2026 CVEs (page 24)
Page 24 of 660 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-100860 | Medium | 5.5 | 2026-09-27 | heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backend/app/services/node_execution/nodes/red… |
CVE-2026-100859 | Medium | 6.5 | 2026-09-27 | Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credentia… |
CVE-2026-100858 | Medium | 6.8 | 2026-09-27 | heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP requests to… |
CVE-2026-100857 | High | 8.0 | 2026-09-27 | AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolat… |
CVE-2026-100856 | High | 8.8 | 2026-09-27 | AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpStrin… |
CVE-2026-100855 | Medium | 6.5 | 2026-09-27 | AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows authenticate… |
CVE-2026-100854 | Medium | 6.3 | 2026-09-27 | AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence… |
CVE-2026-100853 | Medium | 5.9 | 2026-09-27 | In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download m… |
CVE-2026-100852 | High | 8.8 | 2026-09-27 | AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer user… |
CVE-2026-100851 | High | 7.6 | 2026-09-27 | AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with o… |
CVE-2026-100850 | High | 7.7 | 2026-09-27 | AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (backend/src/Radio/AutoDJ/… |
CVE-2026-100849 | High | 7.1 | 2026-09-27 | AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl() (back… |
CVE-2026-100848 | High | 7.1 | 2026-09-27 | AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme (Utilities… |
CVE-2026-100847 | High | 7.5 | 2026-09-27 | AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitra… |
CVE-2026-100846 | High | 7.6 | 2026-09-27 | MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads… |
CVE-2026-100845 | High | 7.8 | 2026-09-27 | MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when l… |
CVE-2026-100844 | High | 8.4 | 2026-09-27 | MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from… |
CVE-2026-100843 | High | 7.8 | 2026-09-27 | MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in mo… |
CVE-2026-100842 | High | 7.0 | 2026-09-27 | MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions… |
CVE-2026-100841 | High | 7.8 | 2026-09-27 | In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache Me… |
CVE-2026-100840 | High | 7.8 | 2026-09-27 | MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable cal… |
CVE-2026-100839 | High | 8.4 | 2026-09-27 | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection… |
CVE-2026-100838 | High | 8.1 | 2026-09-27 | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw… |
CVE-2026-100837 | Low | 3.7 | 2026-09-27 | Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor… |
CVE-2026-100836 | Medium | 4.3 | 2026-09-27 | Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decod… |
CVE-2026-100835 | High | 7.4 | 2026-09-27 | Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained t… |
CVE-2026-100834 | Medium | 5.9 | 2026-09-27 | http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter… |
CVE-2026-100833 | High | 8.2 | 2026-09-27 | Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase dur… |
CVE-2026-100745 | Medium | 6.3 | 2026-09-27 | A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the component Wireles… |
CVE-2026-100744 | High | 7.3 | 2026-09-27 | A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of t… |
CVE-2026-100725 | Medium | 6.5 | 2026-09-27 | http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilte… |
CVE-2026-100724 | Medium | 5.4 | 2026-09-27 | http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in revers… |
CVE-2026-100723 | High | 7.5 | 2026-09-27 | vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host… |
CVE-2026-100722 | Medium | 6.8 | 2026-09-27 | vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromi… |
CVE-2026-100721 | Critical | 9.0 | 2026-09-27 | vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolve… |
CVE-2026-100740 | Critical | 9.9 | 2026-09-27 | A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP Control Channe… |
CVE-2026-100739 | High | 7.3 | 2026-09-26 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the… |
CVE-2026-94408 | Medium | 4.9 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94400 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94399 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94398 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94397 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94396 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-82300 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). |
CVE-2026-82294 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). |
CVE-2026-78582 | Medium | 6.5 | 2026-09-26 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC… |
CVE-2026-72668 | High | 7.3 | 2026-09-26 | Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit… |
CVE-2026-72662 | Medium | 6.3 | 2026-09-26 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Func… |
CVE-2026-82901 | Critical | 9.8 | 2026-09-26 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_ma… |
CVE-2026-85984 | Critical | 9.8 | 2026-09-26 | The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter i… |
CVE-2026-77203 | High | 8.8 | 2026-09-26 | The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due… |
CVE-2026-97163 | | 2026-09-26 | Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | |
CVE-2026-97162 | | 2026-09-26 | Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | |
CVE-2026-97161 | | 2026-09-26 | Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | |
CVE-2026-97160 | | 2026-09-26 | Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | |
CVE-2026-94132 | | 2026-09-26 | Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of i… | |
CVE-2026-94131 | | 2026-09-26 | Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a… | |
CVE-2026-94130 | | 2026-09-26 | Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An SQL injection vulnerability in video search functio… | |
CVE-2026-100720 | High | 8.7 | 2026-09-26 | Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificat… |
CVE-2026-100719 | Medium | 6.5 | 2026-09-26 | Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. A… |
CVE-2026-100718 | High | 7.1 | 2026-09-26 | Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled the allowe… |
CVE-2026-100717 | Critical | 9.9 | 2026-09-26 | froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the pa… |
CVE-2026-100716 | Critical | 9.9 | 2026-09-26 | Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path componen… |
CVE-2026-100715 | Critical | 9.6 | 2026-09-26 | Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued w… |
CVE-2026-100714 | Critical | 9.1 | 2026-09-26 | Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no… |
CVE-2026-100713 | High | 7.8 | 2026-09-26 | Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php… |
CVE-2026-100712 | Medium | 6.5 | 2026-09-26 | froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g… |
CVE-2026-100711 | High | 7.5 | 2026-09-26 | froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding h… |
CVE-2026-100710 | Medium | 4.9 | 2026-09-26 | Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of Sub… |
CVE-2026-100709 | High | 7.5 | 2026-09-26 | Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-to… |
CVE-2026-100708 | High | 7.1 | 2026-09-26 | Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.g… |
CVE-2026-100707 | High | 7.7 | 2026-09-26 | Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation… |
CVE-2026-100706 | Critical | 9.9 | 2026-09-26 | kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace cl… |
CVE-2026-100705 | High | 7.6 | 2026-09-26 | Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253, metadata.google.internal, 1… |
CVE-2026-100704 | High | 7.7 | 2026-09-26 | Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator never reads the… |
CVE-2026-100703 | High | 7.7 | 2026-09-26 | Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the… |
CVE-2026-100702 | Medium | 5.9 | 2026-09-26 | Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhausti… |
CVE-2026-100701 | Medium | 5.9 | 2026-09-26 | Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-speci… |
CVE-2026-100700 | High | 7.5 | 2026-09-26 | nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking… |
CVE-2026-100699 | Medium | 5.3 | 2026-09-26 | Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part… |
CVE-2026-100698 | Medium | 5.8 | 2026-09-26 | Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture grou… |
CVE-2026-100697 | High | 8.6 | 2026-09-26 | Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-au… |
CVE-2026-100696 | Medium | 5.8 | 2026-09-26 | Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/driver… |
CVE-2026-100695 | Medium | 6.1 | 2026-09-26 | Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper esc… |
CVE-2026-100694 | Medium | 6.1 | 2026-09-26 | Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw H… |
CVE-2026-100693 | High | 8.4 | 2026-09-26 | Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to by… |
CVE-2026-100692 | High | 7.5 | 2026-09-26 | Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme… |
CVE-2026-100691 | Medium | 5.4 | 2026-09-26 | Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option befor… |
CVE-2026-100690 | High | 7.5 | 2026-09-26 | Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file sys… |
CVE-2026-100689 | Medium | 5.9 | 2026-09-26 | GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-… |
CVE-2026-100688 | Medium | 6.5 | 2026-09-26 | Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows… |
CVE-2026-100687 | Medium | 5.5 | 2026-09-26 | Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocke… |
CVE-2026-100686 | High | 8.1 | 2026-09-26 | Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign appli… |
CVE-2026-100685 | High | 7.7 | 2026-09-26 | Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across… |
CVE-2026-100684 | High | 8.1 | 2026-09-26 | Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing u… |
CVE-2026-100683 | High | 8.0 | 2026-09-26 | Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers di… |
CVE-2026-100682 | High | 8.8 | 2026-09-26 | Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without p… |
CVE-2026-100681 | Medium | 5.4 | 2026-09-26 | Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoin… |
CVE-2026-100680 | High | 8.1 | 2026-09-26 | Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to… |
CVE-2026-100679 | High | 8.8 | 2026-09-26 | stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket w… |