2026 CVEs (page 271)
Page 271 of 469 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9378 | Medium | 6.3 | 2026-05-24 | A security flaw has been discovered in Edimax BR-6675nD 1.12. This affects the function formHwSet of the file /goform/formHwSet of the component POST Request H… |
CVE-2026-9377 | Low | 2.4 | 2026-05-24 | A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file /admin/productedit.php. The m… |
CVE-2026-9376 | Medium | 6.3 | 2026-05-24 | A vulnerability was determined in JPress up to 1.0.3. The affected element is an unknown function of the file /ucenter/article/doWriteSave of the component UCe… |
CVE-2026-9374 | Medium | 6.3 | 2026-05-24 | A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. Impacted is the function FileUploadUtils.upload of the file /common/upload of the component C… |
CVE-2026-9373 | Low | 3.7 | 2026-05-24 | A vulnerability has been found in JeecgBoot 3.9.1. This issue affects some unknown processing of the file /openapi/call/ of the component OpenAPI Endpoint. Suc… |
CVE-2026-9372 | High | 7.3 | 2026-05-24 | A flaw has been found in ItzCrazyKns Vane up to 1.12.1. This vulnerability affects unknown code of the file src/app/api/providers/route.ts of the component Mod… |
CVE-2026-9371 | Medium | 5.6 | 2026-05-24 | A security vulnerability has been detected in ItzCrazyKns Vane up to 1.12.1. Affected by this issue is some unknown functionality of the file route.ts of the c… |
CVE-2026-9370 | Low | 3.7 | 2026-05-24 | A weakness has been identified in ulisesbocchio jasypt-spring-boot up to 3.0.5/4.0.4. Affected by this vulnerability is the function getSecretKeySaltGenerator… |
CVE-2026-9369 | Medium | 5.3 | 2026-05-24 | A security flaw has been discovered in NousResearch hermes-agent 2026.4.23. Affected is the function _discover_dashboard_plugins of the file hermes_cli/web_ser… |
CVE-2026-9368 | High | 7.3 | 2026-05-24 | A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This impacts the function execute_code of the file tools/code_execution_tool.py of… |
CVE-2026-9367 | High | 7.3 | 2026-05-24 | A vulnerability was determined in NousResearch hermes-agent up to 5157f5427f19488b31c6fdebbacd15d798ce7f63. This affects the function detect_dangerous_command… |
CVE-2026-9366 | High | 7.3 | 2026-05-24 | A vulnerability was found in NousResearch hermes-agent 2026.4.23. The impacted element is the function _scan_context_content of the file agent/prompt_builder.p… |
CVE-2026-9365 | Medium | 5.6 | 2026-05-24 | A vulnerability has been found in Ettercap up to 0.8.3. The affected element is the function FUNC_DECODER of the file src/dissectors/ec_gg.c of the component G… |
CVE-2026-9364 | High | 7.3 | 2026-05-24 | A flaw has been found in projectworlds Online Art Gallery Shop 1.0. Impacted is an unknown function of the file /admin/adminHome.php. Executing a manipulation… |
CVE-2026-9363 | Medium | 6.3 | 2026-05-24 | A vulnerability was detected in Edimax EW-7438RPn 1.12. This issue affects the function formEZCHNwlanSetup of the file /goform/formEZCHNwlanSetu of the compone… |
CVE-2026-9362 | Medium | 6.3 | 2026-05-24 | A security vulnerability has been detected in Edimax EW-7438RPn 1.12. This vulnerability affects the function formConnectionSetting of the file /goform/formCon… |
CVE-2026-9361 | Medium | 6.3 | 2026-05-24 | A weakness has been identified in Edimax EW-7438RPn 1.12. This affects the function formAccept of the file /goform/formAccep of the component POST Request Hand… |
CVE-2026-9360 | High | 8.8 | 2026-05-24 | A security flaw has been discovered in Edimax EW-7438RPn 1.28a. Affected by this issue is the function formwlencrypt24g of the file /goform/formwlencrypt24g of… |
CVE-2026-9359 | Medium | 6.3 | 2026-05-24 | A vulnerability was identified in Edimax EW-7438RPn 1.28a. Affected by this vulnerability is the function formHwSet of the file /goform/formHwSet of the compon… |
CVE-2026-9358 | Medium | 4.3 | 2026-05-24 | A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the co… |
CVE-2026-9357 | Low | 3.5 | 2026-05-24 | A vulnerability was found in vBulletin 6.x. This impacts an unknown function of the component Login. Performing a manipulation results in cross site scripting… |
CVE-2026-9356 | High | 7.3 | 2026-05-24 | A vulnerability has been found in SourceCodester Hospitals Patient Records Management System 1.0. This affects an unknown function of the file /admin/patients/… |
CVE-2026-9355 | High | 7.3 | 2026-05-24 | A flaw has been found in SourceCodester Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file /classes/Maste… |
CVE-2026-9354 | Medium | 6.5 | 2026-05-24 | A vulnerability was detected in NousResearch hermes-agent up to 2026.4.16. The affected element is an unknown function of the component Slack Agent/Mattermost… |
CVE-2026-9353 | High | 7.3 | 2026-05-24 | A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.23. Impacted is an unknown function of the file agent/skills_guard.py of t… |
CVE-2026-9352 | Medium | 5.3 | 2026-05-24 | A weakness has been identified in NousResearch hermes-agent up to 2026.4.23. This issue affects the function _make_run_env of the file tools/environments/local… |
CVE-2026-3515 | High | 8.5 | 2026-05-24 | A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git comman… |
CVE-2026-9351 | Medium | 6.5 | 2026-05-24 | A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.16. This vulnerability affects the function _is_blocked_device of the file tools/… |
CVE-2026-9350 | High | 7.3 | 2026-05-24 | A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This affects the function check_all_command_guards of the file tools/approval.py o… |
CVE-2026-9349 | Medium | 5.3 | 2026-05-24 | A vulnerability was determined in calcom cal.diy up to 4.9.4. Affected by this issue is the function getServerSideProps of the file apps/web/modules/bookings/v… |
CVE-2026-9348 | High | 8.8 | 2026-05-24 | A vulnerability was found in Edimax EW-7438RPn up to 1.31. Affected by this vulnerability is an unknown functionality of the file /goform/mp of the component w… |
CVE-2026-48829 | High | 7.5 | 2026-05-24 | In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. Thi… |
CVE-2026-9347 | Medium | 6.3 | 2026-05-24 | A vulnerability has been found in Edimax EW-7438RPn up to 1.31. Affected is the function formWizSurvey of the file /goform/formWizSurvey of the component webs… |
CVE-2026-9346 | High | 8.8 | 2026-05-24 | A flaw has been found in Edimax EW-7438RPn up to 1.31. This impacts the function formWirelessTbl of the file /goform/formWirelessTbl of the component webs. Exe… |
CVE-2026-9345 | High | 8.8 | 2026-05-24 | A vulnerability was detected in Edimax EW-7438RPn up to 1.31. This affects the function formWizSurvey of the file /goform/formWizSurvey of the component webs… |
CVE-2026-9344 | High | 8.8 | 2026-05-24 | A security vulnerability has been detected in Edimax EW-7438RPn up to 1.31. The impacted element is an unknown function of the file /goform/formWpsStart of the… |
CVE-2026-9343 | Medium | 6.3 | 2026-05-23 | A weakness has been identified in Edimax EW-7438RPn up to 1.31. The affected element is the function formWpsStart of the file /goform/formWpsStart of the compo… |
CVE-2026-9342 | Medium | 6.3 | 2026-05-23 | A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. Impacted is an unknown function of the file /admin/patie… |
CVE-2026-9306 | Low | 3.7 | 2026-05-23 | A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router… |
CVE-2026-9305 | Medium | 6.3 | 2026-05-23 | A weakness has been identified in QuantumNous new-api up to 0.12.1. The impacted element is the function SearchUserTopUps/SearchAllTopUps of the file model/top… |
CVE-2026-9304 | Medium | 5.0 | 2026-05-23 | A security flaw has been discovered in calcom cal.diy up to 4.9.4. The affected element is the function validateUrlForSSRF of the file apps/web/app/api/logo/ro… |
CVE-2026-9303 | Medium | 4.3 | 2026-05-23 | A vulnerability was identified in calcom cal.diy up to 4.9.4. Impacted is an unknown function. The manipulation leads to cross-site request forgery. It is poss… |
CVE-2026-9302 | Medium | 6.3 | 2026-05-23 | A vulnerability was determined in 546669204 vps-inventory-monitoring up to 98c00b370668c96ae75e91c15548d9ea113652d9. This issue affects the function eval of th… |
CVE-2026-9301 | Medium | 6.3 | 2026-05-23 | A vulnerability was found in omec-project amf up to 2.1.1. This vulnerability affects unknown code of the component NGReset Message Handler. Performing a manip… |
CVE-2026-9300 | Medium | 6.3 | 2026-05-23 | A vulnerability has been found in omec-project amf up to 2.1.1. This affects an unknown part of the component NGSetupRequest Handler. Such manipulation leads t… |
CVE-2026-46300 | High | 7.8 | 2026-05-23 | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach… |
CVE-2026-43503 | High | 8.8 | 2026-05-23 | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer… |
CVE-2026-9299 | Medium | 6.3 | 2026-05-23 | A flaw has been found in omec-project amf up to 2.1.1. Affected by this issue is the function PDUSessionResourceModifyIndication of the file /go/src/amf/ngap/h… |
CVE-2026-9298 | Medium | 6.3 | 2026-05-23 | A vulnerability was detected in omec-project amf up to 2.1.1. Affected by this vulnerability is an unknown functionality of the component PathSwitchRequest Han… |
CVE-2026-9297 | Medium | 6.3 | 2026-05-23 | A security vulnerability has been detected in Edimax BR-6428NS 1.10. Affected is the function formWlbasic of the file /goform/formWlbasic of the component POST… |
CVE-2026-9296 | Medium | 6.3 | 2026-05-23 | A weakness has been identified in Edimax BR-6428NS 1.10. This impacts the function system of the file /goform/formWlanM of the component POST Request Handler… |
CVE-2026-9295 | High | 8.8 | 2026-05-23 | A security flaw has been discovered in Edimax BR-6428NS 1.10. This affects the function formWirelessTbl of the file /goform/formWirelessTbl of the component PO… |
CVE-2026-9294 | High | 8.8 | 2026-05-23 | A vulnerability was identified in Edimax BR-6428NS 1.10. The impacted element is the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the co… |
CVE-2026-9284 | High | 8.2 | 2026-05-23 | The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization c… |
CVE-2026-6898 | High | 8.8 | 2026-05-23 | The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember3_Hooks::ge… |
CVE-2026-6897 | High | 8.8 | 2026-05-23 | The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember\Features\T… |
CVE-2026-6895 | High | 8.8 | 2026-05-23 | The WishList Member plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Disclosure and Privilege Escalation in version… |
CVE-2026-6419 | High | 8.8 | 2026-05-23 | The WishList Member plugin for WordPress is vulnerable to Privilege Escalation via Missing Authorization in versions up to and including 3.30.1. This is due to… |
CVE-2026-47280 | Critical | 10.0 | 2026-05-22 | Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-45659 | High | 8.8 | 2026-05-22 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-42901 | Critical | 10.0 | 2026-05-22 | Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-42827 | Medium | 6.5 | 2026-05-22 | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information ove… |
CVE-2026-41149 | | 2026-05-22 | Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1… | |
CVE-2026-41148 | | 2026-05-22 | Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and prior, in addition to 11.0.0-alpha… | |
CVE-2026-41104 | Critical | 10.0 | 2026-05-22 | Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network. |
CVE-2026-41090 | Critical | 9.3 | 2026-05-22 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering o… |
CVE-2026-40412 | Critical | 10.0 | 2026-05-22 | Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code over a network. |
CVE-2026-40411 | Critical | 9.9 | 2026-05-22 | Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network. |
CVE-2026-35430 | High | 8.8 | 2026-05-22 | Authorization bypass through user-controlled key in Azure Privileged Identity Management (PIM) allows an authorized attacker to elevate privileges over a netwo… |
CVE-2026-33843 | Critical | 9.1 | 2026-05-22 | Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a n… |
CVE-2026-26147 | High | 7.7 | 2026-05-22 | Improper input validation in Azure Compute Gallery allows an authorized attacker to disclose information over a network. |
CVE-2026-23663 | High | 7.5 | 2026-05-22 | Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-23652 | Critical | 10.0 | 2026-05-22 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code ov… |
CVE-2026-41147 | High | 8.7 | 2026-05-22 | NukeViet CMS is a multi Content Management System. Versions 4.5.07 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient s… |
CVE-2026-41076 | High | 8.1 | 2026-05-22 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.9 and prior in addition to 6.0.0 through 6.0.2 contain an authentication… |
CVE-2026-41075 | High | 8.8 | 2026-05-22 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 contain an SQL injection vulnerab… |
CVE-2026-41074 | High | 7.1 | 2026-05-22 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 through 6.0.2 contain a Cross-Site Request Forgery (CSRF) vulnerability… |
CVE-2026-41073 | Medium | 4.6 | 2026-05-22 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) i… |
CVE-2026-41071 | High | 8.1 | 2026-05-22 | libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted HEIF sequence file where the saiz box declares more samples… |
CVE-2026-41069 | Medium | 6.5 | 2026-05-22 | libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malformed HEIF sequence file can trigger an out-of-bounds read in c… |
CVE-2026-40864 | Medium | 5.4 | 2026-05-22 | JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1… |
CVE-2026-3294 | High | 8.8 | 2026-05-22 | An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login param… |
CVE-2026-5843 | High | 8.2 | 2026-05-22 | The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model… |
CVE-2026-5817 | High | 8.2 | 2026-05-22 | The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sa… |
CVE-2026-40610 | Medium | 5.5 | 2026-05-22 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.38 and prior, the build packaging wo… |
CVE-2026-40607 | | 2026-05-22 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.11.0 through 2.28.1, a Stored XSS vulnerability is caused by incorrect escaping of… | |
CVE-2026-40598 | | 2026-05-22 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, improper escaping of the redirection page (retrieved from the requ… | |
CVE-2026-40597 | | 2026-05-22 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, given any pre-existing XSS / HTML injection vulnerability, an atta… | |
CVE-2026-40596 | | 2026-05-22 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.11.0 through 2.28.1 allow any authenticated user to inject arbitrary HTML by updating… | |
CVE-2026-40295 | Medium | 6.1 | 2026-05-22 | Devise is an authentication solution for Rails based on Warden. In versions 5.0.3 and below, when the Timeoutable module is enabled in Devise, the FailureApp#r… |
CVE-2026-39824 | Low | 3.3 | 2026-05-22 | NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number… |
CVE-2026-9291 | High | 7.1 | 2026-05-22 | Insecure deserialization in the job results processing component in Amazon Braket SDK before 1.117.0 might allow a remote authenticated user with S3 write acce… |
CVE-2026-6406 | High | 8.8 | 2026-05-22 | The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop. When ECI is enabled, Docker socket mounts from… |
CVE-2026-48700 | | 2026-05-22 | An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file's path is passed as a URI in an org.freedesktop.FileManager1.Sho… | |
CVE-2026-40172 | High | 8.1 | 2026-05-22 | authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, the PATCH /api/v3/core/users/{pk}/ API allows… |
CVE-2026-40166 | | 2026-05-22 | authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, authenticated non-admin users with at least on… | |
CVE-2026-39970 | | 2026-05-22 | TypeBot is a chatbot builder tool. Versions 3.15.2 and prior contain a critical stored XSS vulnerability in the app.typebot.io profile picture upload form. The… | |
CVE-2026-39969 | Medium | 6.5 | 2026-05-22 | TypeBot is a chatbot builder tool. In versions 3.16.0 and prior, the WhatsApp Cloud API webhook endpoint (POST /v1/workspaces/{workspaceId}/whatsapp/{credentia… |
CVE-2026-39968 | High | 7.1 | 2026-05-22 | TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the fix for GHSA-4xc5-wfwc-jw47 ("Credential Theft via Client-Side Script Execution and API Au… |
CVE-2026-39967 | Low | 3.1 | 2026-05-22 | TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the bot engine's the findResult query does not filter results by typebotId, allowing an authen… |