2026 CVEs (page 25)
Page 25 of 661 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-100697 | High | 8.6 | 2026-09-26 | Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-au… |
CVE-2026-100696 | Medium | 5.8 | 2026-09-26 | Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/driver… |
CVE-2026-100695 | Medium | 6.1 | 2026-09-26 | Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper esc… |
CVE-2026-100694 | Medium | 6.1 | 2026-09-26 | Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw H… |
CVE-2026-100693 | High | 8.4 | 2026-09-26 | Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to by… |
CVE-2026-100692 | High | 7.5 | 2026-09-26 | Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme… |
CVE-2026-100691 | Medium | 5.4 | 2026-09-26 | Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option befor… |
CVE-2026-100690 | High | 7.5 | 2026-09-26 | Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file sys… |
CVE-2026-100689 | Medium | 5.9 | 2026-09-26 | GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-… |
CVE-2026-100688 | Medium | 6.5 | 2026-09-26 | Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows… |
CVE-2026-100687 | Medium | 5.5 | 2026-09-26 | Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocke… |
CVE-2026-100686 | High | 8.1 | 2026-09-26 | Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign appli… |
CVE-2026-100685 | High | 7.7 | 2026-09-26 | Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across… |
CVE-2026-100684 | High | 8.1 | 2026-09-26 | Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing u… |
CVE-2026-100683 | High | 8.0 | 2026-09-26 | Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers di… |
CVE-2026-100682 | High | 8.8 | 2026-09-26 | Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without p… |
CVE-2026-100681 | Medium | 5.4 | 2026-09-26 | Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoin… |
CVE-2026-100680 | High | 8.1 | 2026-09-26 | Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to… |
CVE-2026-100679 | High | 8.8 | 2026-09-26 | stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket w… |
CVE-2026-100678 | Medium | 6.5 | 2026-09-26 | stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with… |
CVE-2026-100677 | Medium | 5.3 | 2026-09-26 | stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthentica… |
CVE-2026-100676 | High | 8.2 | 2026-09-26 | January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG <image href> values as local filesyste… |
CVE-2026-100675 | Medium | 6.5 | 2026-09-26 | stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated us… |
CVE-2026-100674 | Medium | 4.3 | 2026-09-26 | stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submittin… |
CVE-2026-100673 | High | 8.2 | 2026-09-26 | The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates… |
CVE-2026-100672 | High | 7.5 | 2026-09-26 | The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any… |
CVE-2026-100671 | High | 8.0 | 2026-09-26 | Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page c… |
CVE-2026-100670 | High | 8.8 | 2026-09-26 | Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a `security@: admi… |
CVE-2026-100669 | High | 7.5 | 2026-09-26 | Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config (IIS)… |
CVE-2026-100668 | Medium | 6.5 | 2026-09-26 | Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is on the sandbox allowlist but is regist… |
CVE-2026-100667 | Medium | 5.3 | 2026-09-26 | grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by t… |
CVE-2026-100666 | High | 7.3 | 2026-09-26 | Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each o… |
CVE-2026-100665 | High | 7.5 | 2026-09-26 | Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a pla… |
CVE-2026-100664 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host hea… |
CVE-2026-100663 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets whe… |
CVE-2026-100662 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the Q… |
CVE-2026-100661 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-int… |
CVE-2026-100660 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a… |
CVE-2026-100659 | Medium | 6.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority ps… |
CVE-2026-100654 | Medium | 6.5 | 2026-09-26 | vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates o… |
CVE-2026-100653 | Medium | 6.5 | 2026-09-26 | vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision… |
CVE-2026-100652 | Medium | 5.9 | 2026-09-26 | vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token… |
CVE-2026-100651 | Medium | 6.5 | 2026-09-26 | vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a… |
CVE-2026-100650 | Medium | 6.5 | 2026-09-26 | vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB c… |
CVE-2026-100649 | Low | 3.7 | 2026-09-26 | vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent coun… |
CVE-2026-100648 | Medium | 5.3 | 2026-09-26 | vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file si… |
CVE-2026-100647 | Medium | 5.3 | 2026-09-26 | vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, wh… |
CVE-2026-100646 | High | 8.1 | 2026-09-26 | SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/mo… |
CVE-2026-100645 | High | 8.0 | 2026-09-26 | SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are no… |
CVE-2026-100644 | High | 7.5 | 2026-09-26 | SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without… |
CVE-2026-100643 | High | 8.0 | 2026-09-26 | SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaSc… |
CVE-2026-100642 | High | 7.6 | 2026-09-26 | SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants admin… |
CVE-2026-100641 | High | 8.0 | 2026-09-26 | SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /… |
CVE-2026-100640 | Medium | 4.7 | 2026-09-26 | SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by… |
CVE-2026-100639 | High | 8.8 | 2026-09-26 | SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in… |
CVE-2026-100638 | High | 7.6 | 2026-09-26 | SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitra… |
CVE-2026-100637 | High | 7.6 | 2026-09-26 | SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files… |
CVE-2026-100636 | High | 7.6 | 2026-09-26 | SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitr… |
CVE-2026-100635 | Medium | 5.9 | 2026-09-26 | SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attribu… |
CVE-2026-100634 | Medium | 4.7 | 2026-09-26 | SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process (app/electron/ma… |
CVE-2026-100633 | Medium | 6.5 | 2026-09-26 | SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard (util.IsForbiddenAbsPat… |
CVE-2026-100632 | Medium | 6.5 | 2026-09-26 | Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields cla… |
CVE-2026-100631 | High | 7.5 | 2026-09-26 | Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication l… |
CVE-2026-100630 | Medium | 5.4 | 2026-09-26 | AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attack… |
CVE-2026-100629 | Medium | 5.5 | 2026-09-26 | Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that th… |
CVE-2026-100628 | Medium | 4.3 | 2026-09-26 | capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, reques… |
CVE-2026-100627 | High | 8.1 | 2026-09-26 | Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoi… |
CVE-2026-100626 | Medium | 4.3 | 2026-09-26 | capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage… |
CVE-2026-100625 | High | 7.1 | 2026-09-26 | Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build… |
CVE-2026-100624 | Medium | 5.4 | 2026-09-26 | Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request i… |
CVE-2026-100623 | High | 8.8 | 2026-09-26 | Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies "Allow org… |
CVE-2026-100622 | High | 7.5 | 2026-09-26 | capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers c… |
CVE-2026-100621 | Medium | 4.3 | 2026-09-26 | Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication… |
CVE-2026-100620 | Low | 3.8 | 2026-09-26 | Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Googl… |
CVE-2026-100619 | High | 8.8 | 2026-09-26 | Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed… |
CVE-2026-100618 | High | 8.5 | 2026-09-26 | Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalize… |
CVE-2026-100617 | High | 8.8 | 2026-09-26 | Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant c… |
CVE-2026-100616 | Medium | 5.5 | 2026-09-26 | capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table… |
CVE-2026-100615 | High | 8.8 | 2026-09-26 | Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super… |
CVE-2026-100614 | High | 8.8 | 2026-09-26 | Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows… |
CVE-2026-100613 | Medium | 5.3 | 2026-09-26 | capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of p… |
CVE-2026-100612 | High | 7.2 | 2026-09-26 | Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers… |
CVE-2026-100611 | Medium | 6.5 | 2026-09-26 | Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly created API keys. When a… |
CVE-2026-100610 | High | 7.5 | 2026-09-26 | Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service pe… |
CVE-2026-100609 | Medium | 6.8 | 2026-09-26 | Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOn… |
CVE-2026-100608 | High | 8.3 | 2026-09-26 | Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cl… |
CVE-2026-100607 | High | 7.7 | 2026-09-26 | Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to auth… |
CVE-2026-100606 | High | 7.7 | 2026-09-26 | Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callback arrives with an… |
CVE-2026-100605 | High | 7.1 | 2026-09-26 | Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. At… |
CVE-2026-100604 | Medium | 5.4 | 2026-09-26 | ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerU… |
CVE-2026-100603 | Medium | 5.4 | 2026-09-26 | ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a… |
CVE-2026-100602 | Medium | 6.5 | 2026-09-26 | ClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the publi… |
CVE-2026-100601 | Medium | 5.3 | 2026-09-26 | ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview… |
CVE-2026-100600 | Medium | 5.3 | 2026-09-26 | ClawHub (the openclaw/clawhub application/backend) does not bind anonymous HTTP API requests to a trusted caller identity, so all direct anonymous API requests… |
CVE-2026-100315 | High | 7.3 | 2026-09-26 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the… |
CVE-2026-100314 | High | 7.3 | 2026-09-26 | A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown f… |
CVE-2026-100313 | Medium | 4.3 | 2026-09-26 | A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of t… |
CVE-2026-98163 | | 2026-09-26 | In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea ("cgro… | |
CVE-2026-100312 | Medium | 6.3 | 2026-09-26 | A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unkno… |
CVE-2026-100311 | Low | 3.5 | 2026-09-26 | A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown fu… |