2026 CVEs (page 274)
Page 274 of 469 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34927 | High | 7.8 | 2026-05-21 | An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. Please note: an at… |
CVE-2026-34926 | Medium | 6.7 | 2026-05-21 | A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to i… |
CVE-2026-2740 | High | 8.4 | 2026-05-21 | Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticate… |
CVE-2026-6841 | Medium | 6.1 | 2026-05-21 | Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL tha… |
CVE-2026-5118 | Critical | 9.8 | 2026-05-21 | The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a… |
CVE-2026-45760 | High | 8.1 | 2026-05-21 | (Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authoriz… |
CVE-2026-43502 | High | 7.8 | 2026-05-21 | In the Linux kernel, the following vulnerability has been resolved: net/rds: handle zerocopy send cleanup before the message is queued A zerocopy send can fa… |
CVE-2026-43501 | Critical | 9.8 | 2026-05-21 | In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decomp… |
CVE-2026-43499 | High | 7.8 | 2026-05-21 | In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used b… |
CVE-2026-43498 | High | 7.8 | 2026-05-21 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Disallow re-exporting imported GEM objects Prevent re-exporting of imported G… |
CVE-2026-43497 | High | 7.3 | 2026-05-21 | In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free dlfb_ops_mmap() uses… |
CVE-2026-43496 | Medium | 5.5 | 2026-05-21 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked When r… |
CVE-2026-43495 | High | 8.8 | 2026-05-21 | In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler … |
CVE-2026-43494 | High | 7.8 | 2026-05-21 | In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in… |
CVE-2026-0393 | Medium | 6.5 | 2026-05-21 | The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to insufficient isolatio… |
CVE-2026-45255 | High | 7.5 | 2026-05-21 | When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to s… |
CVE-2026-45254 | Medium | 6.5 | 2026-05-21 | In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of b… |
CVE-2026-45253 | High | 8.4 | 2026-05-21 | ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the ability to deb… |
CVE-2026-45252 | Medium | 5.5 | 2026-05-21 | When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list of extended… |
CVE-2026-45251 | High | 7.8 | 2026-05-21 | A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread does not hold… |
CVE-2026-42396 | Medium | 4.9 | 2026-05-21 | Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail |
CVE-2026-42002 | Medium | 5.9 | 2026-05-21 | Concurrency and locking defects in GSS-TSIG |
CVE-2026-42001 | High | 7.5 | 2026-05-21 | Insufficient Validation of Autoprimary SOA Queries |
CVE-2026-42000 | Medium | 6.8 | 2026-05-21 | Insufficient Validation of Names During AXFR |
CVE-2026-41999 | Medium | 4.8 | 2026-05-21 | Incorrect Behaviour of Views with TCP PROXY Requests |
CVE-2026-39461 | High | 8.8 | 2026-05-21 | libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it… |
CVE-2026-28764 | High | 7.8 | 2026-05-21 | MediaArea MediaInfoLib LXF element parsing heap-based buffer overflow vulnerability |
CVE-2026-9157 | High | 8.4 | 2026-05-21 | Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows Remote Code Inclusion. This issue affects… |
CVE-2026-7837 | Low | 3.7 | 2026-05-21 | A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operations, which may all… |
CVE-2026-5434 | Medium | 5.9 | 2026-05-21 | Honeywell Control Network Module (CNM) contains insertion of sensitive information into an unintended directory. An attacker could exploit this vulnerability t… |
CVE-2026-5433 | Critical | 9.1 | 2026-05-21 | Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command … |
CVE-2026-4858 | High | 8.0 | 2026-05-21 | Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an… |
CVE-2026-45250 | High | 7.8 | 2026-05-21 | The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supp… |
CVE-2026-44075 | Low | 3.7 | 2026-05-21 | A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a DSIOPT_ATTNQUANT switch case to fall through into DSIOPT_SERVQ… |
CVE-2026-44074 | Low | 3.7 | 2026-05-21 | Netatalk 2.1.0 through 4.4.2 combines multiple errno values using bitwise OR, resulting in incorrect error codes when multiple error conditions occur simultane… |
CVE-2026-44071 | Low | 3.7 | 2026-05-21 | Netatalk 3.1.2 through 4.4.2 is compiled without FORTIFY_SOURCE, which disables built-in buffer overflow detection at runtime, potentially allowing a remote at… |
CVE-2026-44057 | Low | 3.1 | 2026-05-21 | A dead bounds check in the Spotlight RPC unmarshaller in Netatalk 3.0.0 through 4.4.2 results in an unreachable code path that provides no effective bounds pro… |
CVE-2026-27393 | Medium | 5.3 | 2026-05-21 | Missing Authorization vulnerability in Tobias CF7 WOW Styler allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 W… |
CVE-2026-27349 | Medium | 4.3 | 2026-05-21 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPFunnels Team Mail Mint allows Retrieve Embedded Sensitive Data. … |
CVE-2026-22880 | Medium | 6.1 | 2026-05-21 | Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allow… |
CVE-2026-7836 | Low | 3.1 | 2026-05-21 | An incorrect calculation in the hextoint macro in Netatalk 2.0.0 through 4.4.2 due to improper uppercase character handling allows a remote authenticated attac… |
CVE-2026-7835 | Low | 3.1 | 2026-05-21 | A format string argument mismatch in Netatalk 3.0.3 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted input t… |
CVE-2026-4055 | Medium | 4.3 | 2026-05-21 | Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an aut… |
CVE-2026-44076 | Medium | 6.7 | 2026-05-21 | Insufficient sanitization of volume paths in Netatalk 3.1.0 through 4.4.2 allows a local privileged user to inject OS commands and execute arbitrary code via a… |
CVE-2026-44073 | Medium | 5.0 | 2026-05-21 | Authentication modules in Netatalk 1.5.0 through 4.4.2 fail to check the return value of seteuid(), which may allow a remote authenticated attacker to retain e… |
CVE-2026-44072 | Low | 3.0 | 2026-05-21 | Netatalk 2.2.1 through 4.4.2 calls system() after a failed chdir() without properly handling the error condition, which allows a local privileged user to execu… |
CVE-2026-44070 | Low | 3.1 | 2026-05-21 | An unbounded memory reallocation in the charset conversion code in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to cause a minor denial… |
CVE-2026-44069 | Low | 3.9 | 2026-05-21 | An integer underflow in the volxlate function in Netatalk 3.0.0 through 4.4.2 allows a local privileged user to obtain limited information, modify limited data… |
CVE-2026-44068 | High | 7.6 | 2026-05-21 | Incomplete sanitization of extended attribute (EA) path components in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to write to files out… |
CVE-2026-44067 | Medium | 4.2 | 2026-05-21 | A heap over-read in extended attribute (EA) header parsing in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to obtain limited information… |
CVE-2026-44066 | High | 7.1 | 2026-05-21 | Multiple heap out-of-bounds reads in the Spotlight RPC unmarshalling code in Netatalk 3.1.0 through 4.4.2 allow a remote authenticated attacker to obtain sensi… |
CVE-2026-44065 | Medium | 4.2 | 2026-05-21 | An off-by-two error in lp_write() in papd in Netatalk 2.0.0 through 4.4.2 allows an adjacent network attacker to modify limited data or cause a minor service d… |
CVE-2026-44064 | High | 7.1 | 2026-05-21 | An out-of-bounds read in ASP session ID handling in Netatalk 1.3 through 4.4.2 allows an adjacent network attacker to obtain limited information or cause a den… |
CVE-2026-44063 | Medium | 4.2 | 2026-05-21 | An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited informatio… |
CVE-2026-44062 | High | 7.5 | 2026-05-21 | A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code o… |
CVE-2026-44061 | Medium | 5.9 | 2026-05-21 | Netatalk 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, which allows a remote attacker to recover authentication credentials v… |
CVE-2026-44060 | High | 7.5 | 2026-05-21 | An integer underflow in dsi_writeinit() in Netatalk 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to cause a denial of service via a crafted DSI… |
CVE-2026-44059 | Medium | 4.5 | 2026-05-21 | A race condition in the privilege toggle mechanism in Netatalk 2.2.5 through 4.4.2 allows a local attacker to obtain limited information, modify limited data… |
CVE-2026-44058 | High | 7.2 | 2026-05-21 | An authentication bypass vulnerability in Netatalk 2.2.2 through 4.4.2 allows a remote privileged user to authenticate as an arbitrary user via the admin auth… |
CVE-2026-44056 | Medium | 6.4 | 2026-05-21 | A stack-based buffer overflow in desktop.c in Netatalk 1.3 through 4.2.2 allows a remote authenticated attacker to cause a denial of service, obtain limited in… |
CVE-2026-44055 | High | 7.5 | 2026-05-21 | A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker to inject OS commands and execute arbitrar… |
CVE-2026-44054 | Medium | 6.5 | 2026-05-21 | Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote authenticated attacker to cause a denial… |
CVE-2026-44053 | High | 7.4 | 2026-05-21 | Netatalk 1.5.0 through 4.2.2 uses a broken cryptographic algorithm in the DHCAST128 UAM, which allows a remote attacker to obtain authentication credentials or… |
CVE-2026-44052 | High | 7.5 | 2026-05-21 | Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain L… |
CVE-2026-44051 | High | 8.1 | 2026-05-21 | An improper link resolution vulnerability in Netatalk 3.0.2 through 4.4.2 allows a remote authenticated attacker to read arbitrary files or overwrite arbitrary… |
CVE-2026-44050 | Critical | 9.9 | 2026-05-21 | A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to execute arbitrary… |
CVE-2026-44049 | High | 7.5 | 2026-05-21 | An out-of-bounds write due to improper null termination in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute… |
CVE-2026-44048 | High | 8.8 | 2026-05-21 | A stack-based buffer overflow via UCS-2 type confusion in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute a… |
CVE-2026-44047 | High | 8.8 | 2026-05-21 | An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access t… |
CVE-2026-6279 | Critical | 9.8 | 2026-05-21 | The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and… |
CVE-2026-2734 | Medium | 6.5 | 2026-05-21 | In mlflow/mlflow versions up to 3.9.0, the `SearchModelVersions` REST API endpoint and the `mlflowSearchModelVersions` GraphQL query lack proper per-model auth… |
CVE-2026-1543 | Medium | 6.4 | 2026-05-21 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15… |
CVE-2026-4811 | Medium | 4.9 | 2026-05-21 | The WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Icon… |
CVE-2026-9152 | | 2026-05-21 | A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authent… | |
CVE-2026-48172 | Critical | 9.8 | 2026-05-21 | LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via… |
CVE-2026-1881 | Medium | 4.3 | 2026-05-21 | The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta… |
CVE-2026-9149 | Medium | 6.5 | 2026-05-21 | A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size v… |
CVE-2026-40165 | High | 8.7 | 2026-05-21 | authentik is an open-source identity provider. Versions 2025.12.4 and prior, and versions 2026.2.0-rc1 through 2026.2.2 were vulnerable to Authentication Bypas… |
CVE-2026-9150 | Medium | 6.5 | 2026-05-20 | A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian… |
CVE-2026-47782 | Low | 3.3 | 2026-05-20 | Android App "RoboForm Password Manager" provided by Siber Systems, Inc. handles Android intents without sufficient URL validation, user confirmation nor notifi… |
CVE-2026-47372 | Critical | 9.1 | 2026-05-20 | Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictabl… |
CVE-2026-40102 | Medium | 6.5 | 2026-05-20 | Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter directly… |
CVE-2026-40094 | Medium | 4.3 | 2026-05-20 | nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In versions 1.3.0 and prior, network-libp2p discovery accepts signed PeerCo… |
CVE-2026-40092 | High | 7.5 | 2026-05-20 | nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In versions 1.3.0 and below, a malicious network peer can crash any Nimiq f… |
CVE-2026-39960 | Medium | 5.4 | 2026-05-20 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and below contain flawed logic that causes improper escaping of a textarea custo… |
CVE-2026-8632 | High | 7.8 | 2026-05-20 | A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of priv… |
CVE-2026-8631 | Critical | 9.8 | 2026-05-20 | A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of priv… |
CVE-2026-47373 | High | 7.5 | 2026-05-20 | Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing c… |
CVE-2026-9144 | High | 7.6 | 2026-05-20 | Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allo… |
CVE-2026-9141 | Critical | 9.8 | 2026-05-20 | Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web configuration interface that allows un… |
CVE-2026-9139 | Critical | 9.8 | 2026-05-20 | Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentic… |
CVE-2026-9137 | High | 7.5 | 2026-05-20 | The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where… |
CVE-2026-9136 | Medium | 6.5 | 2026-05-20 | A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without… |
CVE-2026-9133 | High | 7.7 | 2026-05-20 | Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme (arn:aws-debug:file) accepted by the PUT /api/a… |
CVE-2026-9129 | | 2026-05-20 | A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-pr… | |
CVE-2026-9126 | High | 8.8 | 2026-05-20 | Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-9124 | Medium | 5.3 | 2026-05-20 | Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer proc… |
CVE-2026-9123 | High | 7.5 | 2026-05-20 | Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a local attacker to execute arbitrary code insi… |
CVE-2026-9122 | Medium | 6.5 | 2026-05-20 | Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to obtain potentially sensitive information from process me… |
CVE-2026-9121 | High | 8.8 | 2026-05-20 | Out of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |