2026 CVEs (page 314)
Page 314 of 463 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32655 | Medium | 5.3 | 2026-04-27 | Dell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local acces… |
CVE-2026-31256 | High | 7.5 | 2026-04-27 | A null pointer dereference vulnerability exists in the RTSP service of the MERCURY MIPC252W 1.0.5 Build 230306 Rel.79931n. During the processing of a SETUP req… |
CVE-2026-31255 | Critical | 9.8 | 2026-04-27 | A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi. The vulnerability is located in the /goform/SetSambaCfg interface, where improper ha… |
CVE-2026-7146 | High | 7.3 | 2026-04-27 | A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability i… |
CVE-2026-7145 | Medium | 5.4 | 2026-04-27 | A weakness has been identified in mettle sendportal up to 3.0.1. Affected is the function destroy of the file app/Http/Controllers/Workspaces/WorkspaceInvitati… |
CVE-2026-7144 | Medium | 4.3 | 2026-04-27 | A security flaw has been discovered in 1000 Projects Portfolio Management System MCA 1.0. This impacts an unknown function of the file update_passwd_process.ph… |
CVE-2026-7143 | Medium | 6.3 | 2026-04-27 | A vulnerability was identified in 1000 Projects Portfolio Management System MCA up to 1.0. This affects an unknown function of the file /admin/block_status.php… |
CVE-2026-31691 | Medium | 5.5 | 2026-04-27 | In the Linux kernel, the following vulnerability has been resolved: igb: remove napi_synchronize() in igb_down() When an AF_XDP zero-copy application termina… |
CVE-2026-31690 | High | 7.8 | 2026-04-27 | In the Linux kernel, the following vulnerability has been resolved: firmware: thead: Fix buffer overflow and use standard endian macros Addresses two issues… |
CVE-2026-31689 | Medium | 5.5 | 2026-04-27 | In the Linux kernel, the following vulnerability has been resolved: EDAC/mc: Fix error path ordering in edac_mc_alloc() When the mci->pvt_info allocation in… |
CVE-2026-31687 | Medium | 5.5 | 2026-04-27 | In the Linux kernel, the following vulnerability has been resolved: gpio: omap: do not register driver in probe() Commit 11a78b794496 ("ARM: OMAP: MPUIO wake… |
CVE-2026-31686 | High | 7.8 | 2026-04-27 | In the Linux kernel, the following vulnerability has been resolved: mm/kasan: fix double free for kasan pXds kasan_free_pxd() assumes the page table is alway… |
CVE-2026-25908 | Medium | 6.7 | 2026-04-27 | Dell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain an Execution with Unnecessary Privileges vulnerability in the AWCC. A low privileged… |
CVE-2026-7142 | Medium | 6.3 | 2026-04-27 | A vulnerability was determined in Wooey up to 0.13.2. The impacted element is the function add_or_update_script of the file wooey/api/scripts.py of the compone… |
CVE-2026-7141 | Medium | 5.6 | 2026-04-27 | A vulnerability was found in vllm up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py of the componen… |
CVE-2026-7140 | Critical | 9.8 | 2026-04-27 | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component C… |
CVE-2026-7139 | Critical | 9.8 | 2026-04-27 | A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the componen… |
CVE-2026-38936 | Medium | 6.1 | 2026-04-27 | A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains parameter |
CVE-2026-38935 | Medium | 6.1 | 2026-04-27 | A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/view.php via the doctype parameter |
CVE-2026-38934 | High | 8.8 | 2026-04-27 | Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sens… |
CVE-2026-30462 | Medium | 4.3 | 2026-04-27 | A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to execute a directory traversal. |
CVE-2026-30346 | Medium | 4.3 | 2026-04-27 | An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via supplying a crafted… |
CVE-2026-7138 | Critical | 9.8 | 2026-04-27 | A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setNtpCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-7137 | Critical | 9.8 | 2026-04-27 | A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-7136 | Critical | 9.8 | 2026-04-27 | A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2026-7135 | Medium | 5.3 | 2026-04-27 | A security flaw has been discovered in GPAC up to 26.03-DEV-rev105-g8f39a1eb3-master. Affected by this vulnerability is the function elng_box_read of the file… |
CVE-2026-7134 | Medium | 4.7 | 2026-04-27 | A vulnerability was identified in code-projects Online Lot Reservation System 1.0. Affected is an unknown function of the file /edithousepic.php. Such manipula… |
CVE-2026-6970 | | 2026-04-27 | authd prior to version 0.6.4 contains a logic error in primary group ID assignment that can lead to local privilege escalation. When a user's primary group ID… | |
CVE-2026-41467 | Medium | 5.4 | 2026-04-27 | ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the file upload functionality where the checkValidFileName() funct… |
CVE-2026-41466 | Medium | 5.4 | 2026-04-27 | ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the checkValidHtmlText() function within Security.php that fails t… |
CVE-2026-41465 | Medium | 6.5 | 2026-04-27 | ProjeQtor versions 7.0 through 12.4.3 contain a path traversal vulnerability in the log file viewer at dynamicDialog.php where the logname parameter is not val… |
CVE-2026-41464 | Medium | 6.5 | 2026-04-27 | ProjeQtor versions 7.0 through 12.4.3 contain a missing authorization vulnerability in the objectDetail.php endpoint that allows authenticated users with guest… |
CVE-2026-41463 | High | 8.8 | 2026-04-27 | ProjeQtor versions 7.0 through 12.4.3 contain a ZipSlip path traversal vulnerability in the plugin upload functionality that allows authenticated attackers wit… |
CVE-2026-41462 | Critical | 9.8 | 2026-04-27 | ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly co… |
CVE-2026-30352 | Critical | 9.8 | 2026-04-27 | A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code v… |
CVE-2026-30351 | High | 7.5 | 2026-04-27 | A path traversal vulnerability in the UI/static component of leonvanzyl autocoder commit 79d02a allows attackers to read arbitrary files via sending crafted UR… |
CVE-2026-7133 | Medium | 4.7 | 2026-04-27 | A vulnerability was determined in code-projects Online Lot Reservation System 1.0. This impacts an unknown function of the file /activity.php. This manipulatio… |
CVE-2026-7132 | Medium | 5.3 | 2026-04-27 | A vulnerability was found in code-projects Online Lot Reservation System up to 1.0. This affects the function readfile of the file /download.php. The manipulat… |
CVE-2026-7131 | High | 7.3 | 2026-04-27 | A vulnerability has been found in code-projects Online Lot Reservation System up to 1.0. The impacted element is an unknown function of the file /loginuser.php… |
CVE-2026-6357 | | 2026-04-27 | pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. Thes… | |
CVE-2026-40514 | Medium | 5.9 | 2026-04-27 | SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys an… |
CVE-2026-30350 | High | 7.5 | 2026-04-27 | An issue in the /store/items/search endpoint of Agent Protocol server commit e9a89f allows attackers to cause a Denial of Service (DoS) via a crafted POST requ… |
CVE-2026-7130 | High | 7.3 | 2026-04-27 | A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=delet… |
CVE-2026-7129 | Medium | 4.3 | 2026-04-27 | A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /index.php?page=categories… |
CVE-2026-7128 | High | 7.3 | 2026-04-27 | A security vulnerability has been detected in SourceCodester Pharmacy Sales and Inventory System 1.0. This issue affects some unknown processing of the file /a… |
CVE-2026-7127 | High | 7.3 | 2026-04-27 | A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=… |
CVE-2026-7126 | High | 7.3 | 2026-04-27 | A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajax.php?action=save_c… |
CVE-2026-6265 | High | 8.8 | 2026-04-27 | Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This issue has been resolved in Cerberus F… |
CVE-2026-41081 | Medium | 6.5 | 2026-04-27 | Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description… |
CVE-2026-40557 | Medium | 4.8 | 2026-04-27 | Improper Certificate Validation via Global SSL Context Downgrade in Apache Storm Prometheus Reporter Versions Affected: from 2.6.3 to 2.8.6 Description: … |
CVE-2026-32688 | High | 7.5 | 2026-04-27 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table ex… |
CVE-2026-7125 | Critical | 9.8 | 2026-04-27 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-7124 | Critical | 9.8 | 2026-04-27 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstec… |
CVE-2026-7123 | Critical | 9.8 | 2026-04-27 | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Ha… |
CVE-2026-7040 | High | 7.5 | 2026-04-27 | Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters. The minify functions mishandl… |
CVE-2026-7122 | Critical | 9.8 | 2026-04-27 | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component… |
CVE-2026-7121 | Critical | 9.8 | 2026-04-27 | A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Han… |
CVE-2026-7119 | High | 8.8 | 2026-04-27 | A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCountrystr. The manipulation of the argumen… |
CVE-2026-7118 | Medium | 6.3 | 2026-04-27 | A security vulnerability has been detected in code-projects Employee Management System 1.0. The affected element is an unknown function of the file 370project/… |
CVE-2026-7117 | Medium | 6.3 | 2026-04-27 | A weakness has been identified in code-projects Employee Management System 1.0. Impacted is an unknown function of the file 370project/approve.php. Executing a… |
CVE-2026-7116 | Medium | 4.3 | 2026-04-27 | A security flaw has been discovered in code-projects Employee Management System 1.0. This issue affects some unknown processing of the file 370project/mark.php… |
CVE-2026-5943 | High | 7.8 | 2026-04-27 | Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered document modification… |
CVE-2026-5942 | Medium | 5.5 | 2026-04-27 | Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalid… |
CVE-2026-5941 | High | 7.8 | 2026-04-27 | Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memor… |
CVE-2026-5940 | High | 7.8 | 2026-04-27 | Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes. |
CVE-2026-5939 | Medium | 5.5 | 2026-04-27 | A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code… |
CVE-2026-5938 | Medium | 5.5 | 2026-04-27 | Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of… |
CVE-2026-5937 | Medium | 5.5 | 2026-04-27 | Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argument" exception, ultim… |
CVE-2026-42410 | Medium | 6.5 | 2026-04-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows… |
CVE-2026-7115 | Medium | 6.3 | 2026-04-27 | A vulnerability was identified in code-projects Employee Management System 1.0. This vulnerability affects unknown code of the file 370project/delete.php. Such… |
CVE-2026-7114 | Medium | 6.3 | 2026-04-27 | A vulnerability was determined in code-projects Employee Management System 1.0. This affects an unknown part of the file 370project/edit.php. This manipulation… |
CVE-2026-7113 | Medium | 5.6 | 2026-04-27 | A vulnerability was found in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality of the file gateway/platforms/webhook.py of… |
CVE-2026-33453 | Critical | 10.0 | 2026-04-27 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component. Apache Camel's camel-coap c… |
CVE-2026-27172 | High | 8.8 | 2026-04-27 | The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method)… |
CVE-2026-22337 | Critical | 9.8 | 2026-04-27 | Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: f… |
CVE-2026-22336 | Critical | 9.3 | 2026-04-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Directorist Booking allows SQL Injection.This issue affec… |
CVE-2026-7112 | Medium | 5.6 | 2026-04-27 | A vulnerability has been found in NousResearch hermes-agent 0.8.0. Affected by this vulnerability is the function _check_auth of the file gateway/platforms/api… |
CVE-2026-7110 | Low | 3.5 | 2026-04-27 | A flaw has been found in code-projects Invoice System in Laravel 1.0. Affected is an unknown function of the file /item. Executing a manipulation of the argume… |
CVE-2026-7109 | Medium | 5.3 | 2026-04-27 | A vulnerability was detected in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /item of the component API Endpoint… |
CVE-2026-41409 | Critical | 9.8 | 2026-04-27 | The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applie… |
CVE-2026-40858 | High | 8.8 | 2026-04-27 | The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInpu… |
CVE-2026-40022 | High | 8.2 | 2026-04-27 | When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path su… |
CVE-2026-33454 | Critical | 9.4 | 2026-04-27 | The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) on… |
CVE-2026-7108 | Medium | 4.3 | 2026-04-27 | A security vulnerability has been detected in code-projects Invoice System in Laravel 1.0. This affects an unknown function. Such manipulation leads to cross-s… |
CVE-2026-7107 | Medium | 6.3 | 2026-04-27 | A weakness has been identified in code-projects Invoice System in Laravel 1.0. The impacted element is an unknown function of the file /company. This manipulat… |
CVE-2026-7103 | Low | 3.7 | 2026-04-27 | A vulnerability was determined in code-projects Chat System 1.0. Affected is an unknown function of the file update_user.php of the component MD5 Hash Handler… |
CVE-2026-7102 | Medium | 6.3 | 2026-04-27 | A vulnerability was found in Tenda F456 1.0.0.5. This impacts the function FromWriteFacMac of the file /goform/WriteFacMac of the component httpd. The manipula… |
CVE-2026-7101 | High | 8.8 | 2026-04-27 | A vulnerability has been found in Tenda F456 1.0.0.5. This affects the function fromWrlclientSet of the file /goform/WrlclientSet of the component httpd. The m… |
CVE-2026-7100 | High | 8.8 | 2026-04-27 | A flaw has been found in Tenda F456 1.0.0.5. The impacted element is the function fromNatlimitof of the file /goform/Natlimit of the component httpd. Executing… |
CVE-2026-7099 | High | 8.8 | 2026-04-27 | A vulnerability was detected in Tenda F456 1.0.0.5. The affected element is the function formQuickIndex of the file /goform/QuickIndex of the component httpd… |
CVE-2026-7098 | High | 8.8 | 2026-04-27 | A security vulnerability has been detected in Tenda F456 1.0.0.5. Impacted is the function fromDhcpListClient of the file /goform/DhcpListClient of the compone… |
CVE-2026-42379 | High | 7.7 | 2026-04-27 | Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data.This issue affects Templately… |
CVE-2026-41635 | Critical | 9.8 | 2026-04-27 | Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypas… |
CVE-2026-40860 | Critical | 9.8 | 2026-04-27 | JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values… |
CVE-2026-40473 | High | 8.8 | 2026-04-27 | The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInp… |
CVE-2026-40453 | Critical | 9.9 | 2026-04-27 | The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filt… |
CVE-2026-40048 | High | 7.8 | 2026-04-27 | The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStre… |
CVE-2026-7097 | High | 8.8 | 2026-04-27 | A weakness has been identified in Tenda F456 1.0.0.5. This issue affects the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter of the… |
CVE-2026-7096 | High | 8.8 | 2026-04-27 | A security flaw has been discovered in Tenda HG3 2.0 300003070. This vulnerability affects the function formgponConf of the file /boaform/admin/formgponConf. T… |
CVE-2026-7095 | Medium | 4.3 | 2026-04-27 | A vulnerability was identified in code-projects Employee Management System 1.0. This affects an unknown part of the file 370project/edit.php. The manipulation… |