2026 CVEs (page 270)
Page 270 of 694 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15217 | High | 8.7 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain co… |
CVE-2026-15216 | High | 8.7 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain co… |
CVE-2026-13361 | High | 8.8 | 2026-08-12 | IBM Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field. |
CVE-2026-13267 | High | 8.1 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-12618 | High | 7.2 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-12359 | High | 8.1 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-12005 | High | 7.2 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-12004 | High | 8.7 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-11937 | Low | 3.1 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-11923 | High | 7.4 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-73301 | Medium | 4.3 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted… |
CVE-2026-19311 | High | 8.1 | 2026-08-12 | Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbit… |
CVE-2026-18952 | High | 8.1 | 2026-08-12 | Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform… |
CVE-2026-18678 | | 2026-08-12 | When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over… | |
CVE-2026-18677 | | 2026-08-12 | In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authentic… | |
CVE-2026-18676 | | 2026-08-12 | The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is… | |
CVE-2026-18675 | | 2026-08-12 | The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64… | |
CVE-2026-18673 | | 2026-08-12 | When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interf… | |
CVE-2026-8667 | Medium | 4.3 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain c… |
CVE-2026-7427 | Medium | 5.3 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain co… |
CVE-2026-73300 | Critical | 9.6 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enablin… |
CVE-2026-73299 | Critical | 10.0 | 2026-08-12 | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty te… |
CVE-2026-73298 | | 2026-08-12 | The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving cont… | |
CVE-2026-69106 | High | 8.8 | 2026-08-12 | A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content. |
CVE-2026-49467 | High | 8.8 | 2026-08-12 | Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password v… |
CVE-2026-44741 | High | 8.8 | 2026-08-12 | Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translatio… |
CVE-2026-42018 | High | 7.5 | 2026-08-12 | JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive… |
CVE-2026-18713 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute… |
CVE-2026-18669 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component… |
CVE-2026-18250 | Medium | 6.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to a race conditi… |
CVE-2026-18244 | Medium | 4.3 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain condi… |
CVE-2026-18235 | High | 8.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation. |
CVE-2026-17420 | Medium | 6.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements in… |
CVE-2026-17419 | Medium | 6.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL… |
CVE-2026-17418 | High | 8.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in… |
CVE-2026-17276 | Critical | 9.6 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority… |
CVE-2026-17271 | High | 7.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size. |
CVE-2026-17268 | Medium | 6.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token. |
CVE-2026-17266 | Medium | 6.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restrict… |
CVE-2026-17248 | High | 7.1 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an… |
CVE-2026-17222 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special element… |
CVE-2026-17218 | Critical | 9.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. |
CVE-2026-17110 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privile… |
CVE-2026-17109 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a command due to parameter injection. |
CVE-2026-16956 | Critical | 9.8 | 2026-08-12 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in a… |
CVE-2026-16931 | High | 7.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options. |
CVE-2026-16907 | High | 7.6 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking. |
CVE-2026-16906 | High | 8.8 | 2026-08-12 | IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special… |
CVE-2026-16904 | High | 8.1 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owne… |
CVE-2026-16863 | High | 7.7 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read. |
CVE-2026-16860 | Critical | 9.9 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element. |
CVE-2026-16856 | High | 8.8 | 2026-08-12 | IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of special elements used in an OS command. |
CVE-2026-16627 | High | 7.7 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated… |
CVE-2026-15423 | High | 8.5 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain co… |
CVE-2026-73297 | | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did no… | |
CVE-2026-73296 | Critical | 9.4 | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mo… |
CVE-2026-73295 | Medium | 5.4 | 2026-08-12 | Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/asse… |
CVE-2026-73240 | Critical | 9.8 | 2026-08-12 | Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to up… |
CVE-2026-73239 | Medium | 6.5 | 2026-08-12 | Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: befor… |
CVE-2026-73238 | Medium | 6.1 | 2026-08-12 | XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, whic… |
CVE-2026-73237 | Medium | 6.1 | 2026-08-12 | XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to ver… |
CVE-2026-48554 | High | 7.5 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitu… |
CVE-2026-48553 | High | 7.5 | 2026-08-12 | Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the N… |
CVE-2026-48552 | Medium | 5.4 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflecte… |
CVE-2026-48551 | High | 7.4 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An att… |
CVE-2026-48550 | Medium | 6.1 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthentic… |
CVE-2026-18847 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i. |
CVE-2026-18683 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execut… |
CVE-2026-18499 | High | 8.1 | 2026-08-12 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives. |
CVE-2026-18246 | Low | 3.0 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart par… |
CVE-2026-18144 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization. |
CVE-2026-18106 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input. |
CVE-2026-18098 | High | 8.1 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity due to an XML injectio… |
CVE-2026-17095 | High | 8.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection. |
CVE-2026-17094 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerabi… |
CVE-2026-16694 | Medium | 6.4 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code i… |
CVE-2026-73325 | High | 7.8 | 2026-08-12 | Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supp… |
CVE-2026-73294 | Critical | 9.9 | 2026-08-12 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --uploa… |
CVE-2026-73293 | High | 8.8 | 2026-08-12 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGloba… |
CVE-2026-73292 | High | 8.3 | 2026-08-12 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authe… |
CVE-2026-70547 | Medium | 4.3 | 2026-08-12 | An authenticated user without repository read permission may access package metadata under specific conditions. |
CVE-2026-69107 | Medium | 5.9 | 2026-08-12 | An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions. |
CVE-2026-69105 | High | 8.1 | 2026-08-12 | An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availabili… |
CVE-2026-68971 | Medium | 6.5 | 2026-08-12 | Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` autho… |
CVE-2026-68970 | Medium | 6.5 | 2026-08-12 | Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task log… |
CVE-2026-68969 | Medium | 6.5 | 2026-08-12 | Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH… |
CVE-2026-68968 | High | 7.5 | 2026-08-12 | Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authori… |
CVE-2026-68759 | High | 7.2 | 2026-08-12 | A holder of a valid integration credential may impersonate other users under specific conditions. |
CVE-2026-68758 | Medium | 6.5 | 2026-08-12 | A low-privileged authenticated user may access restricted support information under specific conditions. |
CVE-2026-68076 | Medium | 5.4 | 2026-08-12 | Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent thi… |
CVE-2026-67587 | High | 8.8 | 2026-08-12 | Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback… |
CVE-2026-67260 | High | 7.3 | 2026-08-12 | Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the… |
CVE-2026-66384 | Medium | 5.3 | 2026-08-12 | An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. |
CVE-2026-66016 | Medium | 6.7 | 2026-08-12 | Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users. |
CVE-2026-65941 | High | 8.8 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in… |
CVE-2026-65940 | Medium | 6.8 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server. |
CVE-2026-65939 | Medium | 6.8 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS we… |
CVE-2026-65938 | Medium | 4.3 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke… |
CVE-2026-65937 | High | 8.0 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content. |
CVE-2026-65926 | Low | 3.1 | 2026-08-12 | An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundl… |