2026 CVEs (page 342)
Page 342 of 451 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34783 | High | 8.1 | 2026-04-06 | Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library fun… |
CVE-2026-31313 | Medium | 5.4 | 2026-04-06 | An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web s… |
CVE-2026-5704 | Medium | 5.0 | 2026-04-06 | A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attack… |
CVE-2026-5666 | Medium | 5.3 | 2026-04-06 | A vulnerability was detected in code-projects Online FIR System 1.0. Affected by this issue is some unknown functionality of the file /complaints.sql of the co… |
CVE-2026-5665 | High | 7.3 | 2026-04-06 | A security vulnerability has been detected in code-projects Online FIR System 1.0. Affected by this vulnerability is an unknown functionality of the file /Logi… |
CVE-2026-34982 | High | 8.2 | 2026-04-06 | Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user… |
CVE-2026-34969 | High | 7.5 | 2026-04-06 | Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly i… |
CVE-2026-34951 | Medium | 6.1 | 2026-04-06 | Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbenc… |
CVE-2026-34950 | Critical | 9.1 | 2026-04-06 | fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that… |
CVE-2026-34940 | High | 8.7 | 2026-04-06 | KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript() function in internal/modelcontroller/engine_ollama.go constr… |
CVE-2026-34764 | Low | 2.3 | 2026-04-06 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 33.0.0-alpha.1 to before 39.8.5, 40.8.5, 41.1.0, a… |
CVE-2026-34756 | Medium | 6.5 | 2026-04-06 | vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM Ope… |
CVE-2026-34755 | Medium | 6.5 | 2026-04-06 | vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19.0, the VideoMediaIO.load_base64() method at vllm/multimodal… |
CVE-2026-34753 | Medium | 5.4 | 2026-04-06 | vLLM is an inference and serving engine for large language models (LLMs). From 0.16.0 to before 0.19.0, a server-side request forgery (SSRF) vulnerability in d… |
CVE-2026-34589 | Medium | 5.0 | 2026-04-06 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to… |
CVE-2026-34588 | High | 7.8 | 2026-04-06 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to… |
CVE-2026-34444 | Critical | 10.0 | 2026-04-06 | Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed thro… |
CVE-2026-34380 | Medium | 5.9 | 2026-04-06 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to… |
CVE-2026-34379 | High | 7.1 | 2026-04-06 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to… |
CVE-2026-34378 | Medium | 6.5 | 2026-04-06 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to… |
CVE-2026-34217 | High | 7.2 | 2026-04-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, a scope modification vulnerability exists in @nyariv/sandboxjs. The vulnerability allows untrust… |
CVE-2026-34211 | High | 7.5 | 2026-04-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, the @nyariv/sandboxjs parser contains unbounded recursion in the restOfExp function and the lisp… |
CVE-2026-34208 | Critical | 10.0 | 2026-04-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this p… |
CVE-2026-34148 | High | 7.5 | 2026-04-06 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP… |
CVE-2026-33752 | High | 8.6 | 2026-04-06 | curl_cffi is the a Python binding for curl. Prior to 0.15.0, curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically vi… |
CVE-2026-33727 | Medium | 6.4 | 2026-04-06 | Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Version 6.4 has a local privilege-escalation vulnerability allows cod… |
CVE-2026-33405 | Low | 3.1 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the form… |
CVE-2026-31354 | Medium | 5.4 | 2026-04-06 | Multiple authenticated stored cross-site scripting (XSS) vulnerabilities in the Permissions module of Feehi CMS v2.1.1 allows attackers to execute arbitrary we… |
CVE-2026-31353 | Medium | 5.4 | 2026-04-06 | An authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts o… |
CVE-2026-31352 | Medium | 5.4 | 2026-04-06 | An authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web sc… |
CVE-2026-31351 | Medium | 4.8 | 2026-04-06 | An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web s… |
CVE-2026-31350 | Medium | 5.4 | 2026-04-06 | An authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a… |
CVE-2026-21382 | High | 7.8 | 2026-04-06 | Memory Corruption when handling power management requests with improperly sized input/output buffers. |
CVE-2026-21381 | High | 7.6 | 2026-04-06 | Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection. |
CVE-2026-21380 | High | 7.8 | 2026-04-06 | Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory. |
CVE-2026-21378 | High | 7.8 | 2026-04-06 | Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver. |
CVE-2026-21376 | High | 7.8 | 2026-04-06 | Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver. |
CVE-2026-21375 | High | 7.8 | 2026-04-06 | Memory Corruption when accessing an output buffer without validating its size during IOCTL processing. |
CVE-2026-21374 | High | 7.8 | 2026-04-06 | Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation. |
CVE-2026-21373 | High | 7.8 | 2026-04-06 | Memory Corruption when accessing an output buffer without validating its size during IOCTL processing. |
CVE-2026-21372 | High | 7.8 | 2026-04-06 | Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations. |
CVE-2026-21371 | High | 7.8 | 2026-04-06 | Memory Corruption when retrieving output buffer with insufficient size validation. |
CVE-2026-21367 | High | 7.6 | 2026-04-06 | Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans. |
CVE-2026-5663 | High | 7.3 | 2026-04-06 | A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/stores… |
CVE-2026-5661 | Medium | 5.3 | 2026-04-06 | A vulnerability was identified in Free5GC 4.2.0. This affects an unknown function of the component NGSetupRequest Handler. Such manipulation leads to denial of… |
CVE-2026-34897 | Medium | 6.5 | 2026-04-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS.T… |
CVE-2026-34885 | High | 8.5 | 2026-04-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant allows SQL Injectio… |
CVE-2026-33540 | High | 7.5 | 2026-04-06 | Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mode, distribution discovers token auth en… |
CVE-2026-33510 | High | 8.8 | 2026-04-06 | Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has been discovered in Homarr's /auth/login page. The… |
CVE-2026-33406 | Medium | 5.4 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configur… |
CVE-2026-33404 | Low | 3.4 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client h… |
CVE-2026-33403 | Medium | 6.1 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflec… |
CVE-2026-32602 | Medium | 4.2 | 2026-04-06 | Homarr is an open-source dashboard. Prior to 1.57.0, the user registration endpoint (/api/trpc/user.register) is vulnerable to a race condition that allows an… |
CVE-2026-31153 | Medium | 5.4 | 2026-04-06 | A stored cross-site scripting (XSS) vulnerability in Bynder v0.1.394 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2026-31151 | Critical | 9.8 | 2026-04-06 | An issue in the login mechanism of Kaleris YMS v7.2.2.1 allows attackers to bypass login verification to access the application 's resources. |
CVE-2026-31150 | Medium | 4.3 | 2026-04-06 | Incorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the shipping/receiving role to view the truck's dashboard resources. |
CVE-2026-31067 | Medium | 6.8 | 2026-04-06 | A remote command execution (RCE) vulnerability in the /goform/formReleaseConnect component of UTT Aggressive 520W v3v1.7.7-180627 allows attackers to execute a… |
CVE-2026-31066 | Medium | 4.5 | 2026-04-06 | UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the selDateType parameter of the formTaskEdit function. This vulnerabi… |
CVE-2026-31065 | Medium | 4.5 | 2026-04-06 | UTT Aggressive 520W v3v1.7.7-180627 was discovered to contain a buffer overflow in the addCommand parameter of the formConfigCliForEngineerOnly function. This… |
CVE-2026-31063 | Medium | 4.5 | 2026-04-06 | UTT Aggressive HiPER 1200GW v2.5.3-170306 was discovered to contain a buffer overflow in the pools parameter of the formArpBindConfig function. This vulnerabil… |
CVE-2026-31062 | Medium | 4.5 | 2026-04-06 | UTT Aggressive 520W v3v1.7.7-180627 was discovered to contain a buffer overflow in the filename parameter of the formFtpServerDirConfig function. This vulnerab… |
CVE-2026-31061 | Medium | 4.5 | 2026-04-06 | UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the timestart parameter of the ConfigAdvideo function. This vulnerabil… |
CVE-2026-31060 | Medium | 4.5 | 2026-04-06 | UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the notes parameter of the formGroupConfig function. This vulnerabilit… |
CVE-2026-31059 | Critical | 9.8 | 2026-04-06 | A remote command execution (RCE) vulnerability in the /goform/formDia component of UTT Aggressive HiPER 520W v3v1.7.7-180627 allows attackers to execute arbitr… |
CVE-2026-31058 | Medium | 4.5 | 2026-04-06 | UTT Aggressive HiPER 1200GW v2.5.3-170306 was discovered to contain a buffer overflow in the timeRangeName parameter of the formConfigDnsFilterGlobal function… |
CVE-2026-31053 | Medium | 6.2 | 2026-04-06 | A double free vulnerability exists in librz/bin/format/le/le.c in the function le_load_fixup_record(). When processing malformed or circular LE fixup chains, r… |
CVE-2026-29047 | High | 7.2 | 2026-04-06 | GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the lo… |
CVE-2026-26263 | High | 8.1 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Searc… |
CVE-2026-26027 | High | 7.5 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory e… |
CVE-2026-26026 | Critical | 9.1 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability i… |
CVE-2026-25932 | High | 7.2 | 2026-04-06 | GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier f… |
CVE-2026-5660 | Medium | 6.3 | 2026-04-06 | A vulnerability was determined in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /borrowed_equip.php… |
CVE-2026-5659 | Medium | 6.3 | 2026-04-06 | A vulnerability was found in pytries datrie up to 0.8.3. The affected element is the function Trie.load/Trie.read/Trie.__setstate__ of the file src/datrie.pyx… |
CVE-2026-30078 | High | 7.5 | 2026-04-06 | OpenAirInterface V2.2.0 AMF crashes when it receives an NGAP message with invalid procedure code or invalid PDU-type. For example when the message specificatio… |
CVE-2026-3524 | High | 8.8 | 2026-04-06 | Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated att… |
CVE-2026-5650 | Medium | 5.3 | 2026-04-06 | A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollment/database/oas.sq… |
CVE-2026-5649 | Medium | 6.3 | 2026-04-06 | A vulnerability has been found in code-projects Online Application System for Admission 1.0. This issue affects some unknown processing of the file /enrollment… |
CVE-2026-5648 | High | 7.3 | 2026-04-06 | A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /userfinishregister.php of the component… |
CVE-2026-5647 | Low | 2.4 | 2026-04-06 | A vulnerability was detected in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /admin/admin_feature.php of the component Add Pro… |
CVE-2026-5646 | High | 7.3 | 2026-04-06 | A security vulnerability has been detected in code-projects Easy Blog Site 1.0. Affected by this issue is some unknown functionality of the file login.php. The… |
CVE-2026-5645 | High | 7.3 | 2026-04-06 | A weakness has been identified in projectworlds Car Rental System 1.0. Affected by this vulnerability is an unknown functionality of the file /pay.php of the c… |
CVE-2026-5673 | Medium | 5.6 | 2026-04-06 | A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_… |
CVE-2026-5644 | Low | 2.4 | 2026-04-06 | A security flaw has been discovered in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. Affected is an unknown function of t… |
CVE-2026-5643 | Low | 2.4 | 2026-04-06 | A vulnerability was identified in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This impacts an unknown function of the f… |
CVE-2026-5642 | High | 7.3 | 2026-04-06 | A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown function of the f… |
CVE-2026-5641 | Medium | 6.3 | 2026-04-06 | A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /admin/update-image1.php of… |
CVE-2026-5640 | Medium | 6.3 | 2026-04-06 | A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /admin/update-image2.p… |
CVE-2026-5639 | Medium | 6.3 | 2026-04-06 | A flaw has been found in PHPGurukul Online Shopping Portal Project 2.1. Impacted is an unknown function of the file /admin/update-image3.php of the component P… |
CVE-2026-5638 | Medium | 5.3 | 2026-04-06 | A vulnerability was detected in HerikLyma CPPWebFramework up to 3.1. This issue affects some unknown processing. Performing a manipulation results in path trav… |
CVE-2026-5637 | High | 7.3 | 2026-04-06 | A security vulnerability has been detected in projectworlds Car Rental System 1.0. This vulnerability affects unknown code of the file /message_admin.php of th… |
CVE-2026-37977 | Low | 3.7 | 2026-04-06 | A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Ac… |
CVE-2026-5636 | Medium | 6.3 | 2026-04-06 | A weakness has been identified in PHPGurukul Online Shopping Portal Project 2.1. This affects an unknown part of the file /cancelorder.php of the component Par… |
CVE-2026-5635 | Medium | 6.3 | 2026-04-06 | A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. Affected by this issue is some unknown functionality of the file /categor… |
CVE-2026-5634 | High | 7.3 | 2026-04-06 | A vulnerability was identified in projectworlds Car Rental Project 1.0. Affected by this vulnerability is an unknown functionality of the file /book_car.php of… |
CVE-2026-5633 | High | 7.3 | 2026-04-06 | A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulatio… |
CVE-2026-31410 | Medium | 5.5 | 2026-04-06 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION Use sb->s_uuid for a proper volume ide… |
CVE-2026-31409 | High | 8.8 | 2026-04-06 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset conn->binding on failed binding request When a multichannel SMB2_SESSION_SET… |
CVE-2026-31408 | High | 8.8 | 2026-04-06 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_… |
CVE-2026-31407 | High | 7.1 | 2026-04-06 | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: add missing netlink policy validations Hyunwoo Kim reports out-of-b… |
CVE-2026-31406 | High | 7.8 | 2026-04-06 | In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() After cancel_del… |