2026 CVEs (page 280)
Page 280 of 704 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-72788 | Medium | 5.8 | 2026-08-12 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace st… |
CVE-2026-72787 | Medium | 6.4 | 2026-08-12 | Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding… |
CVE-2026-72786 | Medium | 6.5 | 2026-08-12 | Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords… |
CVE-2026-72508 | Critical | 9.9 | 2026-08-12 | A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin… |
CVE-2026-6821 | Medium | 4.3 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain condi… |
CVE-2026-67579 | High | 7.4 | 2026-08-12 | Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pag… |
CVE-2026-63300 | Critical | 9.9 | 2026-08-12 | An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_inst… |
CVE-2026-63299 | Critical | 9.9 | 2026-08-12 | An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify… |
CVE-2026-63298 | Critical | 9.9 | 2026-08-12 | An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitra… |
CVE-2026-63297 | Critical | 9.9 | 2026-08-12 | An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restri… |
CVE-2026-63296 | Critical | 9.9 | 2026-08-12 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating a… |
CVE-2026-63295 | Medium | 4.3 | 2026-08-12 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is confi… |
CVE-2026-63294 | Critical | 9.9 | 2026-08-12 | A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image… |
CVE-2026-63293 | Critical | 9.9 | 2026-08-12 | A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an… |
CVE-2026-62420 | Critical | 9.9 | 2026-08-12 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migr… |
CVE-2026-59917 | High | 7.8 | 2026-08-12 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with l… |
CVE-2026-59916 | High | 7.8 | 2026-08-12 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with l… |
CVE-2026-59914 | High | 7.8 | 2026-08-12 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged at… |
CVE-2026-4879 | Medium | 4.3 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain condi… |
CVE-2026-49466 | Medium | 6.5 | 2026-08-12 | Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the… |
CVE-2026-46731 | High | 7.8 | 2026-08-12 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged at… |
CVE-2026-19657 | Medium | 6.1 | 2026-08-12 | ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafte… |
CVE-2026-19656 | Critical | 9.9 | 2026-08-12 | ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-… |
CVE-2026-19643 | Medium | 5.3 | 2026-08-12 | An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an… |
CVE-2026-19642 | Medium | 5.9 | 2026-08-12 | An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memor… |
CVE-2026-19228 | High | 8.5 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allo… |
CVE-2026-18679 | | 2026-08-12 | When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disab… | |
CVE-2026-18433 | Medium | 4.3 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allo… |
CVE-2026-18150 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition. |
CVE-2026-18148 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navigator log files due to improper output neutraliza… |
CVE-2026-18099 | High | 8.9 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled inp… |
CVE-2026-17642 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used… |
CVE-2026-17445 | High | 8.2 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied use… |
CVE-2026-17417 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters. |
CVE-2026-17111 | High | 7.6 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to vi… |
CVE-2026-17083 | Critical | 9.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. |
CVE-2026-17082 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile na… |
CVE-2026-16494 | High | 7.1 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allo… |
CVE-2026-15217 | High | 8.7 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain co… |
CVE-2026-15216 | High | 8.7 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain co… |
CVE-2026-13361 | High | 8.8 | 2026-08-12 | IBM Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field. |
CVE-2026-13267 | High | 8.1 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-12618 | High | 7.2 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-12359 | High | 8.1 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-12005 | High | 7.2 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-12004 | High | 8.7 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-11937 | Low | 3.1 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-11923 | High | 7.4 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-73301 | Medium | 4.3 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted… |
CVE-2026-19311 | High | 8.1 | 2026-08-12 | Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbit… |
CVE-2026-18952 | High | 8.1 | 2026-08-12 | Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform… |
CVE-2026-18678 | | 2026-08-12 | When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over… | |
CVE-2026-18677 | | 2026-08-12 | In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authentic… | |
CVE-2026-18676 | | 2026-08-12 | The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is… | |
CVE-2026-18675 | | 2026-08-12 | The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64… | |
CVE-2026-18673 | | 2026-08-12 | When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interf… | |
CVE-2026-8667 | Medium | 4.3 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain c… |
CVE-2026-7427 | Medium | 5.3 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain co… |
CVE-2026-73300 | Critical | 9.6 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enablin… |
CVE-2026-73299 | Critical | 10.0 | 2026-08-12 | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty te… |
CVE-2026-73298 | | 2026-08-12 | The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving cont… | |
CVE-2026-69106 | High | 8.8 | 2026-08-12 | A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content. |
CVE-2026-49467 | High | 8.8 | 2026-08-12 | Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password v… |
CVE-2026-44741 | High | 8.8 | 2026-08-12 | Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translatio… |
CVE-2026-42018 | High | 7.5 | 2026-08-12 | JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive… |
CVE-2026-18713 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute… |
CVE-2026-18669 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component… |
CVE-2026-18250 | Medium | 6.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to a race conditi… |
CVE-2026-18244 | Medium | 4.3 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain condi… |
CVE-2026-18235 | High | 8.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation. |
CVE-2026-17420 | Medium | 6.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements in… |
CVE-2026-17419 | Medium | 6.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL… |
CVE-2026-17418 | High | 8.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in… |
CVE-2026-17276 | Critical | 9.6 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority… |
CVE-2026-17271 | High | 7.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size. |
CVE-2026-17268 | Medium | 6.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token. |
CVE-2026-17266 | Medium | 6.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restrict… |
CVE-2026-17248 | High | 7.1 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an… |
CVE-2026-17222 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special element… |
CVE-2026-17218 | Critical | 9.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. |
CVE-2026-17110 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privile… |
CVE-2026-17109 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a command due to parameter injection. |
CVE-2026-16956 | Critical | 9.8 | 2026-08-12 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in a… |
CVE-2026-16931 | High | 7.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options. |
CVE-2026-16907 | High | 7.6 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking. |
CVE-2026-16906 | High | 8.8 | 2026-08-12 | IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special… |
CVE-2026-16904 | High | 8.1 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owne… |
CVE-2026-16863 | High | 7.7 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read. |
CVE-2026-16860 | Critical | 9.9 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element. |
CVE-2026-16856 | High | 8.8 | 2026-08-12 | IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of special elements used in an OS command. |
CVE-2026-16627 | High | 7.7 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated… |
CVE-2026-15423 | High | 8.5 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain co… |
CVE-2026-73297 | | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did no… | |
CVE-2026-73296 | Critical | 9.4 | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mo… |
CVE-2026-73295 | Medium | 5.4 | 2026-08-12 | Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/asse… |
CVE-2026-73240 | Critical | 9.8 | 2026-08-12 | Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to up… |
CVE-2026-73239 | Medium | 6.5 | 2026-08-12 | Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: befor… |
CVE-2026-73238 | Medium | 6.1 | 2026-08-12 | XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, whic… |
CVE-2026-73237 | Medium | 6.1 | 2026-08-12 | XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to ver… |
CVE-2026-48554 | High | 7.5 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitu… |