2026 CVEs (page 303)
Page 303 of 691 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12816 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS bef… |
CVE-2026-12803 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Ca… |
CVE-2026-12802 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS befo… |
CVE-2026-58063 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS b… |
CVE-2026-58062 | Critical | 9.1 | 2026-08-03 | In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Jav… |
CVE-2026-58061 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS b… |
CVE-2026-58060 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java… |
CVE-2026-58059 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS… |
CVE-2026-20498 | Medium | 6.0 | 2026-08-03 | In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2026-20497 | Medium | 6.0 | 2026-08-03 | In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2026-20496 | Medium | 4.4 | 2026-08-03 | In geniezone, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has al… |
CVE-2026-20495 | High | 7.8 | 2026-08-03 | In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execut… |
CVE-2026-20494 | Medium | 5.5 | 2026-08-03 | In wifi, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already… |
CVE-2026-20493 | Medium | 4.4 | 2026-08-03 | In wifi, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obt… |
CVE-2026-20492 | Medium | 5.5 | 2026-08-03 | In Audio HAL, there is a possible system becoming unresponsive due to a race condition. This could lead to local denial of service with User execution privileg… |
CVE-2026-20491 | Medium | 5.5 | 2026-08-03 | In med, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with User execution privileges nee… |
CVE-2026-20490 | Medium | 4.4 | 2026-08-03 | In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obta… |
CVE-2026-20489 | Medium | 4.4 | 2026-08-03 | In display, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure if a malicious actor has alr… |
CVE-2026-20488 | Medium | 4.4 | 2026-08-03 | In display, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has… |
CVE-2026-20486 | Medium | 6.7 | 2026-08-03 | In imgsensor, there is a possible application crash due to incorrect error handling. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2026-20485 | Medium | 6.0 | 2026-08-03 | In HFRP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alrea… |
CVE-2026-20484 | Medium | 4.4 | 2026-08-03 | In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has… |
CVE-2026-20483 | High | 7.7 | 2026-08-03 | In Telephony, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additiona… |
CVE-2026-20482 | Medium | 6.5 | 2026-08-03 | In wlan STA FW, there is a possible system becoming unresponsive due to logging. This could lead to remote (proximal/adjacent) denial of service with no additi… |
CVE-2026-20481 | Medium | 6.0 | 2026-08-03 | In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2026-20480 | Medium | 5.5 | 2026-08-03 | In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges… |
CVE-2026-20479 | High | 7.5 | 2026-08-03 | In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue b… |
CVE-2026-20478 | Medium | 5.5 | 2026-08-03 | In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges… |
CVE-2026-20477 | Medium | 6.0 | 2026-08-03 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2026-20476 | Medium | 5.5 | 2026-08-03 | In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with User execution privileges needed… |
CVE-2026-20475 | Medium | 6.0 | 2026-08-03 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2026-20474 | Medium | 6.0 | 2026-08-03 | In display, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of privilege if a malicious actor has alre… |
CVE-2026-20473 | Medium | 6.0 | 2026-08-03 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2026-20472 | Medium | 4.4 | 2026-08-03 | In TFA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obta… |
CVE-2026-20471 | Medium | 4.6 | 2026-08-03 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service, if an attacker has physical access to… |
CVE-2026-20470 | Medium | 6.2 | 2026-08-03 | In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional… |
CVE-2026-20469 | Medium | 6.0 | 2026-08-03 | In trusted_mem, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious a… |
CVE-2026-20468 | Medium | 6.0 | 2026-08-03 | In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if a malicious actor has alre… |
CVE-2026-20467 | Medium | 6.0 | 2026-08-03 | In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2026-20466 | Medium | 6.1 | 2026-08-03 | In sec boot, there is a possible escalation of privilege due to a heap buffer overflow. This could lead to local escalation of privilege, if an attacker has ph… |
CVE-2026-20465 | High | 8.1 | 2026-08-03 | In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) escalation of privilege… |
CVE-2026-20464 | Medium | 6.5 | 2026-08-03 | In hevc decoder, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege if a malicious actor has… |
CVE-2026-18582 | Medium | 5.3 | 2026-08-03 | A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function Reporting_RCBWriteAccessHandler of the fi… |
CVE-2026-8763 | Critical | 9.1 | 2026-08-03 | In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS befor… |
CVE-2026-65875 | High | 7.1 | 2026-08-03 | BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code i… |
CVE-2026-59652 | Medium | 6.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper. |
CVE-2026-59651 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS be… |
CVE-2026-59650 | Critical | 9.1 | 2026-08-03 | In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73… |
CVE-2026-59649 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java L… |
CVE-2026-59648 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before… |
CVE-2026-59647 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73… |
CVE-2026-59646 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java… |
CVE-2026-59645 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle fo… |
CVE-2026-59644 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender. |
CVE-2026-59643 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA)… |
CVE-2026-59642 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LT… |
CVE-2026-59641 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java… |
CVE-2026-59640 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS… |
CVE-2026-59639 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS b… |
CVE-2026-59638 | Medium | 6.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle f… |
CVE-2026-18581 | Low | 3.3 | 2026-08-03 | A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the c… |
CVE-2026-15055 | High | 8.2 | 2026-08-03 | In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS befor… |
CVE-2026-12185 | High | 8.6 | 2026-08-03 | In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Jav… |
CVE-2026-3245 | High | 7.5 | 2026-08-03 | A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution. |
CVE-2026-18577 | High | 8.1 | 2026-08-02 | An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 |
CVE-2026-10848 | High | 7.0 | 2026-08-02 | The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract… |
CVE-2026-9856 | High | 7.1 | 2026-08-02 | A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in… |
CVE-2026-65321 | Critical | 9.8 | 2026-08-02 | PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-esca… |
CVE-2026-10774 | Low | 2.4 | 2026-08-02 | Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_keys_create()… |
CVE-2026-68583 | Medium | 5.4 | 2026-08-02 | luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inj… |
CVE-2026-68582 | Medium | 6.5 | 2026-08-02 | Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/… |
CVE-2026-68581 | High | 8.1 | 2026-08-02 | Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric… |
CVE-2026-68580 | High | 7.5 | 2026-08-02 | FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backend… |
CVE-2026-68579 | Critical | 9.6 | 2026-08-02 | FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function (client/Windows/wf_cliprd… |
CVE-2026-68578 | High | 7.5 | 2026-08-02 | ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no… |
CVE-2026-67357 | High | 7.5 | 2026-08-02 | ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in… |
CVE-2026-67356 | High | 8.8 | 2026-08-02 | ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().c… |
CVE-2026-12231 | Medium | 6.4 | 2026-08-02 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_infobox_image’ parameter in all versions up… |
CVE-2026-18573 | Medium | 6.5 | 2026-08-02 | A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a rea… |
CVE-2026-18572 | Medium | 6.5 | 2026-08-02 | Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access du… |
CVE-2026-18571 | Medium | 6.6 | 2026-08-02 | A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator… |
CVE-2026-18570 | Medium | 5.4 | 2026-08-02 | A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security… |
CVE-2026-16540 | High | 7.5 | 2026-08-02 | The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allo… |
CVE-2026-16292 | Medium | 5.4 | 2026-08-02 | The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attack… |
CVE-2026-16291 | Medium | 4.3 | 2026-08-02 | The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authentica… |
CVE-2026-16285 | High | 7.5 | 2026-08-02 | The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing un… |
CVE-2026-16273 | Medium | 4.6 | 2026-08-02 | The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing u… |
CVE-2026-16261 | High | 7.5 | 2026-08-02 | The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authen… |
CVE-2026-16256 | Critical | 9.8 | 2026-08-02 | The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that c… |
CVE-2026-16064 | Medium | 5.4 | 2026-08-02 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing… |
CVE-2026-16063 | Medium | 5.4 | 2026-08-02 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editin… |
CVE-2026-16062 | Medium | 6.6 | 2026-08-02 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event con… |
CVE-2026-16042 | Medium | 4.3 | 2026-08-02 | The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Sub… |
CVE-2026-15939 | Low | 2.7 | 2026-08-02 | The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, r… |
CVE-2026-15385 | Medium | 5.4 | 2026-08-02 | The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item set… |
CVE-2026-15248 | Medium | 5.5 | 2026-08-02 | The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with… |
CVE-2026-15241 | High | 7.5 | 2026-08-02 | The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenti… |
CVE-2026-15236 | High | 7.5 | 2026-08-02 | The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected acc… |
CVE-2026-15206 | High | 7.5 | 2026-08-02 | The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker… |
CVE-2026-15151 | High | 7.5 | 2026-08-02 | The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the l… |