2026 CVEs (page 346)
Page 346 of 450 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34608 | Medium | 4.9 | 2026-04-02 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhook_inproc.c, the hook_work_cb() function proce… |
CVE-2026-34606 | Medium | 6.1 | 2026-04-02 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS… |
CVE-2026-34601 | High | 7.5 | 2026-04-02 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xm… |
CVE-2026-34598 | Medium | 6.1 | 2026-04-02 | YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can… |
CVE-2026-34593 | High | 7.5 | 2026-04-02 | Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type.Module.cast_input/2 unconditionally cr… |
CVE-2026-34591 | Medium | 6.5 | 2026-04-02 | Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without… |
CVE-2026-34590 | Medium | 5.4 | 2026-04-02 | Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the… |
CVE-2026-34584 | Medium | 5.4 | 2026-04-02 | listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows u… |
CVE-2026-34577 | High | 8.6 | 2026-04-02 | Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query pa… |
CVE-2026-34576 | High | 7.7 | 2026-04-02 | Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the POST /public/v1/upload-from-url endpoint accepts a user-supplied URL and fetches it… |
CVE-2026-34526 | Medium | 5.0 | 2026-04-02 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2026-34524 | High | 8.3 | 2026-04-02 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2026-34523 | Medium | 5.3 | 2026-04-02 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2026-34522 | High | 8.1 | 2026-04-02 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2026-34124 | Medium | 6.5 | 2026-04-02 | A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic. The implementation enforces length res… |
CVE-2026-34122 | Medium | 6.5 | 2026-04-02 | A stack-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within a configuration handling component due to insufficient input vali… |
CVE-2026-34121 | High | 8.8 | 2026-04-02 | An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent… |
CVE-2026-34120 | Medium | 6.5 | 2026-04-02 | A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the asynchronous parsing of local video stream content due to insu… |
CVE-2026-34119 | Medium | 6.5 | 2026-04-02 | A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing loop when appending segmented request bodies with… |
CVE-2026-34118 | Medium | 6.5 | 2026-04-02 | A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 in the HTTP POST body parsing logic due to missing validation of remainin… |
CVE-2026-33271 | Medium | 6.7 | 2026-04-02 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 42902. |
CVE-2026-32762 | Medium | 4.8 | 2026-04-02 | Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack::Utils.forwarded_values parses the RFC… |
CVE-2026-28728 | Medium | 6.7 | 2026-04-02 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42902. |
CVE-2026-27774 | Medium | 6.7 | 2026-04-02 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42902. |
CVE-2026-26962 | Medium | 4.8 | 2026-04-02 | Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds folded multipart part headers incorrec… |
CVE-2026-5360 | Low | 3.7 | 2026-04-02 | A vulnerability has been found in Free5GC 4.2.0. The affected element is an unknown function of the component aper. Such manipulation leads to type confusion… |
CVE-2026-5355 | Medium | 6.3 | 2026-04-02 | A vulnerability has been found in Trendnet TEW-657BRM 1.00.1. Affected by this issue is the function vpn_drop of the file /setup.cgi. The manipulation of the a… |
CVE-2026-5354 | Medium | 6.3 | 2026-04-02 | A flaw has been found in Trendnet TEW-657BRM 1.00.1. Affected by this vulnerability is the function vpn_connect of the file /setup.cgi. Executing a manipulatio… |
CVE-2026-5353 | Medium | 6.3 | 2026-04-02 | A vulnerability was detected in Trendnet TEW-657BRM 1.00.1. Affected is the function ping_test of the file /setup.cgi. Performing a manipulation of the argumen… |
CVE-2026-5352 | Medium | 6.3 | 2026-04-02 | A security vulnerability has been detected in Trendnet TEW-657BRM 1.00.1. This impacts the function Edit of the file /setup.cgi. Such manipulation of the argum… |
CVE-2026-35388 | Low | 2.5 | 2026-04-02 | OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions. |
CVE-2026-35387 | Low | 3.1 | 2026-04-02 | OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterp… |
CVE-2026-35386 | Low | 3.6 | 2026-04-02 | In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username o… |
CVE-2026-35385 | High | 7.5 | 2026-04-02 | In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is perform… |
CVE-2026-35038 | Medium | 6.5 | 2026-04-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via `… |
CVE-2026-34877 | Critical | 9.8 | 2026-04-02 | An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures a… |
CVE-2026-34831 | Medium | 4.8 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail sets the Content-Length response header using String… |
CVE-2026-34830 | Medium | 5.9 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-M… |
CVE-2026-34829 | High | 7.5 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO wh… |
CVE-2026-34826 | Medium | 5.3 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header without limi… |
CVE-2026-34786 | Medium | 5.3 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static#applicable_rules evaluates several header_rules types ag… |
CVE-2026-34785 | High | 7.5 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a stati… |
CVE-2026-34763 | Medium | 5.3 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path directly into a… |
CVE-2026-34230 | Medium | 5.3 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.select_best_encoding processes Accept-Encoding values wit… |
CVE-2026-34083 | Medium | 6.1 | 2026-04-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, SignalK Server contains a code-level vulnerability in it… |
CVE-2026-33951 | High | 7.5 | 2026-04-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTT… |
CVE-2026-33950 | Critical | 9.4 | 2026-04-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by… |
CVE-2026-30603 | Medium | 6.8 | 2026-04-02 | An issue in the firmware update mechanism of Qianniao QN-L23PA0904 v20250721.1640 allows attackers to gain root access, install backdoors, and exfiltrate data… |
CVE-2026-26961 | Low | 3.7 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipar… |
CVE-2026-26895 | Medium | 5.3 | 2026-04-02 | User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform. |
CVE-2026-25212 | Critical | 9.9 | 2026-04-02 | An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser privileges, an attacker with pmm-admin rights c… |
CVE-2026-5351 | Medium | 6.3 | 2026-04-02 | A weakness has been identified in Trendnet TEW-657BRM 1.00.1. This affects the function add_wps_client of the file /setup.cgi. This manipulation of the argumen… |
CVE-2026-5350 | High | 8.8 | 2026-04-02 | A security flaw has been discovered in Trendnet TEW-657BRM 1.00.1. The impacted element is the function update_pcdb of the file /setup.cgi. The manipulation of… |
CVE-2026-5349 | High | 8.8 | 2026-04-02 | A vulnerability was identified in Trendnet TEW-657BRM 1.00.1. The affected element is the function add_apcdb of the file /setup.cgi. The manipulation of the ar… |
CVE-2026-34876 | High | 7.5 | 2026-04-02 | An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vulnerability in mbedtls_ccm_finish() in library/ccm.c allows attackers to obtain a… |
CVE-2026-33746 | Critical | 9.8 | 2026-04-02 | Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify… |
CVE-2026-33691 | Medium | 6.8 | 2026-04-02 | The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0… |
CVE-2026-30332 | High | 7.5 | 2026-04-02 | A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and e… |
CVE-2026-5346 | High | 7.3 | 2026-04-02 | A vulnerability was determined in huimeicloud hm_editor up to 2.2.3. Impacted is the function client.get of the file src/mcp-server.js of the component image-t… |
CVE-2026-5344 | Medium | 6.3 | 2026-04-02 | A security vulnerability has been detected in Textpattern up to 4.9.1. Affected by this vulnerability is the function mt_uploadImage of the file rpc/TXP_RPCSer… |
CVE-2026-5342 | Medium | 5.3 | 2026-04-02 | A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikon_load_padded_packed_raw of the file src/decoders/decoders_libraw.cpp of th… |
CVE-2026-5339 | Medium | 4.7 | 2026-04-02 | A vulnerability was detected in Tenda G103 1.0.0.5. The impacted element is the function action_set_net_settings of the file gpon.lua of the component Setting… |
CVE-2026-35002 | Critical | 9.8 | 2026-04-02 | Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Pyt… |
CVE-2026-34974 | Medium | 5.4 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the regex-based SVG sanitizer in phpMyFAQ (SvgSanitizer.php) can be bypassed using HTML… |
CVE-2026-34973 | Medium | 5.3 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the searchCustomPages() method in phpmyfaq/src/phpMyFAQ/Search.php uses real_escape_str… |
CVE-2026-34823 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/password/web/. An authenticated attacker c… |
CVE-2026-34822 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the new_cert_name parameter to /manage/ca/certificate/. An authenticated a… |
CVE-2026-34821 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/vpnauthentication/user/. An authenticated… |
CVE-2026-34820 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/ipsec/. An authenticated attacker can inje… |
CVE-2026-34819 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the REMARK parameter to /cgi-bin/openvpnclient.cgi. An authenticated attac… |
CVE-2026-34818 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/localdomains/. An authenticated at… |
CVE-2026-34817 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the ADDRESS BCC parameter to /cgi-bin/smtprouting.cgi. An authenticated at… |
CVE-2026-34816 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the domain parameter to /manage/smtpscan/domainrouting/. An authenticated… |
CVE-2026-34815 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the DOMAIN parameter to /cgi-bin/smtpdomains.cgi. An authenticated attacke… |
CVE-2026-34814 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the group parameter to /cgi-bin/proxygroup.cgi. An authenticated attacker… |
CVE-2026-34813 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the user parameter to /cgi-bin/proxyuser.cgi. An authenticated attacker ca… |
CVE-2026-34812 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the mimetypes parameter to /cgi-bin/proxypolicy.cgi. An authenticated atta… |
CVE-2026-34811 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/xtaccess.cgi. An authenticated attacker c… |
CVE-2026-34810 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/vpnfw.cgi. An authenticated attacker can… |
CVE-2026-34809 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/zonefw.cgi. An authenticated attacker can… |
CVE-2026-34808 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/outgoingfw.cgi. An authenticated attacker… |
CVE-2026-34807 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/incoming.cgi. An authenticated attacker c… |
CVE-2026-34806 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/snat.cgi. An authenticated attacker can i… |
CVE-2026-34805 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/dnat.cgi. An authenticated attacker can i… |
CVE-2026-34804 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the dscp parameter to /manage/qos/rules/. An authenticated attacker can in… |
CVE-2026-34803 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the name parameter to /manage/qos/classes/. An authenticated attacker can… |
CVE-2026-34802 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark user ham spam parameter to /cgi-bin/salearn.cgi. An authenticat… |
CVE-2026-34801 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dhcp/fixed_leases/. An authenticated attac… |
CVE-2026-34800 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the NAME parameter to /cgi-bin/uplinkeditor.cgi. An authenticated attacker… |
CVE-2026-34799 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/hosts/. An authenticated attacker… |
CVE-2026-34798 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/routing.cgi. An authenticated attacker ca… |
CVE-2026-34797 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_smtp.cgi. The DATE… |
CVE-2026-34796 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_openvpn.cgi. The DA… |
CVE-2026-34795 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_log.cgi. The DATE p… |
CVE-2026-34794 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_ids.cgi. The DATE p… |
CVE-2026-34793 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_firewall.cgi. The D… |
CVE-2026-34792 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_clamav.cgi. The DAT… |
CVE-2026-34791 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_proxy.cgi. The DATE… |
CVE-2026-34790 | High | 7.1 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to delete arbitrary files via directory traversal in the remove ARCHIVE parameter to /cgi-bi… |
CVE-2026-34729 | Medium | 6.1 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, there is a stored XSS vulnerability via Regex Bypass in Filter::removeAttributes(). Thi… |