2026 CVEs (page 268)
Page 268 of 469 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47716 | Low | 3.1 | 2026-05-26 | Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, In affected versions, the issue list view authorizes access through the project in the URL, but a… |
CVE-2026-47715 | Low | 3.1 | 2026-05-26 | Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions… |
CVE-2026-46431 | Medium | 4.3 | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the… |
CVE-2026-46430 | Medium | 4.3 | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platfo… |
CVE-2026-45836 | Medium | 5.5 | 2026-05-26 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Add the same NULL gu… |
CVE-2026-45835 | Medium | 5.5 | 2026-05-26 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Add the same NULL… |
CVE-2026-45834 | Medium | 5.5 | 2026-05-26 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Add the same NULL gu… |
CVE-2026-45728 | High | 7.5 | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode… |
CVE-2026-45721 | Critical | 9.0 | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index f… |
CVE-2026-44729 | High | 8.7 | 2026-05-26 | Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using… |
CVE-2026-44723 | Medium | 5.0 | 2026-05-26 | Vowpal Wabbit is a machine learning system. The workflow .github/workflows/python_checks.yml embeds ${{ github.event.pull_request.title }} directly inside doub… |
CVE-2026-44680 | High | 7.6 | 2026-05-26 | MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.1… |
CVE-2026-44502 | Medium | 4.3 | 2026-05-26 | Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsi… |
CVE-2026-44314 | Medium | 4.3 | 2026-05-26 | Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.Permission(User… |
CVE-2026-43982 | | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn() in lua/upload/upload.go uses filepath.Join() with the caller-suppl… | |
CVE-2026-43981 | | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, in engine/luahandler.go, the sync.RWMutex protecting LoadCommonFunctions is released be… | |
CVE-2026-40384 | High | 7.5 | 2026-05-26 | An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability. |
CVE-2026-40383 | Critical | 9.8 | 2026-05-26 | An improper validation of user-supplied input leads to a local file inclusion vulnerability. |
CVE-2026-35223 | Critical | 9.8 | 2026-05-26 | An improper access check allows unauthorized access to com_config webservice endpoints. |
CVE-2026-35222 | Critical | 9.8 | 2026-05-26 | Improperly validated order clauses lead to a SQL injection vulnerability in com_tags. |
CVE-2026-35221 | Critical | 9.8 | 2026-05-26 | Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder. |
CVE-2026-35220 | Medium | 4.3 | 2026-05-26 | Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users. |
CVE-2026-30895 | Medium | 6.1 | 2026-05-26 | Lack of output escaping leads to a XSS vector in the readmore links for com_content. |
CVE-2026-30894 | Medium | 6.1 | 2026-05-26 | Lack of output escaping leads to a XSS vector in the content history component. |
CVE-2026-2264 | | 2026-05-26 | A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate s… | |
CVE-2026-25901 | Medium | 6.1 | 2026-05-26 | Lack of output escaping leads to a XSS vector in the multilingual associations component. |
CVE-2026-25900 | Medium | 6.1 | 2026-05-26 | Lack of output escaping leads to a XSS vector in the feed modules. |
CVE-2026-24212 | High | 7.5 | 2026-05-26 | NVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive information is transmitted in clear text. A successful exploit of this vulnerability… |
CVE-2026-24162 | High | 7.8 | 2026-05-26 | NVIDIA Transformers4Rec for Linux contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of th… |
CVE-2026-48692 | High | 8.1 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism. The server is initialized with grpc::Insec… |
CVE-2026-48688 | High | 7.5 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains multiple out-of-bounds reads in the BGP MP_REACH_NLRI IPv6 attribute decoder. The function decode_mp_reach_… |
CVE-2026-48687 | Critical | 9.8 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _log() function in src/… |
CVE-2026-48686 | Critical | 9.8 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI (Network Layer Reachability Information) decoder. The functio… |
CVE-2026-48685 | Medium | 6.5 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly parses BGP path attributes with the extended length flag set… |
CVE-2026-48684 | Medium | 6.5 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the NetFlow v9 options template parser. In process_netflow_v9_options_template() (… |
CVE-2026-48683 | Medium | 6.5 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor. In src/netflow_plugin/netflow… |
CVE-2026-46620 | Medium | 6.5 | 2026-05-26 | e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem… |
CVE-2026-43936 | Medium | 4.3 | 2026-05-26 | e107 is a content management system (CMS). Prior to 2.3.4, you can access the local environment by specifying the URL of the local environment from "Image/File… |
CVE-2026-43935 | High | 8.1 | 2026-05-26 | e107 is a content management system (CMS). Prior to 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to manipulate the… |
CVE-2026-43934 | Medium | 6.5 | 2026-05-26 | e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authentica… |
CVE-2026-40564 | Medium | 6.5 | 2026-05-26 | Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob… |
CVE-2026-38587 | Medium | 4.3 | 2026-05-26 | An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ONLYOFFICE DocSpace before 3.2.1. The flaw exists in multiple REST API endpoints. Th… |
CVE-2026-25112 | High | 7.8 | 2026-05-26 | A high-severity vulnerability in the deployment of Genetec RabbitMQ that allows a privilege escalation attack. |
CVE-2026-9552 | High | 7.3 | 2026-05-26 | A security flaw has been discovered in Das Parking Management System 停车场管理系统 6.2.0. This vulnerability affects unknown code of the component Search API Endpoin… |
CVE-2026-9551 | High | 7.3 | 2026-05-26 | A vulnerability was identified in Das Parking Management System 停车场管理系统 6.2.0. This affects the function xp_cmdshell of the file ParkingRecord/ExportParkingRec… |
CVE-2026-9550 | High | 7.3 | 2026-05-26 | A vulnerability was determined in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. Affected by this issue is some unknown… |
CVE-2026-4480 | Critical | 9.0 | 2026-05-26 | A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command"… |
CVE-2026-46368 | High | 8.8 | 2026-05-26 | luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packa… |
CVE-2026-45247 | Critical | 9.8 | 2026-05-26 | Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to ach… |
CVE-2026-45082 | High | 7.6 | 2026-05-26 | Karakeep is a elf-hostable bookmark-everything app. A Server-Side Request Forgery (SSRF) protection bypass vulnerability was identified in versions prior to 0… |
CVE-2026-42785 | High | 7.2 | 2026-05-26 | OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /adm… |
CVE-2026-42425 | High | 7.2 | 2026-05-26 | OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against t… |
CVE-2026-41917 | Medium | 4.9 | 2026-05-26 | OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrat… |
CVE-2026-41401 | Medium | 6.5 | 2026-05-26 | libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freei… |
CVE-2026-40034 | High | 7.8 | 2026-05-26 | gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the… |
CVE-2026-40033 | High | 8.8 | 2026-05-26 | FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The… |
CVE-2026-9544 | High | 7.3 | 2026-05-26 | A vulnerability was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 10. Affected by this vulnerability is an unknown functiona… |
CVE-2026-9543 | Critical | 9.8 | 2026-05-26 | A vulnerability has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the componen… |
CVE-2026-9542 | Medium | 6.3 | 2026-05-26 | A weakness has been identified in CodeAstro Leave Management System 1.0. The affected element is an unknown function of the file /admin/add_staff.php. Executin… |
CVE-2026-9541 | Medium | 5.3 | 2026-05-26 | A security flaw has been discovered in Squirrel up to 3.2. Impacted is the function ReadObject of the file squirrel/sqobject.cpp of the component Cnut File Han… |
CVE-2026-9540 | Medium | 5.3 | 2026-05-26 | A vulnerability was identified in vllm-project vllm 0.19.0. This issue affects some unknown processing of the component OpenAI-compatible Serving Path. Such ma… |
CVE-2026-8479 | | 2026-05-26 | IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence of messages is sent for a… | |
CVE-2026-8174 | Medium | 5.7 | 2026-05-26 | Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF). This issue affects Zoho Mail wordpress plugin versions before 1.6.2. |
CVE-2026-7374 | Critical | 9.9 | 2026-05-26 | A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to… |
CVE-2026-7310 | | 2026-05-26 | A heap-based buffer overflow vulnerability exists in XML parser functionality in the HiDraw. An authenticated malicious user with local access can exploit this… | |
CVE-2026-48136 | Medium | 4.1 | 2026-05-26 | When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can mod… |
CVE-2026-48135 | Medium | 5.3 | 2026-05-26 | A Check Point HTTP-based service can incorrectly handle malformed HTTP requests. The issue is related to HTTP request parsing and validation. |
CVE-2026-48134 | Medium | 5.6 | 2026-05-26 | When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access… |
CVE-2026-48133 | High | 7.5 | 2026-05-26 | When the Identity Awareness blade is enabled with Browser-Based Authentication, an unauthenticated user may be able to read certain internal files on the Secur… |
CVE-2026-48132 | High | 8.1 | 2026-05-26 | The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UDP). As a result, a specially crafted or malfo… |
CVE-2026-48131 | High | 8.1 | 2026-05-26 | The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage of a connection attempt. This can cause… |
CVE-2026-44410 | Low | 3.8 | 2026-05-26 | This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, deviating from the… |
CVE-2026-39661 | High | 7.5 | 2026-05-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magentech SW Core allows PHP Local Fil… |
CVE-2026-39642 | Medium | 5.3 | 2026-05-26 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in SpabRice Nyla allows Code Injection. This issue affects Nyla: f… |
CVE-2026-27427 | Medium | 6.5 | 2026-05-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup allows Stored XSS. This issue affe… |
CVE-2026-25713 | High | 7.8 | 2026-05-26 | MediaArea MediaInfoLib ID3v2 parsing heap buffer overflow vulnerability |
CVE-2026-25104 | High | 7.8 | 2026-05-26 | MediaArea MediaInfoLib LXF parsing heap-based buffer overflow vulnerability |
CVE-2026-24638 | Medium | 4.3 | 2026-05-26 | Missing Authorization vulnerability in Webful Creations RepairBuddy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affect… |
CVE-2026-24590 | Medium | 5.3 | 2026-05-26 | Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels. T… |
CVE-2026-8047 | High | 7.5 | 2026-05-26 | The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated… |
CVE-2026-8046 | High | 8.1 | 2026-05-26 | The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerabil… |
CVE-2026-44469 | High | 7.8 | 2026-05-26 | The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileg… |
CVE-2026-44468 | High | 7.8 | 2026-05-26 | The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to m… |
CVE-2026-39655 | Medium | 5.3 | 2026-05-26 | Missing Authorization vulnerability in TeconceTheme Mayosis Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects M… |
CVE-2026-9534 | Medium | 6.3 | 2026-05-26 | A flaw has been found in Totolink CA750-PoE 6.2c.510. This affects the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component Setting Hand… |
CVE-2026-9533 | Medium | 6.3 | 2026-05-26 | A vulnerability was detected in Totolink CA750-PoE 6.2c.510. The impacted element is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi of the comp… |
CVE-2026-9532 | Medium | 6.3 | 2026-05-26 | A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUploadUserData of the file /cgi-bin/cstecgi… |
CVE-2026-9496 | High | 7.5 | 2026-05-26 | Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this… |
CVE-2026-9495 | High | 7.3 | 2026-05-26 | Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the… |
CVE-2026-3314 | Medium | 4.6 | 2026-05-26 | Missing password field masking vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view, Hitachi Ops Center Analyzer probe modules… |
CVE-2026-9531 | Medium | 6.3 | 2026-05-26 | A weakness has been identified in Totolink CA750-PoE 6.2c.510. Impacted is the function setUpgradeUboot of the file /cgi-bin/cstecgi.cgi of the component Setti… |
CVE-2026-9530 | Low | 3.3 | 2026-05-26 | A weakness has been identified in GNU LibreDWG up to 0.14. The impacted element is the function read_2004_compressed_section of the file src/decode.c of the co… |
CVE-2026-9529 | Low | 3.3 | 2026-05-26 | A security flaw has been discovered in GNU LibreDWG up to 0.14. The affected element is the function match_BLOCK_HEADER of the file dwggrep.c of the component… |
CVE-2026-9528 | High | 7.3 | 2026-05-26 | A vulnerability was identified in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /admin/delete_judge.php. Such manipul… |
CVE-2026-9527 | Medium | 4.3 | 2026-05-26 | A vulnerability was determined in itsourcecode Electronic Judging System 1.0. This issue affects some unknown processing of the file /admin/judges.php. This ma… |
CVE-2026-9526 | High | 7.3 | 2026-05-26 | A vulnerability was found in itsourcecode Electronic Judging System 1.0. This vulnerability affects unknown code of the file /admin/edit_team.php. The manipula… |
CVE-2026-9525 | High | 7.3 | 2026-05-26 | A vulnerability has been found in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /admin/edit_judge.php. The manipulation… |
CVE-2026-9524 | Medium | 6.3 | 2026-05-26 | A flaw has been found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is the function execute of the component REST Endpoint. Executing… |
CVE-2026-9523 | High | 7.3 | 2026-05-26 | A vulnerability was detected in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV2. Affected by this vulnerability is an… |
CVE-2026-9538 | High | 7.5 | 2026-05-26 | Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payl… |