2026 CVEs (page 328)
Page 328 of 462 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6598 | Medium | 4.3 | 2026-04-20 | A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function create_project/encrypt_auth_settings of th… |
CVE-2026-32965 | High | 7.5 | 2026-04-20 | Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manager provided by silex technology, Inc. When the affected dev… |
CVE-2026-32964 | Medium | 6.5 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain an improper neutralization of CRLF sequences ('CRLF Injection') vulnerability. Processing s… |
CVE-2026-32963 | Medium | 6.1 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain a reflected cross-site scripting vulnerability. When a user logs in to the affected device… |
CVE-2026-32962 | Medium | 5.3 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for critical function issue. The device configuration may be alter… |
CVE-2026-32961 | Medium | 5.3 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in packet data processing of sx_smpd. Processing… |
CVE-2026-32960 | Medium | 6.5 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive information in resource not removed before reuse. An attacker ma… |
CVE-2026-32959 | Medium | 5.9 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a use of a broken or risky cryptographic algorithm. Information in the traffi… |
CVE-2026-32958 | Medium | 6.5 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. use a hard-coded cryptographic key. An administrative user may be directed to apply a fake firmware… |
CVE-2026-32957 | Medium | 5.3 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for critical function issue on firmware maintenance. Arbitrary fil… |
CVE-2026-32956 | Critical | 9.8 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in processing the redirect URLs. Arbitrary code… |
CVE-2026-32955 | High | 8.8 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain a stack-based buffer overflow vulnerability in processing the redirect URLs. Arbitrary code… |
CVE-2026-6597 | Low | 2.7 | 2026-04-20 | A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove_api_keys/has_api_terms of the file src/backend/base/langflo… |
CVE-2026-6596 | High | 7.3 | 2026-04-20 | A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function create_upload_file of the file src/backend/base/Langfl… |
CVE-2026-6595 | High | 7.3 | 2026-04-20 | A vulnerability was identified in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This vulnerability affects unkno… |
CVE-2026-6594 | High | 7.3 | 2026-04-20 | A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing a manipulation of the argument __proto__/constructor.proto… |
CVE-2026-6593 | Low | 3.5 | 2026-04-20 | A vulnerability was found in ComfyUI up to 0.13.0. Affected by this issue is some unknown functionality of the file server.py of the component View Endpoint. P… |
CVE-2026-6592 | Low | 3.5 | 2026-04-20 | A vulnerability has been found in ComfyUI up to 0.13.0. Affected by this vulnerability is the function getuserdata of the file app/user_manager.py of the compo… |
CVE-2026-6591 | Medium | 4.3 | 2026-04-20 | A flaw has been found in ComfyUI up to 0.13.0. Affected is the function folder_paths.get_annotated_filepath of the file folder_paths.py of the component LoadIm… |
CVE-2026-6590 | Medium | 4.3 | 2026-04-20 | A vulnerability was detected in ComfyUI up to 0.13.0. This impacts the function get_model_preview of the file app/model_manager.py of the component Model Previ… |
CVE-2026-6589 | Medium | 4.3 | 2026-04-20 | A security vulnerability has been detected in ComfyUI up to 0.13.0. This affects the function create_origin_only_middleware of the file server.py. The manipula… |
CVE-2026-6588 | Medium | 6.5 | 2026-04-20 | A weakness has been identified in serge-chat serge up to 1.4TB. The impacted element is the function download_model/delete_model of the file api/src/serge/rout… |
CVE-2026-6587 | Medium | 6.3 | 2026-04-20 | A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the fi… |
CVE-2026-6586 | Medium | 6.3 | 2026-04-20 | A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Impacted is the function get_budget/update_budget of the file superagi/controllers/… |
CVE-2026-6585 | Medium | 5.4 | 2026-04-20 | A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This issue affects the function update_organisation of the file superagi/controller… |
CVE-2026-6584 | Medium | 5.4 | 2026-04-20 | A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function update_user of the file superagi/controllers/use… |
CVE-2026-6583 | Medium | 5.4 | 2026-04-19 | A vulnerability has been found in TransformerOptimus SuperAGI up to 0.0.14. This affects the function delete_api_key/edit_api_key of the file superagi/controll… |
CVE-2026-6582 | High | 7.3 | 2026-04-19 | A flaw has been found in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function get_vector_db_details of the file superagi/controller… |
CVE-2026-6581 | High | 8.8 | 2026-04-19 | A vulnerability was detected in H3C Magic B1 up to 100R004. Affected by this vulnerability is the function SetMobileAPInfoById of the file /goform/aspForm. Per… |
CVE-2026-6580 | High | 7.3 | 2026-04-19 | A security vulnerability has been detected in liangliangyy DjangoBlog up to 2.1.0.0. Affected is an unknown function of the file owntracks/views.py of the comp… |
CVE-2026-6579 | Medium | 6.5 | 2026-04-19 | A weakness has been identified in liangliangyy DjangoBlog up to 2.1.0.0. This impacts an unknown function of the file blog/views.py of the component Clean Endp… |
CVE-2026-6578 | Medium | 5.6 | 2026-04-19 | A security flaw has been discovered in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the compon… |
CVE-2026-6577 | High | 7.3 | 2026-04-19 | A vulnerability was identified in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file owntracks/views.py of the comp… |
CVE-2026-6576 | Medium | 6.3 | 2026-04-19 | A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function CommandHandler of the file servermanager/api/comm… |
CVE-2026-6574 | High | 7.3 | 2026-04-19 | A vulnerability has been found in osuuu LightPicture up to 1.2.2. This issue affects some unknown processing of the file /public/install/lp.sql of the componen… |
CVE-2026-6573 | Medium | 6.3 | 2026-04-19 | A vulnerability was detected in PHPEMS 11.0. This affects the function temppage of the file /app/exam/controller/exams.master.php of the component Instant Exam… |
CVE-2026-6572 | Medium | 5.6 | 2026-04-19 | A security vulnerability has been detected in Collabora KodExplorer up to 4.52. Affected by this issue is some unknown functionality of the file /app/controlle… |
CVE-2026-6571 | Medium | 6.3 | 2026-04-19 | A weakness has been identified in kodcloud KodExplorer up to 4.52. Affected by this vulnerability is the function roleGroupAction of the file /app/controller/s… |
CVE-2026-6570 | Low | 2.7 | 2026-04-19 | A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file /app/controller/systemMember.class.php… |
CVE-2026-6569 | High | 7.3 | 2026-04-19 | A vulnerability was identified in kodcloud KodExplorer up to 4.52. This impacts the function fileGet of the file /app/controller/share.class.php of the compone… |
CVE-2026-6568 | High | 7.3 | 2026-04-19 | A vulnerability was determined in kodcloud KodExplorer up to 4.52. This affects the function share.class.php::initShareOld of the file /app/controller/share.cl… |
CVE-2026-6564 | Medium | 4.3 | 2026-04-19 | A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0. The impacted element is an unknown function of the component Session Handling. The manipulation r… |
CVE-2026-6563 | High | 8.8 | 2026-04-19 | A vulnerability has been found in H3C Magic B1 up to 100R004. The affected element is the function SetAPWifiorLedInfoById of the file /goform/aspForm. The mani… |
CVE-2026-6562 | High | 7.3 | 2026-04-19 | A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is the function getListByPage of the file /index/Search/index.html. Executing a manipulation… |
CVE-2026-6561 | Medium | 4.7 | 2026-04-19 | A vulnerability was detected in EyouCMS up to 1.7.1. This issue affects the function edit_adminlogo of the file application/admin/controller/Index.php. Perform… |
CVE-2026-6560 | High | 8.8 | 2026-04-19 | A security vulnerability has been detected in H3C Magic B0 up to 100R002. This vulnerability affects the function Edit_BasicSSID of the file /goform/aspForm. S… |
CVE-2026-6559 | Medium | 4.3 | 2026-04-19 | A weakness has been identified in Wavlink WL-WN579A3 220323. This affects the function sub_401F80 of the file /cgi-bin/login.cgi. This manipulation of the argu… |
CVE-2026-0868 | Medium | 6.4 | 2026-04-19 | The EMC – Easily Embed Calendly Scheduling Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's calendly shortcode in al… |
CVE-2026-41242 | Critical | 9.8 | 2026-04-18 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type… |
CVE-2026-40948 | Medium | 5.4 | 2026-04-18 | The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-ca… |
CVE-2026-2986 | Medium | 6.4 | 2026-04-18 | The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' parameter in versions up to, and incl… |
CVE-2026-2505 | Medium | 5.4 | 2026-04-18 | The Categories Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.1, via the 'z_taxonomy_image' sho… |
CVE-2026-0894 | Medium | 6.4 | 2026-04-18 | The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_block shortcode in all versi… |
CVE-2026-41254 | Medium | 4.0 | 2026-04-18 | Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication. |
CVE-2026-32690 | Low | 3.7 | 2026-04-18 | Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fie… |
CVE-2026-32228 | High | 7.5 | 2026-04-18 | UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the… |
CVE-2026-30912 | High | 7.5 | 2026-04-18 | In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing addit… |
CVE-2026-30898 | High | 8.8 | 2026-04-18 | An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to es… |
CVE-2026-25917 | High | 7.2 | 2026-04-18 | Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code… |
CVE-2026-41253 | Medium | 6.9 | 2026-04-18 | In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file who… |
CVE-2026-6518 | High | 8.8 | 2026-04-18 | The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions… |
CVE-2026-6048 | Medium | 6.4 | 2026-04-18 | The Flipbox Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flipbox widget's button URL `custom_attributes` field… |
CVE-2026-4801 | Medium | 6.4 | 2026-04-18 | The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via external iCal feed data in all versions up t… |
CVE-2026-40494 | Critical | 9.8 | 2026-04-18 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 45d48d1f2e8e0d73e80bc1fd… |
CVE-2026-40493 | Critical | 9.8 | 2026-04-18 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit c930284445ea3ff94451ccd7… |
CVE-2026-40492 | Critical | 9.8 | 2026-04-18 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 36aa5c7ec8a2bb35f6fb867a… |
CVE-2026-40491 | Medium | 6.5 | 2026-04-18 | gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. W… |
CVE-2026-40490 | Medium | 6.8 | 2026-04-18 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When redirect following i… |
CVE-2026-40489 | | 2026-04-18 | editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-base… | |
CVE-2026-40487 | High | 8.9 | 2026-04-18 | Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML… |
CVE-2026-35582 | High | 8.8 | 2026-04-18 | Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getCommand() is vulnerable to OS command injection because it int… |
CVE-2026-1838 | Medium | 6.1 | 2026-04-18 | The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode_id' parameter in all versions up to, and including, 1.1.6 du… |
CVE-2026-1559 | Medium | 6.4 | 2026-04-18 | The Youzify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkin_place_id' parameter in all versions up to, and including, 1.3.6… |
CVE-2026-40572 | Critical | 9.0 | 2026-04-18 | NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 15 (MemoryMapRange) allows Ring 3 user-mode pro… |
CVE-2026-40350 | High | 8.8 | 2026-04-18 | Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-manageme… |
CVE-2026-40317 | Critical | 9.3 | 2026-04-18 | NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 12 (JumpToUser) accepts an arbitrary entry poin… |
CVE-2026-35465 | High | 7.5 | 2026-04-18 | SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17… |
CVE-2026-40593 | Medium | 4.8 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor (UserEditor.php) renders stored usernames directly into an HT… |
CVE-2026-40582 | | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint validates only the username and password… | |
CVE-2026-40581 | High | 8.1 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, ir… |
CVE-2026-40485 | Medium | 5.3 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishabl… |
CVE-2026-40484 | Critical | 9.1 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents… |
CVE-2026-40483 | Medium | 5.4 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the Pledge Editor renders donation comment values directly into HTML input va… |
CVE-2026-40482 | | 2026-04-18 | ChurchCRM is an open-source church management system. Versions prior to 7.2.0 have SQL injection in FinancialService::getMemberByScanString() via unsanitized $… | |
CVE-2026-40480 | | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/person/{personId} endpoint loads and returns person records with… | |
CVE-2026-40349 | High | 8.8 | 2026-04-18 | Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own accou… |
CVE-2026-40348 | High | 7.7 | 2026-04-18 | Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requ… |
CVE-2026-40347 | Medium | 5.3 | 2026-04-18 | Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/fo… |
CVE-2026-40346 | Medium | 6.5 | 2026-04-18 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase's workflow H… |
CVE-2026-40341 | Low | 3.5 | 2026-04-18 | libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out of bound read in ptp_unpack_EOS_FocusInfoEx could be used to… |
CVE-2026-40340 | Medium | 6.1 | 2026-04-18 | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read vulnerability in `ptp_unpack_OI()` in `camlib… |
CVE-2026-40339 | Medium | 5.2 | 2026-04-18 | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/p… |
CVE-2026-40338 | Medium | 5.2 | 2026-04-18 | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of `ptp_unpa… |
CVE-2026-40337 | Medium | 5.1 | 2026-04-18 | The Sentry kernel is a high security level micro-kernel implementation made for high security embedded systems. A given task with one of the DEV or IO capabili… |
CVE-2026-40336 | Low | 2.4 | 2026-04-18 | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack… |
CVE-2026-40335 | Medium | 5.2 | 2026-04-18 | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_DPV()` in `camlibs/ptp2/ptp-pa… |
CVE-2026-40334 | Low | 3.5 | 2026-04-18 | libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in ptp_unpack_Canon_FE() in camlibs… |
CVE-2026-40333 | Medium | 6.1 | 2026-04-18 | libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but n… |
CVE-2026-40324 | Critical | 9.1 | 2026-04-18 | Hot Chocolate is an open-source GraphQL server. Prior to versions 12.22.7, 13.9.16, 14.3.1, and 15.1.14, Hot Chocolate's recursive descent parser `Utf8GraphQLP… |
CVE-2026-40323 | High | 7.5 | 2026-04-18 | SP1 is a zero‑knowledge virtual machine that proves the correct execution of programs compiled for the RISC-V architecture. In versions 6.0.0 through 6.0.2, a… |