2026 CVEs (page 290)
Page 290 of 465 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-40132 | Medium | 5.4 | 2026-05-12 | Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages), an authenticated attacker could access i… |
CVE-2026-40131 | Low | 3.4 | 2026-05-12 | SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user input without proper parameterization o… |
CVE-2026-40129 | Medium | 4.3 | 2026-05-12 | Due to a Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform, an authenticated attacker could send specially crafte… |
CVE-2026-34263 | Critical | 9.6 | 2026-05-12 | Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary s… |
CVE-2026-34260 | Critical | 9.6 | 2026-05-12 | SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements th… |
CVE-2026-34259 | High | 8.2 | 2026-05-12 | Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non… |
CVE-2026-34258 | Medium | 4.7 | 2026-05-12 | SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. Successful exploitat… |
CVE-2026-27682 | Medium | 4.7 | 2026-05-12 | Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages), an unauthen… |
CVE-2026-0502 | Medium | 5.4 | 2026-05-12 | Due to insufficient CSRF protection in SAP BusinessObjects Business Intelligence Platform ,an authenticated user could be tricked by an attacker to send uninte… |
CVE-2026-45393 | High | 7.8 | 2026-05-12 | A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\SYSTEM. Incorrect defaul… |
CVE-2026-45392 | High | 8.7 | 2026-05-12 | DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remote attacker to execute arbitrary JavaScript in the browser of an authenticated… |
CVE-2026-45391 | High | 7.8 | 2026-05-12 | A command injection vulnerability in Cribl Edge for Linux versions 3.2.0 through 4.17.0 allows a local unprivileged user to execute arbitrary commands in the c… |
CVE-2026-45362 | Low | 3.2 | 2026-05-12 | Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file. |
CVE-2026-45321 | Critical | 9.6 | 2026-05-12 | On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishe… |
CVE-2026-8349 | Medium | 4.3 | 2026-05-12 | A flaw has been found in omec-project amf up to 2.1.1. This vulnerability affects unknown code of the component NGAP Message Handler. Executing a manipulation… |
CVE-2026-8346 | Medium | 6.3 | 2026-05-12 | A vulnerability was detected in D-Link DIR-816 1.10CNB05_R1B011D88210. This affects the function portForward. Performing a manipulation of the argument ip_addr… |
CVE-2026-8345 | Medium | 6.3 | 2026-05-11 | A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this issue is the function sub_445E7C of the file /goform/sing… |
CVE-2026-43914 | High | 7.3 | 2026-05-11 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login… |
CVE-2026-43913 | High | 8.1 | 2026-05-11 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organization owner to purge the entire organiz… |
CVE-2026-43912 | High | 8.7 | 2026-05-11 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden does not enforce that a groups_users.users_organizations_uuid entry… |
CVE-2026-43911 | Medium | 6.8 | 2026-05-11 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when the user's security_stamp is rotated by… |
CVE-2026-43901 | Medium | 6.8 | 2026-05-11 | Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities. In 1.1.5 and earlier… |
CVE-2026-43900 | Critical | 9.3 | 2026-05-11 | DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, a Cross-Site Scripting (XSS)… |
CVE-2026-43899 | Critical | 9.6 | 2026-05-11 | DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, An incomplete mitigation for… |
CVE-2026-42554 | Medium | 6.1 | 2026-05-11 | Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/J… |
CVE-2026-34963 | High | 8.4 | 2026-05-11 | barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual im… |
CVE-2026-34962 | Medium | 6.2 | 2026-05-11 | barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_iterate_dir()… |
CVE-2026-8344 | Medium | 6.3 | 2026-05-11 | A weakness has been identified in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this vulnerability is the function sub_445E7C of the file /goform/formDMZ… |
CVE-2026-7010 | Medium | 6.5 | 2026-05-11 | HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and… |
CVE-2026-44695 | Medium | 5.8 | 2026-05-11 | Outline is a service that allows for collaborative documentation. Prior to 1.7.1, the Slack integration callback for GET /auth/slack.post accepts an unsigned… |
CVE-2026-43897 | | 2026-05-11 | Link Preview JS extracts web links information. Prior to 4.0.1, the library did not check for IPv6 loopback attacks. There was also a DNS attack, where an addr… | |
CVE-2026-43893 | High | 8.2 | 2026-05-11 | exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where a… |
CVE-2026-43890 | High | 7.7 | 2026-05-11 | Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.7.0, the subscriptions.create API endpoint in server/routes/api/subscription… |
CVE-2026-43889 | Medium | 6.5 | 2026-05-11 | Outline is a service that allows for collaborative documentation. Prior to 1.7.0, the shares.create API accepts both collectionId and documentId simultaneously… |
CVE-2026-43888 | High | 8.7 | 2026-05-11 | Outline is a service that allows for collaborative documentation. Prior to 1.7.0, ZipHelper.extract computes the extraction path for each entry by passing a fu… |
CVE-2026-43887 | High | 7.3 | 2026-05-11 | Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, the Outline comment section permits users to mention other users; howev… |
CVE-2026-43886 | High | 8.2 | 2026-05-11 | Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() uses Array.some() to va… |
CVE-2026-43885 | | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php an… | |
CVE-2026-43884 | High | 7.7 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, two endpoints (plugin/AI/receiveAsync.json.php and objects/EpgParser.php) i… |
CVE-2026-43883 | Medium | 4.2 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/PayPalYPT/agreementCancel.json.php cancels a PayPal billing agreemen… |
CVE-2026-43882 | Medium | 4.3 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, the unauthenticated plugin/Scheduler/downloadICS.php endpoint passes attack… |
CVE-2026-43881 | Medium | 5.3 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/users.json.php exposes two unauthenticated paths that disclose the… |
CVE-2026-43880 | Medium | 5.3 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes two branches depending on whether contac… |
CVE-2026-43879 | Medium | 5.4 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, an authenticated user can configure their own donation-notification webhook… |
CVE-2026-43878 | Medium | 6.1 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/Meet/iframe.php echoes the attacker-controlled user and pass query p… |
CVE-2026-43877 | Medium | 5.4 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSavePhoto.php is a legacy profile-photo endpoint that accepts a… |
CVE-2026-43876 | Medium | 6.4 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySubscribers.json.php takes the raw message POST parameter and… |
CVE-2026-43875 | Medium | 6.8 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/MobileManager/oauth2.php completes an OAuth login by sending an HTTP… |
CVE-2026-43873 | High | 7.5 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared sec… |
CVE-2026-42600 | Medium | 4.9 | 2026-05-11 | MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z, A path traversal vulnerability in… |
CVE-2026-42564 | High | 8.2 | 2026-05-11 | jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filen… |
CVE-2026-42188 | Low | 2.4 | 2026-05-11 | Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in… |
CVE-2026-42046 | High | 7.8 | 2026-05-11 | libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacke… |
CVE-2026-34961 | Medium | 6.2 | 2026-05-11 | barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the eh_entries field against… |
CVE-2026-34960 | Medium | 6.5 | 2026-05-11 | barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcp_message_type() function that fails to ve… |
CVE-2026-43874 | High | 7.2 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, the server-side mitigation for the YPTSocket autoEvalCodeOnHTML eval sink (… |
CVE-2026-43668 | High | 7.5 | 2026-05-11 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequ… |
CVE-2026-43666 | Medium | 6.2 | 2026-05-11 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS… |
CVE-2026-43661 | High | 7.5 | 2026-05-11 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Seq… |
CVE-2026-43660 | High | 7.5 | 2026-05-11 | A validation issue was addressed with improved logic. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 2… |
CVE-2026-43659 | Medium | 4.7 | 2026-05-11 | A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7… |
CVE-2026-43658 | High | 7.5 | 2026-05-11 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Taho… |
CVE-2026-43656 | High | 7.3 | 2026-05-11 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS… |
CVE-2026-43655 | High | 7.3 | 2026-05-11 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5… |
CVE-2026-43654 | High | 7.5 | 2026-05-11 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, mac… |
CVE-2026-43653 | Medium | 6.2 | 2026-05-11 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, mac… |
CVE-2026-43652 | High | 7.5 | 2026-05-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data. |
CVE-2026-42888 | | 2026-05-11 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the podcast creation endpoint at server/controllers/PodcastController.js accepts… | |
CVE-2026-41489 | High | 8.8 | 2026-05-11 | Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to before Core 6.4.2 and FTL 6.6.1… |
CVE-2026-39871 | High | 7.5 | 2026-05-11 | A path handling issue was addressed with improved logic. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able… |
CVE-2026-39870 | High | 7.5 | 2026-05-11 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Processing a malicio… |
CVE-2026-39869 | Medium | 4.3 | 2026-05-11 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, mac… |
CVE-2026-37630 | High | 7.3 | 2026-05-11 | An issue in QuickJS-NG v.0.12.1 allows an attacker to execute arbitrary code via the js_mapped_arguments_mark function |
CVE-2026-28996 | Medium | 5.5 | 2026-05-11 | A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7… |
CVE-2026-28995 | High | 8.8 | 2026-05-11 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 2… |
CVE-2026-28994 | Medium | 5.3 | 2026-05-11 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequ… |
CVE-2026-28993 | Medium | 5.5 | 2026-05-11 | This issue was addressed by adding an additional prompt for user consent. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS… |
CVE-2026-28992 | Medium | 4.7 | 2026-05-11 | A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Seq… |
CVE-2026-28991 | High | 7.5 | 2026-05-11 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5… |
CVE-2026-28990 | High | 7.5 | 2026-05-11 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, m… |
CVE-2026-28988 | Medium | 5.5 | 2026-05-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, watchOS 26.5… |
CVE-2026-28987 | High | 7.5 | 2026-05-11 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7… |
CVE-2026-28986 | High | 7.5 | 2026-05-11 | A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7… |
CVE-2026-28985 | Medium | 6.2 | 2026-05-11 | A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5. An attac… |
CVE-2026-28983 | High | 7.5 | 2026-05-11 | A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8… |
CVE-2026-28978 | High | 8.8 | 2026-05-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A malicious… |
CVE-2026-28977 | Medium | 6.2 | 2026-05-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS… |
CVE-2026-28976 | High | 7.5 | 2026-05-11 | An information leakage was addressed with additional validation. This issue is fixed in macOS Tahoe 26.5. An app may be able to gain root privileges. |
CVE-2026-28974 | High | 7.5 | 2026-05-11 | This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tah… |
CVE-2026-28972 | Medium | 6.5 | 2026-05-11 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS… |
CVE-2026-28971 | Medium | 4.3 | 2026-05-11 | The issue was addressed with improved UI handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. A malicious i… |
CVE-2026-28969 | High | 7.5 | 2026-05-11 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequ… |
CVE-2026-28967 | Medium | 4.9 | 2026-05-11 | A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4. An attac… |
CVE-2026-28965 | High | 7.5 | 2026-05-11 | A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.5 and iPadOS 26.5. A user may be able to view restricted content from the loc… |
CVE-2026-28964 | High | 7.5 | 2026-05-11 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may b… |
CVE-2026-28963 | Medium | 4.6 | 2026-05-11 | A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to… |
CVE-2026-28962 | High | 7.5 | 2026-05-11 | This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS T… |
CVE-2026-28961 | Medium | 4.6 | 2026-05-11 | This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. An attacker with physical ac… |
CVE-2026-28959 | High | 7.5 | 2026-05-11 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15… |
CVE-2026-28958 | Medium | 5.5 | 2026-05-11 | This issue was addressed with improved data protection. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tah… |