2026 CVEs (page 313)
Page 313 of 463 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-7238 | Medium | 4.7 | 2026-04-28 | A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminUpdateAlbum.php. This manipulati… |
CVE-2026-7237 | High | 7.3 | 2026-04-28 | A vulnerability was detected in AgiFlow scaffold-mcp up to 1.0.27. Affected by this issue is some unknown functionality of the file packages/scaffold-mcp/src/s… |
CVE-2026-7235 | Medium | 5.3 | 2026-04-28 | A security vulnerability has been detected in ErlichLiu claude-agent-sdk-master up to b185aa7ff0d864581257008077b4010fca1747bf. Affected by this vulnerability… |
CVE-2026-4911 | Medium | 5.3 | 2026-04-28 | The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 This is due to the intentForStripe() func… |
CVE-2026-4805 | Medium | 6.4 | 2026-04-28 | The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input saniti… |
CVE-2026-41526 | Medium | 6.5 | 2026-04-28 | In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not ad… |
CVE-2026-41525 | Medium | 6.5 | 2026-04-28 | KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additiona… |
CVE-2026-40966 | Medium | 5.9 | 2026-04-28 | In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials… |
CVE-2026-7234 | High | 7.3 | 2026-04-28 | A weakness has been identified in BrowserOperator browser-operator-core up to 0.6.0. Affected is the function startsWith of the file scripts/component_server/s… |
CVE-2026-7233 | Low | 3.3 | 2026-04-28 | A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the compo… |
CVE-2026-7230 | Medium | 4.3 | 2026-04-28 | A vulnerability was found in SourceCodester Safety Anger Pad 1.0. The affected element is an unknown function. The manipulation of the argument angerDisplay re… |
CVE-2026-7229 | Medium | 6.3 | 2026-04-28 | A vulnerability was found in code-projects Coaching Management System 1.0. This affects an unknown function of the file /cims/modules/admin/reply.php of the co… |
CVE-2026-5306 | Medium | 5.4 | 2026-04-28 | The Check & Log Email WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS… |
CVE-2026-40967 | High | 8.6 | 2026-04-28 | In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages… |
CVE-2026-40356 | Medium | 5.9 | 2026-04-28 | In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on… |
CVE-2026-7228 | High | 7.3 | 2026-04-28 | A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function get_cart_count of the file /admin/ajax.php?action=ge… |
CVE-2026-7227 | High | 7.3 | 2026-04-28 | A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function Login of the file /admin/ajax.php?action=login. The manip… |
CVE-2026-7226 | High | 7.3 | 2026-04-28 | A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects the function login2 of the file /admin/ajax.php?a… |
CVE-2026-7225 | High | 7.3 | 2026-04-28 | A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function delete_menu of the file /admin/ajax.php?… |
CVE-2026-7224 | High | 7.3 | 2026-04-28 | A security flaw has been discovered in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function delete_cart of the file /admin/ajax.php?action=de… |
CVE-2026-6809 | Medium | 6.4 | 2026-04-28 | The Social Post Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Threads embed handler in all versions up to, and including, 2.0… |
CVE-2026-6725 | Medium | 6.4 | 2026-04-28 | The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcsm_text_rotator` s… |
CVE-2026-6551 | Medium | 6.4 | 2026-04-28 | The Timeline Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute of the timeline-blocks/tb-time… |
CVE-2026-42510 | Medium | 6.6 | 2026-04-28 | OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface. |
CVE-2026-40355 | Medium | 5.9 | 2026-04-28 | In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mech… |
CVE-2026-7223 | High | 7.3 | 2026-04-28 | A vulnerability was identified in BigSweetPotatoStudio HyperChat up to 2.0.0-alpha.63. Affected by this issue is the function fetch of the file packages/core/s… |
CVE-2026-7222 | Low | 3.5 | 2026-04-28 | A vulnerability was determined in code-projects Coaching Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /cims/mo… |
CVE-2026-7221 | High | 7.3 | 2026-04-28 | A vulnerability was found in TencentCloudBase CloudBase-MCP up to 2.17.0. Affected is the function openUrl of the file mcp/src/interactive-server.ts of the com… |
CVE-2026-7220 | High | 7.3 | 2026-04-28 | A vulnerability has been found in jackwrichards FastlyMCP up to 6f3d0b0e654fc51076badc7fa16c03c461f95620. This impacts an unknown function of the file fastly-m… |
CVE-2026-7219 | High | 7.2 | 2026-04-28 | A flaw has been found in Totolink N300RT 3.4.0-B20250430. This affects an unknown function of the file /boafrm/formIpQoS. Executing a manipulation of the argum… |
CVE-2026-7218 | High | 7.2 | 2026-04-28 | A vulnerability was detected in Totolink N300RT 3.4.0-B20250430. The impacted element is the function is_cmd_string_valid of the file /boafrm/formWsc of the co… |
CVE-2026-7217 | Medium | 5.3 | 2026-04-28 | A security vulnerability has been detected in Deepractice PromptX up to 2.4.0. The affected element is the function read_docx/read_xlsx/read_pptx/list_xlsx_she… |
CVE-2026-7216 | High | 7.3 | 2026-04-28 | A weakness has been identified in donchelo processing-claude-mcp-bridge up to e017b20a4b592a45531a6392f494007f04e661bd. Impacted is an unknown function of the… |
CVE-2026-7215 | High | 7.3 | 2026-04-28 | A security flaw has been discovered in egtai gmx-vmd-mcp up to 0.1.0. This issue affects the function launch_vmd_gui_tool of the file mcp_server.py of the comp… |
CVE-2026-1460 | High | 7.2 | 2026-04-28 | A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware ve… |
CVE-2026-0711 | Medium | 6.8 | 2026-04-28 | A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an… |
CVE-2026-7214 | High | 7.3 | 2026-04-28 | A vulnerability was identified in eghuzefa engineer-your-data up to 0.1.3. This vulnerability affects the function read_file/write_file/list_files/file_inf of… |
CVE-2026-7213 | High | 7.3 | 2026-04-28 | A vulnerability was detected in ef10007 MLOps_MCP 1.0.0. This impacts an unknown function of the file fastmcp_server.py of the component save_file Tool. The ma… |
CVE-2026-7212 | High | 7.3 | 2026-04-28 | A security vulnerability has been detected in edvardlindelof notes-mcp up to 0.1.4. This affects an unknown function of the file notes_mcp.py. The manipulation… |
CVE-2026-7211 | High | 7.3 | 2026-04-28 | A weakness has been identified in dvladimirov MCP up to 0.1.0. The impacted element is the function GitSearchRequest of the file mcp_server.py of the component… |
CVE-2026-7206 | High | 7.3 | 2026-04-28 | A security flaw has been discovered in dubydu sqlite-mcp up to 0.1.0. The affected element is the function extract_to_json of the file src/entry.py. Performing… |
CVE-2026-7205 | High | 7.3 | 2026-04-28 | A vulnerability was identified in duartium papers-mcp-server 9ceb3812a6458ba7922ca24a7406f8807bc55598. Impacted is the function search_papers of the file src/m… |
CVE-2026-7204 | Critical | 9.8 | 2026-04-28 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setPptpServerCfg of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2026-7203 | Critical | 9.8 | 2026-04-28 | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi o… |
CVE-2026-7202 | Critical | 9.8 | 2026-04-28 | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWiFiWpsStart of the file /cgi-bin/cstecgi.cgi of the compo… |
CVE-2026-32649 | Medium | 6.8 | 2026-04-28 | A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras. |
CVE-2026-32644 | Critical | 9.8 | 2026-04-28 | Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys. |
CVE-2026-20766 | High | 8.8 | 2026-04-28 | An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras. |
CVE-2026-7200 | Medium | 4.3 | 2026-04-28 | A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /index.php?pa… |
CVE-2026-7199 | High | 7.3 | 2026-04-28 | A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-7196 | Medium | 6.3 | 2026-04-28 | A security vulnerability has been detected in CodeAstro Online Classroom 1.0. Affected is an unknown function of the file /guestdetails. Such manipulation of t… |
CVE-2026-41372 | Medium | 5.8 | 2026-04-28 | OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections. Attackers… |
CVE-2026-41371 | High | 8.5 | 2026-04-28 | OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session res… |
CVE-2026-41370 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.3.31 contains a path traversal vulnerability in ACP dispatch that allows attackers to read arbitrary files by manipulating inbound channel… |
CVE-2026-41369 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compile… |
CVE-2026-41368 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.3.28 contains an environment variable disclosure vulnerability in the jq safe-bin policy that fails to block the $ENV filter. Attackers ca… |
CVE-2026-41367 | Medium | 5.0 | 2026-04-28 | OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers… |
CVE-2026-41366 | Medium | 5.5 | 2026-04-28 | OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file… |
CVE-2026-41365 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread mess… |
CVE-2026-41364 | High | 8.1 | 2026-04-28 | OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files. Attackers… |
CVE-2026-41363 | Medium | 5.3 | 2026-04-28 | OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-syst… |
CVE-2026-41362 | Medium | 4.3 | 2026-04-28 | OpenClaw versions 2026.2.19 before 2026.3.31 contain an improper cache isolation vulnerability in the Zalo webhook replay-dedupe mechanism that is shared acros… |
CVE-2026-40977 | Medium | 4.7 | 2026-04-28 | When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the… |
CVE-2026-40976 | Critical | 9.1 | 2026-04-28 | In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable… |
CVE-2026-40975 | Medium | 4.8 | 2026-04-28 | Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used f… |
CVE-2026-40974 | Medium | 5.0 | 2026-04-28 | Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0… |
CVE-2026-40973 | High | 7.0 | 2026-04-28 | A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persi… |
CVE-2026-40972 | High | 7.5 | 2026-04-28 | An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme ci… |
CVE-2026-27785 | High | 8.8 | 2026-04-28 | Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials. |
CVE-2026-7194 | High | 7.3 | 2026-04-27 | A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=save_pr… |
CVE-2026-7183 | Medium | 5.3 | 2026-04-27 | A vulnerability has been found in aligungr UERANSIM up to 3.2.7. The affected element is the function rls::DecodeRlsMessage in the library src/lib/rls/rls_pdu… |
CVE-2026-7179 | Medium | 5.3 | 2026-04-27 | A security vulnerability has been detected in OSPG binwalk up to 2.4.3. This vulnerability affects the function read_null_terminated_string of the file src/bin… |
CVE-2026-40971 | Medium | 5.0 | 2026-04-27 | When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. … |
CVE-2026-28747 | High | 7.1 | 2026-04-27 | A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed. |
CVE-2026-7178 | High | 7.3 | 2026-04-27 | A weakness has been identified in ChatGPTNextWeb NextChat up to 2.16.1. This affects the function storeUrl of the file app/api/artifacts/route.ts of the compon… |
CVE-2026-7177 | High | 7.3 | 2026-04-27 | A security flaw has been discovered in ChatGPTNextWeb NextChat up to 2.16.1. Affected by this issue is the function proxyHandler of the file app/api/[provider]… |
CVE-2026-7160 | High | 8.8 | 2026-04-27 | A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation… |
CVE-2026-7159 | High | 7.3 | 2026-04-27 | A vulnerability was found in douinc mkdocs-mcp-plugin up to 0.4.1. This affects the function read_document/list_documents of the file server.py. Performing a m… |
CVE-2026-7191 | High | 7.2 | 2026-04-27 | Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to ex… |
CVE-2026-7158 | High | 7.3 | 2026-04-27 | A vulnerability has been found in dmitryglhf mcp-url-downloader up to 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6. Affected by this issue is the function _validat… |
CVE-2026-7157 | High | 7.3 | 2026-04-27 | A flaw has been found in disler aider-mcp-server up to b2516fa466d0d851932da92ee6d0e66946db9efc. Affected by this vulnerability is an unknown functionality of… |
CVE-2026-7156 | Critical | 9.8 | 2026-04-27 | A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI… |
CVE-2026-7155 | Critical | 9.8 | 2026-04-27 | A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setLoginPasswordCfg of the file /cgi-bin/cstecgi… |
CVE-2026-7154 | Critical | 9.8 | 2026-04-27 | A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setAdvancedInfoShow of the file /cgi-bin/cstecgi.cgi of the c… |
CVE-2026-5362 | Medium | 5.4 | 2026-04-27 | An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution wh… |
CVE-2026-3087 | High | 7.5 | 2026-04-27 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the… |
CVE-2026-29971 | Medium | 6.1 | 2026-04-27 | A reflected cross-site scripting (XSS) vulnerability exists in WebFileSys version before 2.32.0 and fixed in v.2.32.0. User-controlled input is reflected into… |
CVE-2026-7153 | Critical | 9.8 | 2026-04-27 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setMiniuiHomeInfoShow of the file /cgi-bin/cs… |
CVE-2026-7152 | Critical | 9.8 | 2026-04-27 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of t… |
CVE-2026-7151 | High | 8.8 | 2026-04-27 | A vulnerability was determined in Tenda HG3 2.0. Impacted is the function formUploadConfig of the file /boaform/formIPv6Routing. This manipulation of the argum… |
CVE-2026-6741 | High | 8.8 | 2026-04-27 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including… |
CVE-2026-5394 | | 2026-04-27 | An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger un… | |
CVE-2026-7150 | Medium | 6.3 | 2026-04-27 | A vulnerability was found in dh1011 auto-favicon up to f189116a9259950c2393f114dbcb94dde0ad864b. This issue affects the function generate_favicon_from_url of t… |
CVE-2026-7149 | High | 7.3 | 2026-04-27 | A vulnerability has been found in dexhunter kaggle-mcp up to 406127ffcb2b91b8c10e20e6c2ca787fbc1dc92d. This vulnerability affects the function prepare_kaggle_d… |
CVE-2026-7148 | Medium | 6.3 | 2026-04-27 | A flaw has been found in CodeAstro Online Classroom 1.0. This affects an unknown part of the file /addnewfaculty. Executing a manipulation of the argument fnam… |
CVE-2026-7147 | High | 7.3 | 2026-04-27 | A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is some unknown functionality of the file server/routes/llm.js o… |
CVE-2026-40970 | Medium | 5.0 | 2026-04-27 | When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearc… |
CVE-2026-35903 | Critical | 9.8 | 2026-04-27 | MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service. After successful Digest authent… |
CVE-2026-35902 | Medium | 6.2 | 2026-04-27 | The RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 230306 has an issue handling failed Digest authentication attempts. By repeatedly sending RTSP reque… |
CVE-2026-35901 | Medium | 4.4 | 2026-04-27 | A handling issue in the RTSP service of the Mercury MIPC252W 1.0.5 Build 230306 Rel.79931n allows an authenticated attacker to trigger session termination by r… |