2026 CVEs (page 307)
Page 307 of 691 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63220 | Medium | 4.8 | 2026-07-31 | CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End-Https header… |
CVE-2026-62323 | Medium | 6.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token… |
CVE-2026-55502 | High | 7.1 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though Get… |
CVE-2026-55499 | Medium | 4.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the ow… |
CVE-2026-55497 | Medium | 6.5 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but… |
CVE-2026-55496 | Medium | 4.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predic… |
CVE-2026-55495 | Medium | 4.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a… |
CVE-2026-43833 | Medium | 5.3 | 2026-07-31 | Full details and mitigation steps are currently restricted and will be published at a later date. |
CVE-2026-43832 | High | 7.5 | 2026-07-31 | Full details and mitigation steps are currently restricted and will be published at a later date. |
CVE-2026-43831 | High | 7.5 | 2026-07-31 | Full details and mitigation steps are currently restricted and will be published at a later date. |
CVE-2026-43830 | Critical | 9.8 | 2026-07-31 | Full details and mitigation steps are currently restricted and will be published at a later date. |
CVE-2026-43829 | High | 7.5 | 2026-07-31 | Full details and mitigation steps are currently restricted and will be published at a later date. |
CVE-2026-18157 | High | 7.8 | 2026-07-31 | A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in… |
CVE-2026-14541 | High | 7.5 | 2026-07-31 | An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google… |
CVE-2026-14540 | Medium | 6.1 | 2026-07-31 | A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. Wh… |
CVE-2026-14539 | High | 7.5 | 2026-07-31 | An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauth… |
CVE-2026-14538 | High | 7.7 | 2026-07-31 | An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1… |
CVE-2026-14537 | Critical | 9.8 | 2026-07-31 | Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to… |
CVE-2026-58039 | Low | 3.3 | 2026-07-31 | A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidenti… |
CVE-2026-66720 | Medium | 6.5 | 2026-07-30 | The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages… |
CVE-2026-66421 | Critical | 9.3 | 2026-07-30 | OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the adm… |
CVE-2026-66420 | High | 8.8 | 2026-07-30 | MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticat… |
CVE-2026-66369 | Medium | 6.5 | 2026-07-30 | The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus… |
CVE-2026-66364 | Medium | 6.5 | 2026-07-30 | The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When… |
CVE-2026-66360 | High | 7.5 | 2026-07-30 | The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of… |
CVE-2026-66349 | Medium | 6.5 | 2026-07-30 | The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER… |
CVE-2026-65423 | High | 8.8 | 2026-07-30 | An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write. |
CVE-2026-65421 | Medium | 6.5 | 2026-07-30 | The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read… |
CVE-2026-63550 | Medium | 6.5 | 2026-07-30 | The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded eleme… |
CVE-2026-63362 | Medium | 5.9 | 2026-07-30 | An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted U… |
CVE-2026-63035 | High | 8.1 | 2026-07-30 | A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or pot… |
CVE-2026-63033 | Medium | 6.5 | 2026-07-30 | A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one b… |
CVE-2026-61893 | Medium | 6.5 | 2026-07-30 | A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of… |
CVE-2026-56758 | Medium | 6.5 | 2026-07-30 | The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, a… |
CVE-2026-10031 | Medium | 5.4 | 2026-07-30 | SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbol… |
CVE-2026-68563 | Medium | 5.5 | 2026-07-30 | A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is… |
CVE-2026-68562 | Medium | 6.2 | 2026-07-30 | A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When… |
CVE-2026-64816 | Medium | 6.5 | 2026-07-30 | RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lut… |
CVE-2026-63559 | High | 7.5 | 2026-07-30 | An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potenti… |
CVE-2026-62845 | Medium | 4.7 | 2026-07-30 | Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolati… |
CVE-2026-62246 | High | 8.5 | 2026-07-30 | Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd… |
CVE-2026-5846 | Medium | 5.7 | 2026-07-30 | The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and en… |
CVE-2026-38709 | Critical | 9.8 | 2026-07-30 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover… |
CVE-2026-18064 | High | 7.5 | 2026-07-30 | An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reach… |
CVE-2026-12562 | High | 8.8 | 2026-07-30 | The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded sys… |
CVE-2026-68503 | Critical | 9.8 | 2026-07-30 | LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn… |
CVE-2026-68502 | Critical | 9.8 | 2026-07-30 | LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket… |
CVE-2026-68501 | Medium | 6.5 | 2026-07-30 | Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank… |
CVE-2026-68500 | High | 7.5 | 2026-07-30 | Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/upda… |
CVE-2026-68499 | Medium | 6.2 | 2026-07-30 | re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 patter… |
CVE-2026-66803 | Critical | 10.0 | 2026-07-30 | Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network. |
CVE-2026-66418 | Critical | 9.3 | 2026-07-30 | OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script… |
CVE-2026-61526 | Medium | 6.1 | 2026-07-30 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the er… |
CVE-2026-55777 | | 2026-07-30 | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to 1.11, the parse_ios()… | |
CVE-2026-55768 | | 2026-07-30 | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the buil… | |
CVE-2026-54715 | | 2026-07-30 | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. In version 1.10.2, parse_browse… | |
CVE-2026-52539 | Critical | 9.1 | 2026-07-30 | Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application falls back to the de… |
CVE-2026-35847 | Critical | 9.8 | 2026-07-30 | An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file |
CVE-2026-67594 | Critical | 9.8 | 2026-07-30 | Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploi… |
CVE-2026-67550 | Medium | 5.7 | 2026-07-30 | re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject b… |
CVE-2026-67530 | Medium | 6.4 | 2026-07-30 | WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/automations/engine.ts and its validatio… |
CVE-2026-67529 | Medium | 4.3 | 2026-07-30 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workP… |
CVE-2026-67528 | Medium | 4.3 | 2026-07-30 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resolved CustomOption records by global nume… |
CVE-2026-67527 | High | 7.6 | 2026-07-30 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and allowed auth… |
CVE-2026-67208 | Critical | 9.8 | 2026-07-30 | Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting… |
CVE-2026-67207 | High | 8.8 | 2026-07-30 | Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access… |
CVE-2026-67206 | High | 8.8 | 2026-07-30 | Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP fi… |
CVE-2026-66756 | Critical | 9.8 | 2026-07-30 | Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recomme… |
CVE-2026-66755 | High | 7.5 | 2026-07-30 | Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can p… |
CVE-2026-65835 | Medium | 6.6 | 2026-07-30 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItem… |
CVE-2026-65834 | Medium | 6.8 | 2026-07-30 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and Capsule… |
CVE-2026-12946 | Critical | 9.9 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code. |
CVE-2026-11536 | High | 8.5 | 2026-07-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector. |
CVE-2026-10569 | Medium | 4.3 | 2026-07-30 | IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8… |
CVE-2026-66416 | High | 8.8 | 2026-07-30 | Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authent… |
CVE-2026-66415 | High | 8.5 | 2026-07-30 | Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by… |
CVE-2026-66066 | | 2026-07-30 | Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libv… | |
CVE-2026-64870 | | 2026-07-30 | MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.update_tool passes caller-supplied download_url and… | |
CVE-2026-61536 | High | 7.5 | 2026-07-30 | Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {… |
CVE-2026-59881 | | 2026-07-30 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the… | |
CVE-2026-48499 | | 2026-07-30 | Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated… | |
CVE-2026-18245 | Critical | 9.0 | 2026-07-30 | Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in… |
CVE-2026-18140 | High | 7.5 | 2026-07-30 | Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every g… |
CVE-2026-15978 | High | 7.5 | 2026-07-30 | SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to… |
CVE-2026-15977 | High | 7.5 | 2026-07-30 | SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-a… |
CVE-2026-15976 | Critical | 9.8 | 2026-07-30 | SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, whe… |
CVE-2026-15974 | Medium | 6.5 | 2026-07-30 | SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to interna… |
CVE-2026-15971 | Critical | 9.8 | 2026-07-30 | SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code… |
CVE-2026-15969 | Critical | 9.8 | 2026-07-30 | SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command executi… |
CVE-2026-14227 | Medium | 4.9 | 2026-07-30 | An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could… |
CVE-2026-13444 | High | 8.1 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma p… |
CVE-2026-13435 | Critical | 9.9 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation. |
CVE-2026-12943 | Critical | 9.8 | 2026-07-30 | IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could all… |
CVE-2026-12942 | High | 7.5 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL reque… |
CVE-2026-12733 | High | 7.5 | 2026-07-30 | IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations. |
CVE-2026-12118 | Critical | 9.8 | 2026-07-30 | IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserializa… |
CVE-2026-11904 | Medium | 5.3 | 2026-07-30 | IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-10700 | Medium | 6.5 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user fi… |
CVE-2026-10695 | Medium | 6.2 | 2026-07-30 | IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced federated queries. |
CVE-2026-10545 | High | 7.5 | 2026-07-30 | IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites vi… |