2026 CVEs (page 331)
Page 331 of 689 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56416 | Medium | 4.8 | 2026-07-22 | In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it com… |
CVE-2026-55991 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and… |
CVE-2026-55990 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscryp… |
CVE-2026-55973 | High | 7.5 | 2026-07-22 | In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstrea… |
CVE-2026-55717 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <ne… |
CVE-2026-55708 | Low | 3.1 | 2026-07-22 | In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tr… |
CVE-2026-54478 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 serv… |
CVE-2026-53910 | | 2026-07-22 | diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect ar… | |
CVE-2026-52863 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view na… |
CVE-2026-50252 | Critical | 9.3 | 2026-07-22 | In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DN… |
CVE-2026-50251 | Medium | 5.3 | 2026-07-22 | In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0… |
CVE-2026-50248 | Medium | 6.5 | 2026-07-22 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still cons… |
CVE-2026-50243 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response… |
CVE-2026-50046 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_que… |
CVE-2026-50045 | Medium | 5.3 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send… |
CVE-2026-46582 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based… |
CVE-2026-44690 | High | 7.5 | 2026-07-22 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198… |
CVE-2026-44687 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could b… |
CVE-2026-44621 | Medium | 5.9 | 2026-07-22 | With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be a… |
CVE-2026-42955 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found… |
CVE-2026-41637 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-c… |
CVE-2026-40691 | High | 7.5 | 2026-07-22 | In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply… |
CVE-2026-32665 | High | 7.5 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC conn… |
CVE-2026-16560 | Medium | 5.3 | 2026-07-22 | A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation a… |
CVE-2026-16232 | Critical | 9.8 | 2026-07-22 | An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login t… |
CVE-2026-14932 | Medium | 6.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and… |
CVE-2026-14865 | Medium | 5.3 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowin… |
CVE-2026-14586 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 abo… |
CVE-2026-13192 | Medium | 6.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authentic… |
CVE-2026-13190 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from atta… |
CVE-2026-13189 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to i… |
CVE-2026-13188 | Medium | 5.9 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior… |
CVE-2026-13187 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enab… |
CVE-2026-13186 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the… |
CVE-2026-13185 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-… |
CVE-2026-13184 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload… |
CVE-2026-13183 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing dif… |
CVE-2026-13182 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failure… |
CVE-2026-13181 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-control… |
CVE-2026-8152 | | 2026-07-22 | Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with… | |
CVE-2026-44191 | High | 7.8 | 2026-07-22 | A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ans… |
CVE-2026-16270 | | 2026-07-22 | Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the p… | |
CVE-2026-65603 | High | 8.8 | 2026-07-22 | The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserP… |
CVE-2026-65602 | High | 8.8 | 2026-07-22 | Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport referen… |
CVE-2026-65601 | High | 8.8 | 2026-07-22 | Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[]… |
CVE-2026-65600 | Medium | 5.3 | 2026-07-22 | Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middlew… |
CVE-2026-65599 | Medium | 6.5 | 2026-07-22 | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM p… |
CVE-2026-65598 | High | 7.5 | 2026-07-22 | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restr… |
CVE-2026-65597 | Medium | 5.4 | 2026-07-22 | n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution… |
CVE-2026-65596 | High | 8.1 | 2026-07-22 | n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Que… |
CVE-2026-65595 | High | 8.8 | 2026-07-22 | n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instan… |
CVE-2026-65594 | Medium | 6.5 | 2026-07-22 | n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the a… |
CVE-2026-65593 | Medium | 5.4 | 2026-07-22 | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authori… |
CVE-2026-65592 | Medium | 5.4 | 2026-07-22 | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-p… |
CVE-2026-65591 | High | 8.8 | 2026-07-22 | n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modif… |
CVE-2026-65590 | Critical | 9.8 | 2026-07-22 | n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was ap… |
CVE-2026-65589 | Medium | 6.5 | 2026-07-22 | n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to wor… |
CVE-2026-65016 | High | 8.8 | 2026-07-22 | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning pa… |
CVE-2026-65015 | High | 8.8 | 2026-07-22 | n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization check… |
CVE-2026-65014 | Medium | 5.3 | 2026-07-22 | n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is… |
CVE-2026-61392 | Medium | 5.3 | 2026-07-22 | There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain partial information from the device’s m… |
CVE-2026-61391 | High | 7.2 | 2026-07-22 | There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending… |
CVE-2026-61390 | High | 7.7 | 2026-07-22 | There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending speci… |
CVE-2026-57600 | High | 7.5 | 2026-07-22 | Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data. |
CVE-2026-57599 | Medium | 6.6 | 2026-07-22 | There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate p… |
CVE-2026-4773 | High | 8.1 | 2026-07-22 | Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA… |
CVE-2026-44192 | Medium | 6.6 | 2026-07-22 | A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulnerability, known as path traversal, allows an attacker to manipulate a… |
CVE-2026-44190 | High | 7.8 | 2026-07-22 | A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote attacker to execute unau… |
CVE-2026-44189 | High | 7.8 | 2026-07-22 | A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker t… |
CVE-2026-44187 | Low | 3.3 | 2026-07-22 | A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or mal… |
CVE-2026-16551 | | 2026-07-22 | Denial-of-Service in Thinkst Applied Research OpenCanary (MongoDB module) allows Excessive Allocation. This issue affects OpenCanary 0.9.8 only. | |
CVE-2026-16544 | Medium | 6.5 | 2026-07-22 | A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() functio… |
CVE-2026-16473 | Medium | 4.3 | 2026-07-22 | A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap o… |
CVE-2026-14551 | High | 8.8 | 2026-07-22 | The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation… |
CVE-2026-63264 | | 2026-07-22 | Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerabilit… | |
CVE-2026-2406 | Medium | 6.5 | 2026-07-22 | Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow… |
CVE-2026-15787 | Medium | 6.4 | 2026-07-22 | The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon… |
CVE-2026-63048 | | 2026-07-22 | Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2 - The Joomla extension Page Builder CK is vu… | |
CVE-2026-63047 | High | 7.5 | 2026-07-22 | Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking pri… |
CVE-2026-45820 | High | 7.5 | 2026-07-22 | fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring com… |
CVE-2026-3821 | High | 8.8 | 2026-07-22 | Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit SMASH’s input capability… |
CVE-2026-14322 | Medium | 5.3 | 2026-07-22 | The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recog… |
CVE-2026-12987 | High | 7.5 | 2026-07-22 | The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-suppli… |
CVE-2026-12968 | High | 8.8 | 2026-07-22 | The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts… |
CVE-2026-15802 | High | 8.1 | 2026-07-22 | The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_c… |
CVE-2026-56844 | | 2026-07-22 | A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level ac… | |
CVE-2026-16492 | Medium | 5.5 | 2026-07-22 | A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitI… |
CVE-2026-16490 | Medium | 6.3 | 2026-07-22 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipula… |
CVE-2026-63263 | Medium | 6.5 | 2026-07-22 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user ma… |
CVE-2026-63262 | Medium | 4.3 | 2026-07-22 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level acce… |
CVE-2026-16489 | Medium | 5.3 | 2026-07-22 | A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function _execCommand in the library lib/registry/sfdx.js of the component SFDX… |
CVE-2026-16488 | Medium | 5.0 | 2026-07-22 | A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of t… |
CVE-2026-63261 | Medium | 6.5 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user c… |
CVE-2026-63260 | Medium | 6.5 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-pr… |
CVE-2026-63259 | Medium | 4.3 | 2026-07-21 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled… |
CVE-2026-63145 | Medium | 4.3 | 2026-07-21 | Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not… |
CVE-2026-63144 | Medium | 6.5 | 2026-07-21 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authentica… |
CVE-2026-63143 | Medium | 4.3 | 2026-07-21 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileg… |
CVE-2026-63142 | Medium | 5.0 | 2026-07-21 | Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request re… |
CVE-2026-56820 | High | 7.4 | 2026-07-21 | Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Fin… |