2026 CVEs (page 24)
Page 24 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-71474 | Medium | 6.3 | 2026-08-11 | A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com p… |
CVE-2026-71468 | Medium | 5.3 | 2026-08-11 | A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all su… |
CVE-2026-71467 | High | 7.5 | 2026-08-11 | A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upg… |
CVE-2026-70339 | Medium | 5.4 | 2026-08-11 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-66146 | Medium | 6.1 | 2026-08-11 | Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute… |
CVE-2026-66145 | Critical | 9.1 | 2026-08-11 | An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read… |
CVE-2026-65655 | | 2026-08-11 | When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected… | |
CVE-2026-48813 | | 2026-08-11 | Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue l… | |
CVE-2026-48804 | High | 7.5 | 2026-08-11 | python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in… |
CVE-2026-45618 | Critical | 10.0 | 2026-08-11 | LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Versi… |
CVE-2026-19091 | High | 8.1 | 2026-08-11 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insuffic… |
CVE-2026-18844 | High | 8.1 | 2026-08-11 | The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent… |
CVE-2026-16230 | Critical | 9.8 | 2026-08-11 | The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete_file function in a… |
CVE-2026-13457 | High | 7.5 | 2026-08-11 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6… |
CVE-2026-73228 | Medium | 5.3 | 2026-08-11 | Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._p… |
CVE-2026-73227 | High | 8.1 | 2026-08-11 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write at… |
CVE-2026-73226 | High | 8.8 | 2026-08-11 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client… |
CVE-2026-73225 | High | 8.1 | 2026-08-11 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to… |
CVE-2026-73224 | High | 8.8 | 2026-08-11 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to… |
CVE-2026-73223 | High | 8.1 | 2026-08-11 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write a… |
CVE-2026-73222 | High | 8.8 | 2026-08-11 | Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option… |
CVE-2026-73221 | | 2026-08-11 | CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictab… | |
CVE-2026-72742 | High | 8.6 | 2026-08-11 | DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model o… |
CVE-2026-69119 | High | 8.3 | 2026-08-11 | Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently… |
CVE-2026-69117 | Medium | 6.5 | 2026-08-11 | NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django… |
CVE-2026-69115 | Medium | 6.5 | 2026-08-11 | OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitt… |
CVE-2026-48809 | High | 7.5 | 2026-08-11 | python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python… |
CVE-2026-48802 | High | 7.5 | 2026-08-11 | python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecess… |
CVE-2026-18712 | High | 8.1 | 2026-08-11 | An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause… |
CVE-2026-18711 | High | 7.1 | 2026-08-11 | An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used… |
CVE-2026-18709 | Medium | 6.4 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transa… |
CVE-2026-18708 | Medium | 6.4 | 2026-08-11 | An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed with… |
CVE-2026-18707 | Medium | 4.3 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly… |
CVE-2026-18706 | Medium | 6.6 | 2026-08-11 | An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause… |
CVE-2026-18705 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different… |
CVE-2026-18704 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections… |
CVE-2026-18703 | Medium | 4.2 | 2026-08-11 | An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authe… |
CVE-2026-18702 | Medium | 6.4 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the ent… |
CVE-2026-18701 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by su… |
CVE-2026-18700 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the… |
CVE-2026-18699 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly b… |
CVE-2026-18698 | Medium | 5.4 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that… |
CVE-2026-18697 | High | 7.5 | 2026-08-11 | An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitt… |
CVE-2026-18696 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operati… |
CVE-2026-18695 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write… |
CVE-2026-18694 | High | 7.1 | 2026-08-11 | An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be… |
CVE-2026-18693 | High | 7.6 | 2026-08-11 | An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to… |
CVE-2026-18692 | High | 8.8 | 2026-08-11 | An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to… |
CVE-2026-18691 | High | 8.8 | 2026-08-11 | An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is use… |
CVE-2026-18690 | High | 8.1 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that… |
CVE-2026-18688 | High | 7.1 | 2026-08-11 | An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed nu… |
CVE-2026-18687 | High | 7.1 | 2026-08-11 | MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypt… |
CVE-2026-15426 | High | 8.8 | 2026-08-11 | The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in al… |
CVE-2026-73219 | | 2026-08-11 | CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can su… | |
CVE-2026-73218 | | 2026-08-11 | Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Deskt… | |
CVE-2026-73217 | | 2026-08-11 | Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtu… | |
CVE-2026-73216 | Medium | 6.5 | 2026-08-11 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely c… |
CVE-2026-73215 | | 2026-08-11 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/apps/relay/turn_ports.c marks the unused… | |
CVE-2026-73214 | | 2026-08-11 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtls_server_input_handler() and create_new_connected_udp_socket() in src/… | |
CVE-2026-73213 | | 2026-08-11 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise compa… | |
CVE-2026-73212 | | 2026-08-11 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_turn_server.c uses ioa_addr_in_range()… | |
CVE-2026-73211 | Critical | 9.8 | 2026-08-11 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub… |
CVE-2026-73090 | Critical | 9.3 | 2026-08-11 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update contai… |
CVE-2026-72713 | High | 7.5 | 2026-08-11 | XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files o… |
CVE-2026-72712 | Medium | 6.5 | 2026-08-11 | Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted pa… |
CVE-2026-71398 | Critical | 10.0 | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curren… |
CVE-2026-71362 | Critical | 9.1 | 2026-08-11 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability… |
CVE-2026-69113 | Medium | 5.4 | 2026-08-11 | Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any priva… |
CVE-2026-69102 | Critical | 9.8 | 2026-08-11 | MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attack… |
CVE-2026-65680 | Medium | 6.7 | 2026-08-11 | Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally. |
CVE-2026-48790 | Medium | 5.5 | 2026-08-11 | Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.js… |
CVE-2026-48771 | High | 8.2 | 2026-08-11 | ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side dat… |
CVE-2026-48767 | High | 7.6 | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token… |
CVE-2026-48494 | | 2026-08-11 | TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session th… | |
CVE-2026-48447 | High | 7.7 | 2026-08-11 | Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An… |
CVE-2026-48441 | High | 8.6 | 2026-08-11 | Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary f… |
CVE-2026-48416 | High | 7.5 | 2026-08-11 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerab… |
CVE-2026-48415 | High | 7.6 | 2026-08-11 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage… |
CVE-2026-48414 | High | 7.7 | 2026-08-11 | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts i… |
CVE-2026-48413 | High | 8.7 | 2026-08-11 | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts i… |
CVE-2026-48412 | Low | 2.7 | 2026-08-11 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploi… |
CVE-2026-48411 | Medium | 6.5 | 2026-08-11 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could l… |
CVE-2026-48410 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48409 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48408 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48407 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48406 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48405 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48404 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48397 | High | 8.6 | 2026-08-11 | Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current… |
CVE-2026-48381 | Critical | 9.0 | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re… |
CVE-2026-47940 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2026-47705 | Critical | 9.6 | 2026-08-11 | TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or es… |
CVE-2026-27302 | Critical | 10.0 | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curren… |
CVE-2026-20917 | | 2026-08-11 | Exposure of sensitive information caused by incorrect data forwarding during transient execution for some Intel(R) Processors within Ring 0: Hypervisor and Ker… | |
CVE-2026-20901 | | 2026-08-11 | Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a priv… | |
CVE-2026-20712 | | 2026-08-11 | Incomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may allow an information disclosure. System software adversary with… | |
CVE-2026-0465 | | 2026-08-11 | A Use‑After‑Free (UAF) vulnerability in the AMD Ryzen™ Master Utility Driver could allow a local attacker to access kernel memory, potentially resulting in los… | |
CVE-2026-73089 | High | 7.5 | 2026-08-11 | Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct… |
CVE-2026-73088 | High | 7.5 | 2026-08-11 | Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, re… |