2026 CVEs (page 289)
Page 289 of 465 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8390 | High | 7.3 | 2026-05-12 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3. |
CVE-2026-8389 | High | 8.8 | 2026-05-12 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3. |
CVE-2026-8388 | Medium | 6.5 | 2026-05-12 | Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11… |
CVE-2026-6865 | | 2026-05-12 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files wh… | |
CVE-2026-45091 | Critical | 9.1 | 2026-05-12 | sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 throu… |
CVE-2026-43930 | Medium | 5.9 | 2026-05-12 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.76 and 9.9.0-alpha.2, a race condition in… |
CVE-2026-43916 | | 2026-05-12 | pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes. Prior to 0.2.0-alpha, a heap buffer over-rea… | |
CVE-2026-42006 | Medium | 4.3 | 2026-05-12 | An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this… |
CVE-2026-40638 | Medium | 6.7 | 2026-05-12 | Dell PowerScale InsightIQ, versions 5.0.0 through 6.2.0, contains an execution with unnecessary privileges vulnerability. A high privileged attacker with local… |
CVE-2026-40020 | Low | 3.1 | 2026-05-12 | Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be… |
CVE-2026-40016 | Medium | 5.3 | 2026-05-12 | Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the config… |
CVE-2026-35071 | High | 8.2 | 2026-05-12 | Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection')… |
CVE-2026-33603 | Medium | 6.8 | 2026-05-12 | Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to p… |
CVE-2026-27851 | High | 7.4 | 2026-05-12 | When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to b… |
CVE-2026-4827 | | 2026-05-12 | CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑man… | |
CVE-2026-45218 | High | 7.7 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel wp-travel allows Blind SQL Injection… |
CVE-2026-45215 | Medium | 5.3 | 2026-05-12 | Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal WP EasyPay wp-easy-pay allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2026-45214 | High | 8.5 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows B… |
CVE-2026-45213 | High | 7.6 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injectio… |
CVE-2026-45212 | Medium | 5.3 | 2026-05-12 | Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Exploiting Incorrectly Configured Access Control S… |
CVE-2026-45211 | High | 8.5 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare al… |
CVE-2026-45210 | Medium | 5.4 | 2026-05-12 | Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-42742 | High | 8.5 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blin… |
CVE-2026-42741 | High | 8.5 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views – Display & Edit Ninja F… |
CVE-2026-41713 | High | 8.2 | 2026-05-12 | A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affect… |
CVE-2026-41712 | High | 7.5 | 2026-05-12 | Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users. |
CVE-2026-32684 | Low | 2.9 | 2026-05-12 | The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications could obtain sensit… |
CVE-2026-2465 | High | 8.8 | 2026-05-12 | Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard FOR-S allows… |
CVE-2026-8162 | High | 7.5 | 2026-05-12 | multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a Content-Disposi… |
CVE-2026-8161 | High | 7.5 | 2026-05-12 | multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that… |
CVE-2026-8159 | High | 7.5 | 2026-05-12 | multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filename parameter parse… |
CVE-2026-8072 | | 2026-05-12 | Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the… | |
CVE-2026-7428 | | 2026-05-12 | Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default… | |
CVE-2026-6813 | Medium | 4.4 | 2026-05-12 | The Continually plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.1 due to insuffi… |
CVE-2026-6800 | Medium | 4.4 | 2026-05-12 | The FastBots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.12 due to insuffici… |
CVE-2026-6001 | High | 8.8 | 2026-05-12 | Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. BAPSİS allows Exploitation of Trusted Identifiers. This issue affec… |
CVE-2026-5029 | | 2026-05-12 | A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint with… | |
CVE-2026-44412 | High | 7.8 | 2026-05-12 | A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected applications contain a stack based overflow vulnerabili… |
CVE-2026-44411 | High | 7.8 | 2026-05-12 | A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected application is vulnerable to uninitialized pointer acce… |
CVE-2026-41551 | Critical | 9.1 | 2026-05-12 | A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnerability because user input is not properl… |
CVE-2026-41125 | Medium | 6.0 | 2026-05-12 | A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions), blueplanet 105 TL3 (All versions), bluepla… |
CVE-2026-33893 | High | 7.5 | 2026-05-12 | A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2406.0012), Teamcenter V2412 (All versio… |
CVE-2026-33862 | High | 7.3 | 2026-05-12 | A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2406.0012), Teamcenter V2412 (All versio… |
CVE-2026-27662 | High | 7.7 | 2026-05-12 | Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place. This could a… |
CVE-2026-25789 | High | 7.1 | 2026-05-12 | Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user i… |
CVE-2026-25787 | Critical | 9.1 | 2026-05-12 | Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This… |
CVE-2026-25786 | Critical | 9.1 | 2026-05-12 | Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow… |
CVE-2026-22925 | High | 7.5 | 2026-05-12 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application is susceptible to resource exhaustion when subjected to… |
CVE-2026-22924 | Critical | 9.1 | 2026-05-12 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application does not properly restrict unauthenticated connections a… |
CVE-2026-1934 | Medium | 4.3 | 2026-05-12 | The Motors – Car Dealership & Classified Listings plugin for WordPress is vulnerable to Payment Bypass via insecure user meta update in all versions up to, and… |
CVE-2026-7661 | Medium | 6.4 | 2026-05-12 | The Bootstrap Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `box` shortcode in all versions up to, and including, 1.0. Th… |
CVE-2026-7659 | Medium | 6.4 | 2026-05-12 | The Advanced Social Media Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `social` shortcode in all versions up to, and includi… |
CVE-2026-7626 | Medium | 5.3 | 2026-05-12 | The Slek Gateway for WooCommerce plugin for WordPress is vulnerable to Information Exposure in version 1.0. This is due to the wsb_handle_slek_payment_redirect… |
CVE-2026-7616 | Medium | 4.3 | 2026-05-12 | The Zawgyi Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorr… |
CVE-2026-7562 | Medium | 4.3 | 2026-05-12 | The WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.3. This is due to the absence of a… |
CVE-2026-7561 | Medium | 6.1 | 2026-05-12 | The Tm – WordPress Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missi… |
CVE-2026-7464 | Medium | 6.1 | 2026-05-12 | The WP Google Maps Integration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `page` parameter in all versions up to, and includi… |
CVE-2026-7437 | Medium | 6.1 | 2026-05-12 | The AzonPost plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `editpos_hidden` parameter in all versions up to, and including, 1.3… |
CVE-2026-7050 | Medium | 4.3 | 2026-05-12 | The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9. This is due to the plugin not properly ver… |
CVE-2026-6932 | Medium | 4.3 | 2026-05-12 | The Woo Commerce Minimum Weight plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.0.1. This is due to miss… |
CVE-2026-6913 | Medium | 6.4 | 2026-05-12 | The Shortcodely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'widget_area' parameter in all versions up to, and including, 1.0.1 d… |
CVE-2026-6808 | Medium | 6.1 | 2026-05-12 | The Pricing Tables for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1… |
CVE-2026-6710 | Medium | 4.3 | 2026-05-12 | The Skysa Text Ticker App plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or… |
CVE-2026-6709 | Medium | 4.3 | 2026-05-12 | The Coinbase Commerce for Contact Form 7 plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.1.2. This is due to a mi… |
CVE-2026-6708 | Medium | 5.3 | 2026-05-12 | The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3… |
CVE-2026-6690 | High | 7.2 | 2026-05-12 | The LifePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'n' parameter of the lp_update_mds AJAX action in all versions up to, a… |
CVE-2026-6663 | Medium | 4.8 | 2026-05-12 | The GWD Connect plugin for WordPress is vulnerable to missing authorization to limited code execution in all versions up to, and including, 2.9. This is due to… |
CVE-2026-6402 | Medium | 5.3 | 2026-05-12 | webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origi… |
CVE-2026-6256 | Medium | 6.4 | 2026-05-12 | The Credits Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the 'credits' shortcode in all versions up… |
CVE-2026-6247 | Medium | 6.4 | 2026-05-12 | The scratchblocks for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' attribute of the 'scratchblocks' shortcode in all… |
CVE-2026-6237 | Medium | 6.4 | 2026-05-12 | The Quick Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' attribute of the 'qtbl' shortcode in all versions up to, and… |
CVE-2026-5715 | Medium | 6.4 | 2026-05-12 | The Voyage Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'post-content' shortcode in all versions up… |
CVE-2026-5693 | Medium | 5.3 | 2026-05-12 | The Smart Appointment & Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and a nonce validatio… |
CVE-2026-5340 | Medium | 6.4 | 2026-05-12 | The Fancy Image Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fancy-img-show` shortcode in all versions up to, and i… |
CVE-2026-5028 | Medium | 6.5 | 2026-05-12 | The Eight Day Week Print Workflow plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'title' parameter in the `pp-get-articles` AJAX… |
CVE-2026-4920 | Medium | 6.4 | 2026-05-12 | The Next Date plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in all versions up to, and including, 1.0… |
CVE-2026-4859 | Medium | 6.4 | 2026-05-12 | The SP Blog Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'design' attribute of the `wpsbd_post_carousel` shortcode in all… |
CVE-2026-4301 | Medium | 4.3 | 2026-05-12 | The Rate Star Review Vote - AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1… |
CVE-2026-3604 | Medium | 4.9 | 2026-05-12 | The WP SEO Structured Data Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `_kcseo_ative_tab` parameter in all versions up to… |
CVE-2026-39432 | High | 8.2 | 2026-05-12 | Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Timetics… |
CVE-2026-2993 | High | 7.5 | 2026-05-12 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.17 due to insufficient e… |
CVE-2026-2300 | Medium | 6.4 | 2026-05-12 | The BJ Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `filter_images()` function in all versions up to, and including, 1.0… |
CVE-2026-35227 | | 2026-05-12 | An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling… | |
CVE-2026-1681 | Medium | 6.1 | 2026-05-12 | Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address causes the network stack to recursively re-enter the input path on the sam… |
CVE-2026-1185 | Medium | 5.4 | 2026-05-12 | A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This… |
CVE-2026-0804 | Medium | 6.7 | 2026-05-12 | An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulner… |
CVE-2026-0802 | Medium | 6.0 | 2026-05-12 | An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerabi… |
CVE-2026-0541 | Medium | 6.7 | 2026-05-12 | ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. T… |
CVE-2026-41872 | High | 7.4 | 2026-05-12 | "Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate validation. A man-in-the-middle attack may allow eavesdropping on, or alt… |
CVE-2026-41530 | Low | 3.3 | 2026-05-12 | The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configur… |
CVE-2026-7287 | High | 7.5 | 2026-05-12 | ** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functio… |
CVE-2026-7257 | Medium | 4.4 | 2026-05-12 | ** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2 firmware version V1.00… |
CVE-2026-7256 | High | 8.8 | 2026-05-12 | ** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjace… |
CVE-2026-7255 | Medium | 6.5 | 2026-05-12 | ** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts vulnerability in the web management interface of Zyxel WRE6505 v2… |
CVE-2026-45430 | High | 7.1 | 2026-05-12 | The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks. |
CVE-2026-40137 | Medium | 6.1 | 2026-05-12 | SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim, redirects them to… |
CVE-2026-40136 | Medium | 4.3 | 2026-05-12 | SAP Financial Consolidation allows an authenticated attacker to disconnect other users by terminating their sessions temporarily preventing access. However, th… |
CVE-2026-40135 | Medium | 6.5 | 2026-05-12 | An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with admi… |
CVE-2026-40134 | Medium | 4.3 | 2026-05-12 | Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users could invoke a remote-enabled function… |
CVE-2026-40133 | Medium | 6.3 | 2026-05-12 | Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthorized access to view and modify condition… |