2026 CVEs (page 238)

Page 238 of 688 — CVEs published in 2026, newest first, with CVSS severity and publication dates.

All CVEs published in 2026 — newest first (page 238 of 688)
CVESeverityScorePublishedSummary
CVE-2026-50576Medium6.82026-08-18ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3…
CVE-2026-50126Medium4.02026-08-18Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote se…
CVE-2026-49228High8.82026-08-18Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allo…
CVE-2026-49225High8.32026-08-18Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operat…
CVE-2026-49224High8.32026-08-18Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operation…
CVE-2026-49223High7.62026-08-18Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operatio…
CVE-2026-49222High7.62026-08-18Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operat…
CVE-2026-48744Medium6.52026-08-18Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly…
CVE-2026-30250Medium6.12026-08-18Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute ar…
CVE-2026-198692026-08-18@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authe…
CVE-2026-18963Critical9.12026-08-18A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build…
CVE-2026-75926High8.62026-08-18Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach th…
CVE-2026-75915High7.52026-08-18CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment…
CVE-2026-75914High7.52026-08-18CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Att…
CVE-2026-75913Critical9.32026-08-18CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev…
CVE-2026-75912High7.42026-08-18CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting g…
CVE-2026-75911High7.82026-08-18CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbi…
CVE-2026-75904Low3.32026-08-18libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index…
CVE-2026-75859High7.52026-08-18CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim…
CVE-2026-75858High7.82026-08-18CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's a…
CVE-2026-75857High7.02026-08-18CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns App…
CVE-2026-75856High8.62026-08-18CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attack…
CVE-2026-75485Medium5.52026-08-18A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing…
CVE-2026-73834Medium5.52026-08-18A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret dat…
CVE-2026-73373Critical9.82026-08-18Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML…
CVE-2026-73371Medium4.32026-08-18Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users…
CVE-2026-73337High7.52026-08-18Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass…
CVE-2026-730732026-08-18Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command…
CVE-2026-72532Medium5.42026-08-18Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthor…
CVE-2026-71574Medium6.52026-08-18Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unau…
CVE-2026-71477Medium6.72026-08-18mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and pa…
CVE-2026-71365High7.72026-08-18A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extr…
CVE-2026-633282026-08-18Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confi…
CVE-2026-62684Low2.72026-08-18File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the…
CVE-2026-623572026-08-18Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width ti…
CVE-2026-55839High8.72026-08-18Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows…
CVE-2026-49227High7.62026-08-18Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allo…
CVE-2026-49226High8.32026-08-18Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a…
CVE-2026-49221High8.82026-08-18Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operation…
CVE-2026-47245Medium4.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly…
CVE-2026-46482Medium5.32026-08-18### Impact The registration component does not validate the text-based _Security Question_ CAPTCHA correctly, allowing attackers to bypass the challenge via a…
CVE-2026-45734Medium5.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attacker…
CVE-2026-45129Medium4.62026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attac…
CVE-2026-45128Low3.52026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attack…
CVE-2026-45127Low3.52026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attacke…
CVE-2026-45126Low3.52026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing…
CVE-2026-45125Medium5.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header inje…
CVE-2026-45124Medium4.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without rep…
CVE-2026-45123Medium4.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side…
CVE-2026-45122Medium4.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when mo…
CVE-2026-45121Medium4.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing auth…
CVE-2026-45120Medium5.42026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewin…
CVE-2026-45119Medium4.62026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-…
CVE-2026-45118Critical9.32026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open r…
CVE-2026-45117Critical9.82026-08-18MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration value…
CVE-2026-45116High8.72026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, res…
CVE-2026-45115High8.72026-08-18MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform J…
CVE-2026-19501High8.82026-08-18CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field nam…
CVE-2026-19500High7.52026-08-18The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fields or submitted con…
CVE-2026-158062026-08-18The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not tak…
CVE-2026-12564Critical9.62026-08-18A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the c…
CVE-2026-75898High8.52026-08-18RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component…
CVE-2026-758722026-08-18HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message…
CVE-2026-75784Critical10.02026-08-18A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the com…
CVE-2026-75032Medium6.32026-08-18A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) im…
CVE-2026-74015Critical9.32026-08-18Unauthenticated SQL Injection in Readabler < 2.0.18 versions.
CVE-2026-74012High8.82026-08-18Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0.
CVE-2026-74009Medium5.32026-08-18Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.
CVE-2026-74008Medium5.32026-08-18Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embe…
CVE-2026-74007Medium5.32026-08-18Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.
CVE-2026-74006Medium4.32026-08-18Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.
CVE-2026-74004Medium5.42026-08-18Subscriber Broken Access Control in Gravity Booster &#8211; Styles &amp; Layouts for Gravity Forms <= 6.0 versions.
CVE-2026-74003Medium4.32026-08-18Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.
CVE-2026-73997High7.52026-08-18Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.
CVE-2026-73996Critical9.82026-08-18Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.
CVE-2026-73995Medium5.42026-08-18Subscriber Broken Authentication in User Registration <= 5.2.6 versions.
CVE-2026-73994High7.52026-08-18Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.
CVE-2026-73426Medium4.62026-08-18Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-seri…
CVE-2026-73404Medium6.52026-08-18Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.
CVE-2026-73400High8.12026-08-18Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.
CVE-2026-73399Medium6.52026-08-18Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.
CVE-2026-73398Medium6.52026-08-18Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.
CVE-2026-73397Critical9.82026-08-18Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
CVE-2026-73396High7.12026-08-18Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.
CVE-2026-73395Medium6.52026-08-18Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.
CVE-2026-73393High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.
CVE-2026-73383Medium4.92026-08-18Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.
CVE-2026-73382High7.12026-08-18Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.T…
CVE-2026-73381Critical9.12026-08-18Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.
CVE-2026-73380Critical9.82026-08-18Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
CVE-2026-73379Medium6.52026-08-18Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.
CVE-2026-73378High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.
CVE-2026-73377High7.52026-08-18Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2026-73376Critical9.82026-08-18Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2026-73375High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2026-73367High7.22026-08-18Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.
CVE-2026-73366Critical9.82026-08-18Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
CVE-2026-73365Critical9.32026-08-18Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.
CVE-2026-73362High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.
CVE-2026-73361High7.12026-08-18Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.