2026 CVEs (page 295)
Page 295 of 700 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-19374 | High | 7.3 | 2026-08-09 | A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file… |
CVE-2026-19373 | Medium | 5.3 | 2026-08-09 | A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the… |
CVE-2026-19372 | Medium | 5.3 | 2026-08-09 | A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the… |
CVE-2026-19371 | Medium | 5.3 | 2026-08-09 | A vulnerability was identified in Nikolaibibo claude-comfyui-mcp 1.0.0. Affected is the function copyFileSync of the file src/tools/utils.ts of the component c… |
CVE-2026-12372 | Low | 3.7 | 2026-08-09 | A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()`… |
CVE-2026-19370 | Medium | 5.3 | 2026-08-09 | A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts… |
CVE-2026-19369 | Medium | 5.3 | 2026-08-09 | A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component add_attachment_from… |
CVE-2026-19368 | Low | 3.3 | 2026-08-09 | A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown functionality of the file src/handlers/unified-gemini.ts of the… |
CVE-2026-19367 | Medium | 6.3 | 2026-08-09 | A vulnerability has been found in NocteDefensor LudusMCP 1.0.24. Affected by this vulnerability is an unknown functionality of the file src/tools/rangeConfig.t… |
CVE-2026-70395 | | 2026-08-09 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they ca… | |
CVE-2026-19366 | Medium | 5.3 | 2026-08-09 | A flaw has been found in NocteDefensor LudusMCP up to 1.0.24. Affected is an unknown function of the file src/tools/insertCredsRangeConfig.ts of the component… |
CVE-2026-19365 | Medium | 5.3 | 2026-08-09 | A vulnerability was identified in Ichigo3766 image-gen-mcp 0.1.0. The impacted element is an unknown function of the file src/index.ts of the component upscale… |
CVE-2026-69659 | Medium | 5.5 | 2026-08-09 | Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor… |
CVE-2026-19364 | Medium | 6.3 | 2026-08-09 | A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancych… |
CVE-2026-19363 | Medium | 5.3 | 2026-08-09 | A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorize… |
CVE-2026-19362 | Medium | 5.3 | 2026-08-09 | A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function parse_token_from_header of the file src/parse_token_from_head… |
CVE-2026-19361 | Low | 3.7 | 2026-08-09 | A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Exe… |
CVE-2026-15534 | Medium | 5.7 | 2026-08-09 | Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. Th… |
CVE-2026-19360 | Medium | 4.7 | 2026-08-09 | A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3. This affects the function ExcelLexBotS3TriggerFunction of the component Lambda Function Hand… |
CVE-2026-19359 | Medium | 4.7 | 2026-08-09 | A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component… |
CVE-2026-19358 | Medium | 6.3 | 2026-08-09 | A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is the function DefaultFunction. This manipulation causes impro… |
CVE-2026-19357 | Medium | 5.3 | 2026-08-09 | A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The mani… |
CVE-2026-19356 | Medium | 5.3 | 2026-08-09 | A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The ma… |
CVE-2026-19355 | High | 7.3 | 2026-08-09 | A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of th… |
CVE-2026-19354 | Medium | 6.3 | 2026-08-09 | A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers… |
CVE-2026-19353 | Medium | 5.0 | 2026-08-09 | A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function _4_Setup of the file install/index.php of the component I… |
CVE-2026-19352 | Low | 3.1 | 2026-08-09 | A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of th… |
CVE-2026-19351 | High | 7.3 | 2026-08-09 | A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.b… |
CVE-2026-19350 | Medium | 6.3 | 2026-08-09 | A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Modu… |
CVE-2026-19348 | Critical | 9.8 | 2026-08-09 | A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt… |
CVE-2026-19347 | Medium | 6.3 | 2026-08-09 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file /viewdoctor.php. Such man… |
CVE-2026-19346 | High | 8.8 | 2026-08-09 | A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulat… |
CVE-2026-19345 | Medium | 6.5 | 2026-08-09 | A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of… |
CVE-2026-19344 | High | 7.3 | 2026-08-09 | A vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/comment_coun… |
CVE-2026-19343 | High | 7.3 | 2026-08-09 | A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php… |
CVE-2026-19342 | High | 7.3 | 2026-08-09 | A vulnerability was detected in code-projects Task Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Perfor… |
CVE-2026-19341 | High | 8.8 | 2026-08-09 | A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/pptpSrvGlobalConfig. Su… |
CVE-2026-19340 | Medium | 6.3 | 2026-08-09 | A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0. This affects an unknown function of the file backend-fix/complete_backend.js of the com… |
CVE-2026-19339 | Medium | 6.3 | 2026-08-09 | A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of… |
CVE-2026-19338 | Medium | 5.3 | 2026-08-09 | A vulnerability was identified in automateyournetwork MCPyATS up to 0.1.4. The affected element is the function processGenerateRequest of the file mcp_servers/… |
CVE-2026-19337 | Medium | 5.3 | 2026-08-09 | A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component read_webpage… |
CVE-2026-19336 | Medium | 5.3 | 2026-08-09 | A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approv… |
CVE-2026-19335 | Medium | 5.3 | 2026-08-09 | A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc… |
CVE-2026-18603 | Medium | 6.5 | 2026-08-09 | The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the conten… |
CVE-2026-18473 | Critical | 9.1 | 2026-08-09 | The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injec… |
CVE-2026-18465 | Medium | 6.5 | 2026-08-09 | The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users… |
CVE-2026-18464 | High | 7.5 | 2026-08-09 | The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users… |
CVE-2026-18357 | High | 7.5 | 2026-08-09 | The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unaut… |
CVE-2026-18037 | Medium | 6.5 | 2026-08-09 | The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that rout… |
CVE-2026-18032 | High | 7.5 | 2026-08-09 | The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guar… |
CVE-2026-17044 | High | 8.6 | 2026-08-09 | The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL i… |
CVE-2026-17017 | High | 8.1 | 2026-08-09 | The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action… |
CVE-2026-17014 | Medium | 5.3 | 2026-08-09 | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing… |
CVE-2026-17011 | Low | 3.8 | 2026-08-09 | The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the… |
CVE-2026-16992 | Medium | 6.5 | 2026-08-09 | The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route addit… |
CVE-2026-16988 | High | 7.5 | 2026-08-09 | The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allow… |
CVE-2026-16965 | Medium | 4.3 | 2026-08-09 | The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as… |
CVE-2026-16957 | Low | 2.7 | 2026-08-09 | The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, al… |
CVE-2026-16032 | Medium | 6.1 | 2026-08-09 | The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and… |
CVE-2026-15038 | Critical | 9.8 | 2026-08-09 | The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-manageme… |
CVE-2026-19334 | Medium | 5.3 | 2026-08-09 | A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This affects an unknown part of the file src/index.ts. This manip… |
CVE-2026-19333 | Medium | 5.3 | 2026-08-09 | A vulnerability was detected in NightTrek Supabase-MCP cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170/db03237d92f7dc2f0da0d70a87dba84ebcde5b66. Affected by this issu… |
CVE-2026-19332 | Medium | 5.3 | 2026-08-09 | A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0. Affected by this vulnerability is an unknown functionality of the component run_openlane/v… |
CVE-2026-19331 | Medium | 5.3 | 2026-08-09 | A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0. This affects the function readCanvas/writeCanvas of the file src/services/CanvasServic… |
CVE-2026-19330 | Medium | 5.3 | 2026-08-09 | A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0. The impacted element is the function create_system_json/create_library to get_system… |
CVE-2026-19329 | Medium | 5.3 | 2026-08-09 | A vulnerability was found in andreahaku codex_mcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. The affected element is an unknown function of the file src/c… |
CVE-2026-10595 | High | 7.5 | 2026-08-09 | A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in `backend/routers/ui.py`. The vul… |
CVE-2026-19328 | Medium | 5.3 | 2026-08-09 | A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill o… |
CVE-2026-19327 | Medium | 5.3 | 2026-08-09 | A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. E… |
CVE-2026-19326 | Medium | 4.4 | 2026-08-09 | A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagemen… |
CVE-2026-19325 | Medium | 5.3 | 2026-08-09 | A security vulnerability has been detected in IncomeStreamSurfer roo-code-memory-bank-mcp-server up to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e. This affects t… |
CVE-2026-19324 | Low | 3.3 | 2026-08-09 | A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.re… |
CVE-2026-17510 | High | 7.5 | 2026-08-09 | Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute. print_attribut… |
CVE-2026-71993 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute ar… |
CVE-2026-71992 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter function that allows remote attackers to execute… |
CVE-2026-71991 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allow… |
CVE-2026-71990 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows r… |
CVE-2026-71989 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute… |
CVE-2026-71988 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw function that allows remote attackers to execute arb… |
CVE-2026-71987 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg function that allows remote attackers to execute arbitr… |
CVE-2026-71986 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz function that allows remote attackers to execute arbitr… |
CVE-2026-71985 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to exec… |
CVE-2026-71984 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute… |
CVE-2026-19323 | Medium | 5.3 | 2026-08-09 | A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function g… |
CVE-2026-71983 | Critical | 9.8 | 2026-08-08 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute a… |
CVE-2026-71502 | | 2026-08-08 | CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-render… | |
CVE-2026-71958 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi inter… |
CVE-2026-71957 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A… |
CVE-2026-71956 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface… |
CVE-2026-71955 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the /boafrm/formWsc in… |
CVE-2026-71954 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71953 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71952 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71951 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71950 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71949 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71948 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71947 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71946 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71945 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |