2026 CVEs (page 247)
Page 247 of 691 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-74900 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, genera… |
CVE-2026-74899 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() bu… |
CVE-2026-74896 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute… |
CVE-2026-74895 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute mali… |
CVE-2026-74894 | Critical | 9.8 | 2026-08-17 | openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string wi… |
CVE-2026-74893 | High | 8.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source c… |
CVE-2026-74892 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing… |
CVE-2026-74891 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access… |
CVE-2026-74890 | Medium | 5.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when… |
CVE-2026-74889 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determini… |
CVE-2026-74888 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose s… |
CVE-2026-74887 | Low | 3.7 | 2026-08-17 | openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct… |
CVE-2026-74886 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST… |
CVE-2026-74885 | Low | 3.6 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored mo… |
CVE-2026-74884 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before… |
CVE-2026-74883 | High | 8.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pa… |
CVE-2026-74882 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig t… |
CVE-2026-74881 | Medium | 6.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious w… |
CVE-2026-74880 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from… |
CVE-2026-74879 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to un… |
CVE-2026-74878 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server res… |
CVE-2026-74877 | High | 8.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revo… |
CVE-2026-74876 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying sig… |
CVE-2026-74875 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be acce… |
CVE-2026-74874 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence fun… |
CVE-2026-74873 | Medium | 5.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can… |
CVE-2026-74872 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to l… |
CVE-2026-74871 | Medium | 6.2 | 2026-08-17 | openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation… |
CVE-2026-74870 | Low | 3.3 | 2026-08-17 | openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unc… |
CVE-2026-74869 | High | 7.7 | 2026-08-17 | stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate member… |
CVE-2026-74868 | High | 7.5 | 2026-08-17 | SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTr… |
CVE-2026-74867 | Medium | 4.2 | 2026-08-17 | SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks Origin/Re… |
CVE-2026-74842 | Medium | 6.3 | 2026-08-17 | A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function download_image of the file server… |
CVE-2026-74802 | High | 8.2 | 2026-08-17 | SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origi… |
CVE-2026-74801 | High | 8.2 | 2026-08-17 | SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. A… |
CVE-2026-74800 | Critical | 9.0 | 2026-08-17 | SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripti… |
CVE-2026-74799 | Critical | 9.3 | 2026-08-17 | SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactl… |
CVE-2026-74798 | High | 8.7 | 2026-08-17 | SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool. The tool performs only an empty-string check on the id para… |
CVE-2026-74845 | High | 8.8 | 2026-08-17 | Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload… |
CVE-2026-58561 | Medium | 4.0 | 2026-08-17 | Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-58560 | Medium | 4.0 | 2026-08-17 | Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-49308 | Medium | 5.5 | 2026-08-17 | Permission control vulnerability in the clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-49307 | Medium | 6.2 | 2026-08-17 | Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-49306 | Low | 3.3 | 2026-08-17 | UAF vulnerability in the time and time zone module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-49305 | Medium | 6.2 | 2026-08-17 | Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-49304 | Medium | 6.2 | 2026-08-17 | Permission control vulnerability in the device key management module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-49303 | Medium | 5.1 | 2026-08-17 | Permission control vulnerability in the notification module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-49302 | Medium | 6.2 | 2026-08-17 | Permission control vulnerability in the notification service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-49301 | Medium | 6.2 | 2026-08-17 | Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-20000 | Medium | 6.3 | 2026-08-17 | A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewprescriptionrecord.ph… |
CVE-2026-19999 | Medium | 6.3 | 2026-08-17 | A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ParseB… |
CVE-2026-19998 | Medium | 4.3 | 2026-08-17 | A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulatio… |
CVE-2026-22072 | | 2026-08-17 | Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens. | |
CVE-2026-19997 | Medium | 4.7 | 2026-08-17 | A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown processing of the file /admin/sales/rma/requests of the comp… |
CVE-2026-19996 | Medium | 4.3 | 2026-08-17 | A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Cus… |
CVE-2026-19995 | Low | 3.5 | 2026-08-17 | A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA… |
CVE-2026-19994 | Medium | 6.3 | 2026-08-17 | A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/configuration/cache-management… |
CVE-2026-15623 | | 2026-08-17 | A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform… | |
CVE-2026-74579 | High | 7.1 | 2026-08-17 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: fix mask build for partial field offload nft_payload_offload_mask… |
CVE-2026-19993 | Medium | 4.3 | 2026-08-17 | A vulnerability has been found in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the file /customer/account/rma/upda… |
CVE-2026-19992 | Low | 3.1 | 2026-08-17 | A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the… |
CVE-2026-19988 | Medium | 4.3 | 2026-08-17 | A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component… |
CVE-2026-19987 | Medium | 5.3 | 2026-08-17 | A security vulnerability has been detected in SourceCodester Best Employee Management System 1.0. This affects an unknown function of the file /assets/uploadIm… |
CVE-2026-14832 | Medium | 5.3 | 2026-08-17 | The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to… |
CVE-2026-13700 | Medium | 5.9 | 2026-08-17 | The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integrat… |
CVE-2026-19986 | Medium | 5.4 | 2026-08-17 | A weakness has been identified in Adblock for Youtube Extension up to 7.2.1 on Chrome. The impacted element is the function updateDynamicRules of the file cont… |
CVE-2026-19984 | Medium | 6.3 | 2026-08-17 | A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function get_images of the file src/mcp_florence2/__init__.py. Thi… |
CVE-2026-19983 | High | 8.3 | 2026-08-17 | A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of t… |
CVE-2026-19982 | High | 7.4 | 2026-08-17 | A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC… |
CVE-2026-19981 | High | 7.4 | 2026-08-17 | A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X20… |
CVE-2026-19980 | High | 7.4 | 2026-08-17 | A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000… |
CVE-2026-19979 | High | 8.3 | 2026-08-17 | A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X20… |
CVE-2026-19978 | Medium | 5.3 | 2026-08-17 | A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function child_process.exec o… |
CVE-2026-50602 | | 2026-08-17 | A security vulnerability has been identified in Planet9 due to incorrect file permissions assigned to an application executable used by the Planet9 background… | |
CVE-2026-50601 | | 2026-08-17 | A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal r… | |
CVE-2026-19977 | Critical | 10.0 | 2026-08-17 | A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation… |
CVE-2026-19976 | Medium | 6.6 | 2026-08-17 | A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub_44A968 of the file /cgi-bin/mbox-config?method=SET§ion=… |
CVE-2026-19975 | Low | 3.1 | 2026-08-17 | A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.ph… |
CVE-2026-19974 | Medium | 5.6 | 2026-08-17 | A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/… |
CVE-2026-19973 | Medium | 6.3 | 2026-08-17 | A vulnerability was found in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewpaymentre… |
CVE-2026-19972 | Medium | 6.3 | 2026-08-17 | A vulnerability has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewpatient.php. Such manipulation… |
CVE-2026-19971 | Medium | 4.7 | 2026-08-17 | A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manip… |
CVE-2026-19970 | Medium | 6.3 | 2026-08-17 | A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph_3DGS_MDL7 of the f… |
CVE-2026-19969 | Medium | 5.4 | 2026-08-17 | A security vulnerability has been detected in Open Asset Import Library Assimp 17c12da. The impacted element is the function Assimp::MDLImporter::GenerateOutpu… |
CVE-2026-19968 | Medium | 4.3 | 2026-08-17 | A weakness has been identified in Open Asset Import Library Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ReadFaces_3DGS_MDL7 in th… |
CVE-2026-19967 | Medium | 6.3 | 2026-08-17 | A security flaw has been discovered in Open Asset Import Library Assimp 17c12da. Impacted is the function Assimp::Compression::decompressBlock of the file code… |
CVE-2026-19966 | Medium | 5.4 | 2026-08-17 | A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save_conta… |
CVE-2026-19965 | Low | 3.7 | 2026-08-17 | A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server… |
CVE-2026-19964 | Medium | 5.5 | 2026-08-17 | A vulnerability was found in Jij-Inc Jij-MCP-Server 0.1.0. This affects the function PythonREPL.run of the file jij_mcp/python_repr.py of the component jm_chec… |
CVE-2026-19963 | High | 7.4 | 2026-08-17 | A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function stainfo of the file /goform/stainfo. The manipulation of the a… |
CVE-2026-19962 | High | 7.4 | 2026-08-17 | A flaw has been found in Edimax EW-7478APC 1.04. Affected by this vulnerability is the function setWAN of the file /goform/setWAN. Executing a manipulation of… |
CVE-2026-19961 | Critical | 9.9 | 2026-08-16 | A vulnerability was detected in Edimax EW-7478APC 1.04. Affected is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey. Performing a manipulati… |
CVE-2026-19960 | High | 7.4 | 2026-08-16 | A security vulnerability has been detected in Edimax EW-7478APC 1.04. This impacts the function formWlbasic of the file /goform/formWlbasic. Such manipulation… |
CVE-2026-19959 | Critical | 9.9 | 2026-08-16 | A weakness has been identified in Edimax EW-7478APC 1.04. This affects the function formWanTcpipSetup of the file /goform/formWanTcpipSetup. This manipulation… |
CVE-2026-19958 | Medium | 6.3 | 2026-08-16 | A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the com… |
CVE-2026-19957 | Medium | 6.3 | 2026-08-16 | A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. This affects the function fetch of the file src/tools.ts of the component ssrf-test Endpo… |
CVE-2026-19956 | Medium | 6.3 | 2026-08-16 | A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetch_pagination_url of the file server.py. S… |
CVE-2026-19955 | Low | 3.5 | 2026-08-16 | A vulnerability was detected in TrailDB 0.6. Impacted is the function tdb_open of the file /src/tdb.c of the component TOC Validation. The manipulation results… |
CVE-2026-74797 | Low | 3.1 | 2026-08-16 | OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provid… |
CVE-2026-74796 | Medium | 6.1 | 2026-08-16 | OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a… |