2026 CVEs (page 32)
Page 32 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15562 | High | 7.5 | 2026-08-11 | A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting ha… |
CVE-2026-15561 | High | 7.5 | 2026-08-11 | A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connec… |
CVE-2026-15560 | High | 8.1 | 2026-08-11 | when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthent… |
CVE-2026-15556 | High | 8.1 | 2026-08-11 | A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker… |
CVE-2026-15555 | High | 8.8 | 2026-08-11 | A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshalle… |
CVE-2026-15554 | High | 7.4 | 2026-08-11 | the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated… |
CVE-2026-10579 | Critical | 9.8 | 2026-08-11 | A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting a… |
CVE-2026-73156 | | 2026-08-11 | Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may orig… | |
CVE-2026-73155 | | 2026-08-11 | Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are author… | |
CVE-2026-73140 | | 2026-08-11 | Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieva… | |
CVE-2026-19519 | Medium | 4.3 | 2026-08-11 | A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. T… |
CVE-2026-19418 | | 2026-08-11 | The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend… | |
CVE-2026-19518 | Medium | 6.5 | 2026-08-11 | Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation. |
CVE-2026-19517 | Medium | 6.5 | 2026-08-11 | Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows… |
CVE-2026-19391 | Medium | 6.5 | 2026-08-11 | A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows… |
CVE-2026-16053 | High | 8.5 | 2026-08-11 | Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Onlin… |
CVE-2026-8158 | Medium | 5.3 | 2026-08-11 | The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to crash. The issue exclusively affects th… |
CVE-2026-6505 | Medium | 5.1 | 2026-08-11 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability ca… |
CVE-2026-6181 | Medium | 5.9 | 2026-08-11 | The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privilege… |
CVE-2026-5304 | Medium | 5.7 | 2026-08-11 | An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis d… |
CVE-2026-5303 | Medium | 5.7 | 2026-08-11 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability ca… |
CVE-2026-4757 | High | 7.2 | 2026-08-11 | A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be expl… |
CVE-2026-19516 | Critical | 9.1 | 2026-08-11 | A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller al… |
CVE-2026-18348 | Medium | 4.1 | 2026-08-11 | Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-contro… |
CVE-2026-14549 | Medium | 4.3 | 2026-08-11 | The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenti… |
CVE-2026-14548 | Medium | 6.5 | 2026-08-11 | The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenti… |
CVE-2026-13716 | Critical | 9.1 | 2026-08-11 | Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitte… |
CVE-2026-12052 | Medium | 5.2 | 2026-08-11 | The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-size response for the… |
CVE-2026-12051 | Medium | 4.6 | 2026-08-11 | The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL pointer dereference in handle_download() (subsys/u… |
CVE-2026-11894 | Medium | 5.9 | 2026-08-11 | The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, violated the bt_hci_driver_api buffer-ownership con… |
CVE-2026-19425 | Critical | 9.8 | 2026-08-11 | Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL… |
CVE-2026-16974 | Medium | 6.4 | 2026-08-11 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode i… |
CVE-2026-11985 | Low | 3.6 | 2026-08-11 | On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the "Floating point ABI" choice, which defaults to CONFIG_FP_HARDABI. Both FP_HARDABI and… |
CVE-2026-11893 | Medium | 5.9 | 2026-08-11 | The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drivers/bluetooth/hci/hci_bflb.c, violates the bt_hci_… |
CVE-2026-8917 | | 2026-08-11 | Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific valu… | |
CVE-2026-24330 | Medium | 6.5 | 2026-08-11 | A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted so… |
CVE-2026-24329 | Medium | 4.9 | 2026-08-11 | A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the… |
CVE-2026-19424 | High | 7.5 | 2026-08-11 | Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific par… |
CVE-2026-66779 | Medium | 6.3 | 2026-08-11 | Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make… |
CVE-2026-66778 | Medium | 5.3 | 2026-08-11 | SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a… |
CVE-2026-66777 | Medium | 5.9 | 2026-08-11 | SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required co… |
CVE-2026-66776 | Medium | 5.9 | 2026-08-11 | SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low p… |
CVE-2026-66775 | Medium | 4.3 | 2026-08-11 | SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious… |
CVE-2026-66774 | Low | 3.7 | 2026-08-11 | SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Succ… |
CVE-2026-66773 | Medium | 5.9 | 2026-08-11 | A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to… |
CVE-2026-66772 | Medium | 4.3 | 2026-08-11 | SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An a… |
CVE-2026-66771 | Medium | 6.1 | 2026-08-11 | SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequent… |
CVE-2026-66770 | Medium | 6.3 | 2026-08-11 | Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definition Language) string… |
CVE-2026-66764 | Medium | 4.3 | 2026-08-11 | Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have… |
CVE-2026-66763 | High | 7.9 | 2026-08-11 | SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An a… |
CVE-2026-66761 | Medium | 4.3 | 2026-08-11 | SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consum… |
CVE-2026-66760 | Medium | 6.4 | 2026-08-11 | SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same t… |
CVE-2026-58248 | Medium | 6.5 | 2026-08-11 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containin… |
CVE-2026-58247 | Medium | 5.3 | 2026-08-11 | SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data… |
CVE-2026-58245 | Low | 3.8 | 2026-08-11 | SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization… |
CVE-2026-58244 | Medium | 4.3 | 2026-08-11 | SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged… |
CVE-2026-58243 | High | 8.8 | 2026-08-11 | SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unaut… |
CVE-2026-58241 | Medium | 4.2 | 2026-08-11 | SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify configuration tabl… |
CVE-2026-58239 | Low | 3.7 | 2026-08-11 | SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the… |
CVE-2026-58238 | Medium | 5.9 | 2026-08-11 | SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that caus… |
CVE-2026-58237 | Medium | 5.9 | 2026-08-11 | WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to acc… |
CVE-2026-58236 | Medium | 5.5 | 2026-08-11 | SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path lea… |
CVE-2026-58235 | Medium | 6.3 | 2026-08-11 | SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer libraries that contain known vulnerabi… |
CVE-2026-58230 | High | 7.0 | 2026-08-11 | SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted to… |
CVE-2026-44765 | High | 7.3 | 2026-08-11 | Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access schedulin… |
CVE-2026-44764 | High | 7.3 | 2026-08-11 | Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests t… |
CVE-2026-44763 | High | 7.6 | 2026-08-11 | SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially c… |
CVE-2026-44762 | Low | 3.7 | 2026-08-11 | SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which co… |
CVE-2026-44758 | Critical | 9.1 | 2026-08-11 | SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionalit… |
CVE-2026-40130 | Medium | 5.3 | 2026-08-11 | SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands. An unauthenticated attacker could send specially crafted reque… |
CVE-2026-34265 | Critical | 9.8 | 2026-08-11 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. Th… |
CVE-2026-8718 | High | 8.4 | 2026-08-10 | tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the cal… |
CVE-2026-48161 | | 2026-08-10 | react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f… | |
CVE-2026-11812 | Low | 2.5 | 2026-08-10 | The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structure that holds the C… |
CVE-2026-11811 | Low | 3.7 | 2026-08-10 | The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on its connection-set… |
CVE-2026-72919 | Medium | 4.3 | 2026-08-10 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the c… |
CVE-2026-72918 | Medium | 5.4 | 2026-08-10 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the s… |
CVE-2026-72917 | Medium | 5.9 | 2026-08-10 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's… |
CVE-2026-72916 | | 2026-08-10 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_addre… | |
CVE-2026-72915 | High | 7.5 | 2026-08-10 | Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use… |
CVE-2026-72914 | High | 7.5 | 2026-08-10 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics end… |
CVE-2026-6426 | Medium | 4.4 | 2026-08-10 | A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by th… |
CVE-2026-73035 | Medium | 4.3 | 2026-08-10 | npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitra… |
CVE-2026-73033 | Medium | 6.5 | 2026-08-10 | Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php… |
CVE-2026-73030 | High | 8.1 | 2026-08-10 | unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths befo… |
CVE-2026-72913 | | 2026-08-10 | Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the… | |
CVE-2026-72912 | Medium | 4.3 | 2026-08-10 | CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can ex… |
CVE-2026-72911 | Critical | 9.9 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/… |
CVE-2026-72910 | High | 7.1 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc… |
CVE-2026-72909 | | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpn… | |
CVE-2026-72908 | Medium | 6.5 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/t… |
CVE-2026-72907 | Medium | 6.5 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts th… |
CVE-2026-72906 | Medium | 4.3 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/pr… |
CVE-2026-72904 | | 2026-08-10 | Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl'… | |
CVE-2026-72903 | High | 8.1 | 2026-08-10 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename throu… |
CVE-2026-72743 | Medium | 5.4 | 2026-08-10 | SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE out… |
CVE-2026-63622 | High | 7.8 | 2026-08-10 | A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in… |
CVE-2026-48160 | | 2026-08-10 | react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6… | |
CVE-2026-19411 | Low | 3.9 | 2026-08-10 | A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of se… |
CVE-2026-18982 | High | 8.8 | 2026-08-10 | A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate the… |