2026 CVEs (page 310)
Page 310 of 463 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6520 | Medium | 5.5 | 2026-04-30 | OpenFlow v6 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-6519 | Medium | 5.5 | 2026-04-30 | MBIM protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-5657 | Medium | 5.5 | 2026-04-30 | iLBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-5655 | Medium | 5.5 | 2026-04-30 | SDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 allows denial of service |
CVE-2026-5654 | Medium | 5.5 | 2026-04-30 | AMR-NB codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-5653 | Medium | 5.5 | 2026-04-30 | DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-5409 | Medium | 5.5 | 2026-04-30 | Monero protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-5408 | Medium | 5.5 | 2026-04-30 | BT-DHT protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-5407 | Medium | 5.5 | 2026-04-30 | SMB2 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-5406 | Medium | 5.5 | 2026-04-30 | FC-SWILS protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-5402 | High | 8.8 | 2026-04-30 | TLS protocol dissector heap overflow in Wireshark 4.6.0 to 4.6.4 allows denial of service and possible code execution |
CVE-2026-5401 | Medium | 5.5 | 2026-04-30 | AFP Spotlight protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-5299 | Medium | 5.5 | 2026-04-30 | ICMPv6 PvD protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-42798 | Medium | 4.0 | 2026-04-30 | Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c. |
CVE-2026-42511 | High | 8.1 | 2026-04-30 | The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the… |
CVE-2026-41226 | Medium | 4.7 | 2026-04-30 | Open redirect vulnerability exists in Multiple laser printers and MFPs which implement Ricoh Web Image Monitor. When accessing a specially crafted URL, the use… |
CVE-2026-7379 | Medium | 5.5 | 2026-04-30 | Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-7378 | Medium | 5.5 | 2026-04-30 | Crash in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-7376 | Medium | 5.5 | 2026-04-30 | Crash in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-7375 | Medium | 5.5 | 2026-04-30 | UDS protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-6868 | Medium | 5.5 | 2026-04-30 | HTTP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-7470 | High | 8.8 | 2026-04-30 | A flaw has been found in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. Affected is the function sub_427C3C of the file /goform/SafeMacFilter. This manipulation… |
CVE-2026-7469 | Medium | 6.3 | 2026-04-30 | A vulnerability was detected in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. This impacts the function sub_425A28 of the file /goform/DelFil. The manipulation… |
CVE-2026-7468 | High | 7.3 | 2026-04-30 | A security vulnerability has been detected in 1024-lab smart-admin up to 3.30.0. This affects an unknown function of the file /smart-admin-api/druid/index.html… |
CVE-2026-7447 | Medium | 6.3 | 2026-04-30 | A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/update_customer.php. T… |
CVE-2026-7446 | High | 7.3 | 2026-04-30 | A vulnerability was detected in VetCoders mcp-server-semgrep 1.0.0. This affects the function analyze_results/filter_results/export_results/compare_results/sca… |
CVE-2026-7445 | Medium | 6.3 | 2026-04-30 | A security vulnerability has been detected in ZachHandley ZMCPTools up to 0.2.2. Affected by this issue is some unknown functionality of the file src/managers/… |
CVE-2026-7443 | High | 7.3 | 2026-04-29 | A weakness has been identified in BurtTheCoder mcp-dnstwist up to 1.0.4. Affected by this vulnerability is the function fuzz_domain of the file src/index.ts of… |
CVE-2026-7420 | High | 8.8 | 2026-04-29 | A security flaw has been discovered in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file route/goform/ConfigAdvideo. The… |
CVE-2026-7419 | High | 8.8 | 2026-04-29 | A vulnerability was identified in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects the function strcpy of the file route/goform/formTaskEdit_ap… |
CVE-2026-7381 | Critical | 9.1 | 2026-04-29 | Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation se… |
CVE-2026-7418 | High | 8.8 | 2026-04-29 | A vulnerability was determined in UTT HiPER 1250GW up to 3.2.7-210907-180535. This vulnerability affects the function strcpy of the file route/goform/NTP. Exec… |
CVE-2026-7417 | High | 7.3 | 2026-04-29 | A vulnerability was found in Algovate xhs-mcp 0.8.11. This affects the function xhs_publish_content of the file src/server/mcp.server.ts of the component MCP I… |
CVE-2026-7416 | High | 7.3 | 2026-04-29 | A vulnerability was found in PolarVista xcode-mcp-server 1.0.0. This issue affects the function build_project/run_tests of the file src/index.ts of the compone… |
CVE-2026-7410 | Medium | 6.3 | 2026-04-29 | A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=add_t… |
CVE-2026-7409 | Medium | 4.7 | 2026-04-29 | A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_user of the file /admin/ajax.php?action=save_user. Executi… |
CVE-2026-7408 | Medium | 4.7 | 2026-04-29 | A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save_menu of the file /admin/ajax.php?actio… |
CVE-2026-7407 | Medium | 4.7 | 2026-04-29 | A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function save_settings of the… |
CVE-2026-7404 | High | 7.3 | 2026-04-29 | A weakness has been identified in getsimpletool mcpo-simple-server up to 0.2.0. Affected is the function delete_shared_prompt of the file src/mcpo_simple_serve… |
CVE-2026-7403 | Medium | 5.3 | 2026-04-29 | A security flaw has been discovered in geldata gel-mcp 0.1.0. This impacts the function list_rules/fetch_rule of the file src/gel_mcp/server.py. The manipulati… |
CVE-2026-1858 | Medium | 4.8 | 2026-04-29 | wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated pr… |
CVE-2026-7426 | High | 8.1 | 2026-04-29 | Insufficient validation of the prefix length field in IPv6 Router Advertisement processing in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent net… |
CVE-2026-7425 | Medium | 6.5 | 2026-04-29 | Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to… |
CVE-2026-7401 | Medium | 4.3 | 2026-04-29 | A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown code of the fi… |
CVE-2026-7400 | High | 7.3 | 2026-04-29 | A security vulnerability has been detected in geekgod382 filesystem-mcp-server 1.0.0. This issue affects the function is_path_allowed of the file server.py of… |
CVE-2026-34965 | High | 8.8 | 2026-04-29 | Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_collection endpoint that allows authenticated attack… |
CVE-2026-7466 | High | 8.8 | 2026-04-29 | AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipeli… |
CVE-2026-7439 | Medium | 4.4 | 2026-04-29 | AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation… |
CVE-2026-7424 | High | 8.1 | 2026-04-29 | Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 a… |
CVE-2026-7423 | Medium | 5.3 | 2026-04-29 | Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of… |
CVE-2026-7422 | Medium | 6.5 | 2026-04-29 | Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validatio… |
CVE-2026-7398 | High | 7.3 | 2026-04-29 | A weakness has been identified in florensiawidjaja BioinfoMCP up to 7ada7918b9e515604d3c0ae264d3a9af10bf6e54. This vulnerability affects the function Upload of… |
CVE-2026-7397 | Medium | 4.4 | 2026-04-29 | A security flaw has been discovered in NousResearch hermes-agent 0.8.0. This affects the function _check_sensitive_path of the file tools/file_tools.py. The ma… |
CVE-2026-41499 | Medium | 6.5 | 2026-04-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, multiple heap-based… |
CVE-2026-30893 | Critical | 9.0 | 2026-04-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vul… |
CVE-2026-28221 | Medium | 6.5 | 2026-04-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.8.0 to before version 4.14.4, a stack-based buffer… |
CVE-2026-27105 | Medium | 6.3 | 2026-04-29 | Dell/Alienware Purchased Apps, versions prior to 1.1.31.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privi… |
CVE-2026-26206 | Medium | 6.5 | 2026-04-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API b… |
CVE-2026-7396 | Medium | 5.3 | 2026-04-29 | A vulnerability was identified in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality of the file gateway/platforms/wecom.py… |
CVE-2026-7394 | Medium | 4.7 | 2026-04-29 | A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/vi… |
CVE-2026-5712 | High | 8.0 | 2026-04-29 | This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definit… |
CVE-2026-26204 | Medium | 4.4 | 2026-04-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-… |
CVE-2026-26015 | Critical | 9.8 | 2026-04-29 | DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an attacker accessing both the official DocsGPT website or any l… |
CVE-2026-7393 | Medium | 4.7 | 2026-04-29 | A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function save_menu of the file /admin/admin_class_novo.php of the com… |
CVE-2026-7392 | Medium | 6.3 | 2026-04-29 | A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function delete_supplier of the file /ajax.php?actio… |
CVE-2026-7391 | Medium | 6.3 | 2026-04-29 | A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function save_supplier of the file /ajax.php?action=save_supp… |
CVE-2026-6915 | Medium | 6.3 | 2026-04-29 | An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with a… |
CVE-2026-6914 | Medium | 6.5 | 2026-04-29 | Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoD… |
CVE-2026-0206 | Medium | 4.9 | 2026-04-29 | A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewall. |
CVE-2026-0205 | Medium | 6.8 | 2026-04-29 | A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services. |
CVE-2026-0204 | High | 8.0 | 2026-04-29 | A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions. |
CVE-2026-7390 | Low | 3.5 | 2026-04-29 | A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. The impacted element is the function Customer of the file /index.php?pa… |
CVE-2026-7389 | High | 7.3 | 2026-04-29 | A security vulnerability has been detected in EyouCMS up to 1.7.9. The affected element is the function GetSortData of the file application/common.php. The man… |
CVE-2026-7388 | Medium | 4.7 | 2026-04-29 | A weakness has been identified in EyouCMS up to 1.7.9. Impacted is the function editFile of the file application/admin/logic/FilemanagerLogic.php of the compon… |
CVE-2026-7386 | High | 7.3 | 2026-04-29 | A flaw has been found in fatbobman mail-mcp-bridge up to 1.3.3. Affected is an unknown function of the file src/mail_mcp_server.py. Executing a manipulation of… |
CVE-2026-6849 | High | 8.8 | 2026-04-29 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Insti… |
CVE-2026-5166 | Critical | 9.6 | 2026-04-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus… |
CVE-2026-42198 | High | 7.5 | 2026-04-29 | pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during… |
CVE-2026-41940 | Critical | 9.8 | 2026-04-29 | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unaut… |
CVE-2026-40230 | Medium | 5.4 | 2026-04-29 | Helpy contains a stored cross-site scripting vulnerability in the knowledge base Doc rendering logic. An authenticated attacker with admin or agent editor priv… |
CVE-2026-40229 | Medium | 5.4 | 2026-04-29 | Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML in their account na… |
CVE-2026-38993 | Medium | 6.5 | 2026-04-29 | Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to… |
CVE-2026-38991 | High | 8.8 | 2026-04-29 | Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename bypasse… |
CVE-2026-37555 | High | 7.5 | 2026-04-29 | An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) a… |
CVE-2026-30769 | High | 7.8 | 2026-04-29 | An issue in the TVicPort64.sys component of EnTech Taiwan TVicPort Product v4.0, File v5.2.1.0 allows attackers to escalate privileges via sending crafted IOCT… |
CVE-2026-2810 | | 2026-04-29 | Netskope was notified about a potential gap in the Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can poten… | |
CVE-2026-7384 | High | 7.3 | 2026-04-29 | A vulnerability was detected in ezequiroga mcp-bases 357ca19c7a49a9b9cb2ef639b366f03aba8bea39/c630b8ab0f970614d42da8e566e9c0d15a16414c. This impacts the functi… |
CVE-2026-7111 | High | 8.4 | 2026-04-29 | Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or m… |
CVE-2026-5161 | High | 8.8 | 2026-04-29 | Improper link resolution before file access ('link following') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Sym… |
CVE-2026-5141 | High | 8.8 | 2026-04-29 | Improper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute… |
CVE-2026-41952 | High | 7.8 | 2026-04-29 | Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212, Acro… |
CVE-2026-41220 | High | 7.8 | 2026-04-29 | Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212, Acro… |
CVE-2026-38992 | Critical | 9.8 | 2026-04-29 | Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker… |
CVE-2026-36841 | Critical | 9.8 | 2026-04-29 | TOTOLINK N200RE V5 was discovered to contain a command injection vulnerability via the macstr and bandstr parameters in the formMapDelDevice function. |
CVE-2026-36837 | High | 7.5 | 2026-04-29 | TOTOLINK A3002RU V3 <= V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the hostname parameter in the formMapDelDevice functio… |
CVE-2026-25852 | Medium | 6.7 | 2026-04-29 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212. |
CVE-2026-5140 | High | 8.8 | 2026-04-29 | Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Auth… |
CVE-2026-42525 | Medium | 4.3 | 2026-04-29 | Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to per… |
CVE-2026-42524 | High | 8.0 | 2026-04-29 | Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vul… |
CVE-2026-42523 | Critical | 9.0 | 2026-04-29 | Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook tri… |