2026 CVEs (page 27)
Page 27 of 661 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-100505 | Medium | 4.4 | 2026-09-26 | Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UT… |
CVE-2026-100504 | High | 7.0 | 2026-09-26 | Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift… |
CVE-2026-100503 | Low | 3.3 | 2026-09-26 | Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect… |
CVE-2026-96795 | High | 8.8 | 2026-09-25 | Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns PO… |
CVE-2026-86066 | | 2026-09-25 | Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ changes attendance_v… | |
CVE-2026-57449 | | 2026-09-25 | Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only fro… | |
CVE-2026-92842 | Medium | 5.9 | 2026-09-25 | The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is… |
CVE-2026-91768 | Medium | 6.5 | 2026-09-25 | The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefi… |
CVE-2026-88003 | | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative… | |
CVE-2026-71483 | | 2026-09-25 | Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/… | |
CVE-2026-63432 | Medium | 6.5 | 2026-09-25 | Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dash… |
CVE-2026-63431 | Medium | 6.5 | 2026-09-25 | Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/component_views.py does not consistently authorize access in allowances_deductions_ta… |
CVE-2026-100502 | Medium | 5.0 | 2026-09-25 | Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain to… |
CVE-2026-100501 | Medium | 6.5 | 2026-09-25 | Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauth… |
CVE-2026-100419 | High | 7.0 | 2026-09-25 | gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree d… |
CVE-2026-100418 | Medium | 5.3 | 2026-09-25 | Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object… |
CVE-2026-100383 | | 2026-09-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extens… | |
CVE-2026-100382 | | 2026-09-25 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Exten… | |
CVE-2026-100381 | | 2026-09-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Exte… | |
CVE-2026-96879 | | 2026-09-25 | Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0. | |
CVE-2026-91769 | Medium | 4.3 | 2026-09-25 | PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC… |
CVE-2026-91767 | Medium | 6.5 | 2026-09-25 | php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard… |
CVE-2026-91766 | Medium | 5.9 | 2026-09-25 | When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the… |
CVE-2026-91765 | High | 7.5 | 2026-09-25 | cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containi… |
CVE-2026-6103 | Medium | 4.3 | 2026-09-25 | phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to… |
CVE-2026-57443 | High | 7.5 | 2026-09-25 | SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`sc… |
CVE-2026-17545 | | 2026-09-25 | On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ whe… | |
CVE-2026-10758 | High | 7.5 | 2026-09-25 | Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer… |
CVE-2026-100417 | Low | 3.1 | 2026-09-25 | RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authenticated peers to read f… |
CVE-2026-100391 | High | 8.2 | 2026-09-25 | MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in… |
CVE-2026-100390 | High | 7.4 | 2026-09-25 | Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers con… |
CVE-2026-100389 | High | 8.1 | 2026-09-25 | GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file… |
CVE-2026-100388 | Medium | 5.4 | 2026-09-25 | RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux… |
CVE-2026-100387 | High | 8.1 | 2026-09-25 | pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users t… |
CVE-2026-100380 | | 2026-09-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extensio… | |
CVE-2026-100379 | | 2026-09-25 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying… | |
CVE-2026-100378 | | 2026-09-25 | Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs. T… | |
CVE-2026-100377 | | 2026-09-25 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issu… | |
CVE-2026-100376 | | 2026-09-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox E… | |
CVE-2026-100369 | High | 8.4 | 2026-09-25 | CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libraries for invoking command-line programs and wrapping executable processes. `Cl… |
CVE-2026-96878 | | 2026-09-25 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This i… | |
CVE-2026-96877 | | 2026-09-25 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This i… | |
CVE-2026-96876 | | 2026-09-25 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This i… | |
CVE-2026-96875 | | 2026-09-25 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This iss… | |
CVE-2026-93682 | Medium | 5.8 | 2026-09-25 | When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end o… |
CVE-2026-5267 | High | 7.5 | 2026-09-25 | Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly enforce authenticat… |
CVE-2026-100373 | Medium | 4.1 | 2026-09-25 | OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hos… |
CVE-2026-100372 | High | 7.2 | 2026-09-25 | ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP… |
CVE-2026-100368 | High | 8.4 | 2026-09-25 | CliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specializations` packages provide specialized wrappers for shells such as Po… |
CVE-2026-100310 | High | 7.0 | 2026-09-25 | GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege che… |
CVE-2026-100208 | High | 7.5 | 2026-09-25 | Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
CVE-2026-97897 | Low | 3.5 | 2026-09-25 | A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component Ti… |
CVE-2026-97896 | Low | 3.5 | 2026-09-25 | A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/… |
CVE-2026-97895 | Medium | 6.3 | 2026-09-25 | A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/… |
CVE-2026-97064 | Critical | 9.1 | 2026-09-25 | X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers… |
CVE-2026-97063 | Critical | 9.1 | 2026-09-25 | X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without… |
CVE-2026-97060 | High | 7.2 | 2026-09-25 | X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership… |
CVE-2026-84465 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email… | |
CVE-2026-84464 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an exte… | |
CVE-2026-84463 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video… | |
CVE-2026-84461 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses fo… | |
CVE-2026-84460 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list an… | |
CVE-2026-84458 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zamm… | |
CVE-2026-63216 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI A… | |
CVE-2026-63208 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the a… | |
CVE-2026-63207 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credential… | |
CVE-2026-63206 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and… | |
CVE-2026-63205 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline image… | |
CVE-2026-63204 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI ana… | |
CVE-2026-63006 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the imag… | |
CVE-2026-61855 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed e… | |
CVE-2026-55217 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete… | |
CVE-2026-55214 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fiel… | |
CVE-2026-53629 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the h… | |
CVE-2026-53628 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth… | |
CVE-2026-53627 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform upda… | |
CVE-2026-53626 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document wi… | |
CVE-2026-53625 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to… | |
CVE-2026-53610 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlle… | |
CVE-2026-49470 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed… | |
CVE-2026-49469 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteri… | |
CVE-2026-48482 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scen… | |
CVE-2026-47679 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation… | |
CVE-2026-45801 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable d… | |
CVE-2026-100306 | Medium | 5.3 | 2026-09-25 | TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated atta… |
CVE-2026-100305 | Medium | 4.3 | 2026-09-25 | TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/form/data/create. Authenticated at… |
CVE-2026-100304 | Medium | 5.3 | 2026-09-25 | TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing auth… |
CVE-2026-100303 | Medium | 5.4 | 2026-09-25 | TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories. Authenticated non-admin… |
CVE-2026-100192 | Medium | 6.5 | 2026-09-25 | X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Un… |
CVE-2026-97886 | Medium | 6.3 | 2026-09-25 | A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an… |
CVE-2026-97885 | High | 7.3 | 2026-09-25 | A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file up… |
CVE-2026-97884 | Medium | 6.3 | 2026-09-25 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the… |
CVE-2026-97883 | High | 7.3 | 2026-09-25 | A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown f… |
CVE-2026-97882 | High | 7.3 | 2026-09-25 | A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown fu… |
CVE-2026-93366 | Medium | 5.4 | 2026-09-25 | Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media fil… |
CVE-2026-91841 | High | 7.8 | 2026-09-25 | A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline chara… |
CVE-2026-91840 | High | 7.8 | 2026-09-25 | A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character i… |
CVE-2026-91839 | High | 7.8 | 2026-09-25 | A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-f… |
CVE-2026-91838 | High | 7.8 | 2026-09-25 | A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special… |
CVE-2026-84462 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypa… |