2026 CVEs (page 243)
Page 243 of 691 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32466 | High | 8.5 | 2026-08-18 | Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions. |
CVE-2026-32465 | High | 8.8 | 2026-08-18 | Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions. |
CVE-2026-32464 | High | 8.1 | 2026-08-18 | Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions. |
CVE-2026-32463 | Critical | 9.9 | 2026-08-18 | Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions. |
CVE-2026-32444 | Critical | 9.9 | 2026-08-18 | Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions. |
CVE-2026-32333 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions. |
CVE-2026-28571 | High | 7.5 | 2026-08-18 | Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions. |
CVE-2026-28570 | High | 8.1 | 2026-08-18 | Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions. |
CVE-2026-28569 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions. |
CVE-2026-28568 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions. |
CVE-2026-28567 | High | 7.5 | 2026-08-18 | Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions. |
CVE-2026-28192 | Critical | 9.6 | 2026-08-18 | Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions. |
CVE-2026-28191 | High | 8.8 | 2026-08-18 | Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0. |
CVE-2026-24301 | High | 8.8 | 2026-08-18 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose informatio… |
CVE-2026-17084 | | 2026-08-18 | The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the… | |
CVE-2026-75874 | Critical | 10.0 | 2026-08-18 | Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, F… |
CVE-2026-75783 | Critical | 9.6 | 2026-08-18 | A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netif… |
CVE-2026-75778 | High | 7.3 | 2026-08-18 | A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select_with_multiple_condition of the file /in… |
CVE-2026-74990 | Critical | 9.8 | 2026-08-18 | Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or… |
CVE-2026-74989 | Critical | 9.8 | 2026-08-18 | Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume th… |
CVE-2026-74988 | Critical | 9.8 | 2026-08-18 | Internally found bugs present in Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevan… |
CVE-2026-74987 | Critical | 9.8 | 2026-08-18 | Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or… |
CVE-2026-74986 | Critical | 9.1 | 2026-08-18 | Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunder… |
CVE-2026-74985 | Critical | 9.8 | 2026-08-18 | Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153… |
CVE-2026-74984 | Medium | 6.8 | 2026-08-18 | Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74983 | High | 8.1 | 2026-08-18 | Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, T… |
CVE-2026-74982 | High | 7.5 | 2026-08-18 | Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74981 | High | 8.1 | 2026-08-18 | Site isolation issue in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird… |
CVE-2026-74980 | Medium | 6.5 | 2026-08-18 | Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154. |
CVE-2026-74979 | Critical | 9.8 | 2026-08-18 | Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74978 | High | 8.1 | 2026-08-18 | Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74977 | High | 7.5 | 2026-08-18 | Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74976 | Medium | 6.5 | 2026-08-18 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154… |
CVE-2026-74975 | Medium | 5.4 | 2026-08-18 | Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154. |
CVE-2026-74974 | Medium | 5.4 | 2026-08-18 | Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR… |
CVE-2026-74973 | Medium | 4.2 | 2026-08-18 | Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153… |
CVE-2026-74972 | Medium | 4.3 | 2026-08-18 | Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbir… |
CVE-2026-74971 | Medium | 4.3 | 2026-08-18 | Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Th… |
CVE-2026-74970 | Medium | 5.4 | 2026-08-18 | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74969 | High | 8.8 | 2026-08-18 | Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1… |
CVE-2026-74968 | Medium | 5.4 | 2026-08-18 | Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153… |
CVE-2026-74967 | Medium | 5.4 | 2026-08-18 | Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbi… |
CVE-2026-74966 | High | 7.5 | 2026-08-18 | Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74965 | High | 8.8 | 2026-08-18 | Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, T… |
CVE-2026-74964 | Critical | 9.8 | 2026-08-18 | Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 14… |
CVE-2026-74963 | Medium | 5.4 | 2026-08-18 | Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird… |
CVE-2026-74962 | High | 8.1 | 2026-08-18 | Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154… |
CVE-2026-74961 | Critical | 9.1 | 2026-08-18 | Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74960 | High | 8.1 | 2026-08-18 | Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thund… |
CVE-2026-74959 | Critical | 9.1 | 2026-08-18 | Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thu… |
CVE-2026-74958 | High | 7.5 | 2026-08-18 | Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74957 | High | 8.1 | 2026-08-18 | Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderb… |
CVE-2026-74956 | Critical | 9.1 | 2026-08-18 | Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbi… |
CVE-2026-74955 | High | 8.8 | 2026-08-18 | Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74954 | High | 7.5 | 2026-08-18 | Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154… |
CVE-2026-74953 | High | 8.8 | 2026-08-18 | Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154… |
CVE-2026-74952 | High | 8.8 | 2026-08-18 | Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153… |
CVE-2026-74951 | Medium | 6.5 | 2026-08-18 | Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154. |
CVE-2026-74950 | High | 8.8 | 2026-08-18 | Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74949 | High | 8.8 | 2026-08-18 | Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 15… |
CVE-2026-74948 | Medium | 6.5 | 2026-08-18 | Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thund… |
CVE-2026-74947 | High | 8.8 | 2026-08-18 | Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thu… |
CVE-2026-74946 | High | 8.8 | 2026-08-18 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115… |
CVE-2026-74945 | Medium | 6.5 | 2026-08-18 | Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1… |
CVE-2026-74944 | Critical | 9.8 | 2026-08-18 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderb… |
CVE-2026-74943 | Critical | 9.8 | 2026-08-18 | Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thu… |
CVE-2026-74942 | High | 8.8 | 2026-08-18 | Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR… |
CVE-2026-74941 | High | 8.8 | 2026-08-18 | Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 15… |
CVE-2026-74940 | Critical | 9.8 | 2026-08-18 | Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunder… |
CVE-2026-74939 | High | 8.8 | 2026-08-18 | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1… |
CVE-2026-74938 | Critical | 9.1 | 2026-08-18 | Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74937 | High | 8.8 | 2026-08-18 | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74936 | Critical | 9.8 | 2026-08-18 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, T… |
CVE-2026-74935 | High | 8.8 | 2026-08-18 | Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1… |
CVE-2026-74934 | High | 7.5 | 2026-08-18 | Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 1… |
CVE-2026-59781 | High | 7.8 | 2026-08-18 | When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access… |
CVE-2026-45532 | | 2026-08-18 | DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windo… | |
CVE-2026-23938 | Medium | 4.9 | 2026-08-18 | An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading t… |
CVE-2026-23937 | Medium | 6.5 | 2026-08-18 | The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. |
CVE-2026-23935 | Medium | 4.9 | 2026-08-18 | A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potenti… |
CVE-2026-23934 | Medium | 6.5 | 2026-08-18 | An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.ap… |
CVE-2026-23933 | Critical | 9.1 | 2026-08-18 | In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation… |
CVE-2026-23931 | Medium | 4.3 | 2026-08-18 | The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confident… |
CVE-2026-23930 | High | 7.5 | 2026-08-18 | An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.tes… |
CVE-2026-23929 | Medium | 5.4 | 2026-08-18 | Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous proper… |
CVE-2026-23922 | Medium | 4.9 | 2026-08-18 | The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were ma… |
CVE-2026-1199 | Low | 3.7 | 2026-08-18 | Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent… |
CVE-2026-18751 | | 2026-08-18 | External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue affects WorkSpace App: 2607. | |
CVE-2026-16309 | Medium | 5.3 | 2026-08-18 | Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrain… |
CVE-2026-75855 | High | 8.7 | 2026-08-18 | ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing auth… |
CVE-2026-75854 | Critical | 9.8 | 2026-08-18 | ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read… |
CVE-2026-75853 | High | 8.8 | 2026-08-18 | ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorizatio… |
CVE-2026-75852 | Critical | 9.8 | 2026-08-18 | ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue i… |
CVE-2026-75851 | Critical | 9.9 | 2026-08-18 | ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker thr… |
CVE-2026-75850 | Medium | 4.2 | 2026-08-18 | ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on… |
CVE-2026-75846 | High | 7.1 | 2026-08-18 | ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStateme… |
CVE-2026-75845 | Medium | 6.3 | 2026-08-18 | ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.exe… |
CVE-2026-75844 | High | 7.1 | 2026-08-18 | ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and ch… |
CVE-2026-75843 | Critical | 9.9 | 2026-08-18 | ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to… |
CVE-2026-75842 | High | 7.7 | 2026-08-18 | ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read loc… |