2026 CVEs (page 354)
Page 354 of 449 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-25099 | High | 8.8 | 2026-03-27 | Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be ex… |
CVE-2026-3457 | | 2026-03-27 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Thales Sentinel LDK Runtime on Windows allows Stor… | |
CVE-2026-27860 | Low | 3.7 | 2026-03-27 | If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restricti… |
CVE-2026-27859 | Medium | 5.3 | 2026-03-27 | A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably formatted mail message causes mail delivery… |
CVE-2026-27858 | High | 7.5 | 2026-03-27 | Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force manages… |
CVE-2026-27857 | Medium | 4.3 | 2026-03-27 | Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This… |
CVE-2026-27856 | High | 7.4 | 2026-03-27 | Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured cre… |
CVE-2026-27855 | Medium | 6.8 | 2026-03-27 | Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP cred… |
CVE-2026-24031 | High | 7.7 | 2026-03-27 | Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user… |
CVE-2026-0394 | Medium | 5.3 | 2026-03-27 | When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characte… |
CVE-2026-4948 | Medium | 5.5 | 2026-03-27 | A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSett… |
CVE-2026-34353 | Medium | 5.9 | 2026-03-27 | In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed. |
CVE-2026-33559 | Medium | 5.4 | 2026-03-27 | WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of the plugin enabled, a… |
CVE-2026-33366 | Medium | 5.3 | 2026-03-27 | Missing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may allow an attacker to forcibly reboot the product without authen… |
CVE-2026-33280 | Critical | 9.8 | 2026-03-27 | Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, result… |
CVE-2026-32678 | High | 7.5 | 2026-03-27 | Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings without authenticatio… |
CVE-2026-32669 | Critical | 9.8 | 2026-03-27 | Code injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary code may be executed on the products. |
CVE-2026-27650 | Critical | 9.8 | 2026-03-27 | OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary OS command may be executed on the… |
CVE-2026-22744 | High | 7.5 | 2026-03-27 | In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts th… |
CVE-2026-22743 | High | 7.5 | 2026-03-27 | Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as… |
CVE-2026-22742 | High | 8.6 | 2026-03-27 | Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages… |
CVE-2026-22738 | Critical | 9.8 | 2026-03-27 | In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could… |
CVE-2026-4910 | High | 7.3 | 2026-03-27 | A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus up to 1.3.44. Affected is an unknown function of the file /RemoteForm… |
CVE-2026-3098 | Medium | 6.5 | 2026-03-27 | The Smart Slider 3 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.5.1.33 via the 'actionExportAll' function… |
CVE-2026-4909 | Low | 2.4 | 2026-03-27 | A weakness has been identified in code-projects Exam Form Submission 1.0. This impacts an unknown function of the file /admin/update_s7.php. This manipulation… |
CVE-2026-4908 | High | 7.3 | 2026-03-27 | A security flaw has been discovered in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /modstaffinfo.php of the component… |
CVE-2026-4907 | Medium | 6.3 | 2026-03-27 | A vulnerability was identified in Page-Replica Page Replica up to e4a7f52e75093ee318b4d5a9a9db6751050d2ad0. The impacted element is the function sitemap.fetch… |
CVE-2026-4906 | High | 8.8 | 2026-03-27 | A vulnerability was determined in Tenda AC5 15.03.06.47. The affected element is the function decodePwd of the file /goform/WizardHandle of the component POST… |
CVE-2026-33935 | High | 7.5 | 2026-03-27 | MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.72, an unauthenticated attacker can lock out administrator and vi… |
CVE-2026-33890 | Critical | 9.8 | 2026-03-27 | MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated attacker can register an arbitrary passkey… |
CVE-2026-33747 | High | 8.4 | 2026-03-27 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a cu… |
CVE-2026-33745 | High | 7.4 | 2026-03-27 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.39.0, the cpp-httplib HTTP client forwards stored Basic Auth, Bear… |
CVE-2026-33744 | High | 7.8 | 2026-03-27 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the `docker.system_packages` field… |
CVE-2026-33735 | High | 8.8 | 2026-03-27 | MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypass in the `/api/settings/import-database… |
CVE-2026-33730 | Medium | 6.5 | 2026-03-27 | Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insec… |
CVE-2026-33729 | Critical | 9.8 | 2026-03-27 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. In versions prior to 1.13.1, u… |
CVE-2026-33728 | Critical | 9.8 | 2026-03-27 | dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoi… |
CVE-2026-33726 | Medium | 5.4 | 2026-03-27 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network Polic… |
CVE-2026-33725 | High | 7.2 | 2026-03-27 | Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58… |
CVE-2026-33721 | Medium | 5.3 | 2026-03-27 | MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’… |
CVE-2026-33718 | High | 7.6 | 2026-03-27 | OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhan… |
CVE-2026-33701 | Critical | 9.8 | 2026-03-27 | OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI ins… |
CVE-2026-33699 | High | 7.5 | 2026-03-27 | pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an in… |
CVE-2026-33693 | Medium | 6.5 | 2026-03-27 | Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the `v4_is_invalid()` function in `activitypub-federation-rust` (`src/ut… |
CVE-2026-4905 | High | 8.8 | 2026-03-27 | A vulnerability was found in Tenda AC5 15.03.06.47. Impacted is the function formWifiWpsOOB of the file /goform/WifiWpsOOB of the component POST Request Handle… |
CVE-2026-4904 | High | 8.8 | 2026-03-27 | A vulnerability has been found in Tenda AC5 15.03.06.47. This issue affects the function formSetCfm of the file /goform/setcfm of the component POST Request Ha… |
CVE-2026-33945 | Critical | 9.9 | 2026-03-27 | Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is… |
CVE-2026-33898 | High | 8.8 | 2026-03-27 | Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by `incus webui` incorrectly validates the authenticat… |
CVE-2026-33697 | High | 7.5 | 2026-03-27 | Cocos AI is a confidential computing system for AI. The current implementation of attested TLS (aTLS) in CoCoS is vulnerable to a relay attack affecting all ve… |
CVE-2026-29071 | Low | 3.1 | 2026-03-27 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, any authenticated user can read othe… |
CVE-2026-29070 | Medium | 5.4 | 2026-03-27 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an access control check is missing w… |
CVE-2026-28788 | High | 7.1 | 2026-03-27 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, any authenticated user can overwrite… |
CVE-2026-28786 | Medium | 4.3 | 2026-03-27 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an unsanitized filename field in the… |
CVE-2026-27893 | High | 8.8 | 2026-03-27 | vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation file… |
CVE-2026-4903 | High | 8.8 | 2026-03-26 | A flaw has been found in Tenda AC5 15.03.06.47. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex of the component POST Req… |
CVE-2026-4902 | High | 8.8 | 2026-03-26 | A vulnerability was detected in Tenda AC5 15.03.06.47. This affects the function fromAddressNat of the file /goform/addressNat of the component POST Request Ha… |
CVE-2026-34352 | High | 8.5 | 2026-03-26 | In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of… |
CVE-2026-33897 | Critical | 9.9 | 2026-03-26 | Incus is a system container and virtual machine manager. Prior to version 6.23.0, instance template files can be used to cause arbitrary read or writes as root… |
CVE-2026-33743 | Medium | 6.5 | 2026-03-26 | Incus is a system container and virtual machine manager. Prior to version 6.23.0, a specially crafted storage bucket backup can be used by an user with access… |
CVE-2026-33711 | High | 7.8 | 2026-03-26 | Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots. That API relies on the use of a temporary file for Q… |
CVE-2026-33542 | Medium | 4.8 | 2026-03-26 | Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestr… |
CVE-2026-4900 | Medium | 5.3 | 2026-03-26 | A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulat… |
CVE-2026-4899 | Low | 2.4 | 2026-03-26 | A security flaw has been discovered in code-projects Online Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /dbfood/… |
CVE-2026-4898 | Medium | 4.3 | 2026-03-26 | A vulnerability was identified in code-projects Online Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /dbfood… |
CVE-2026-4346 | Medium | 6.8 | 2026-03-26 | The vulnerability affecting TL-WR850N v3 allows cleartext storage of administrative and Wi-Fi credentials in a region of the device’s flash memory while the se… |
CVE-2026-3650 | High | 7.5 | 2026-03-26 | A memory leak exists in the Grassroots DICOM library (GDCM). The bug occurs when parsing malformed DICOM files with non-standard VR types in file meta informat… |
CVE-2026-33687 | High | 8.8 | 2026-03-26 | Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 contain a vulnerability in the file upload endpoint that allow… |
CVE-2026-33686 | High | 8.8 | 2026-03-26 | Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. Th… |
CVE-2026-33682 | Medium | 4.7 | 2026-03-26 | Streamlit is a data oriented application development framework for python. Streamlit Open Source versions prior to 1.54.0 running on Windows hosts have an unau… |
CVE-2026-33674 | Low | 2.0 | 2026-03-26 | PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 improperly use the validation framework. Versions 8.2.5 and 9.1.0 co… |
CVE-2026-33673 | High | 7.6 | 2026-03-26 | PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabi… |
CVE-2026-33672 | Medium | 5.3 | 2026-03-26 | Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POS… |
CVE-2026-33671 | High | 7.5 | 2026-03-26 | Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when p… |
CVE-2026-33670 | Critical | 9.8 | 2026-03-26 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, the /api/file/readDir interface was used to traverse and retrieve the file names of a… |
CVE-2026-33669 | Critical | 9.8 | 2026-03-26 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/bl… |
CVE-2026-33664 | High | 7.3 | 2026-03-26 | Kestra is an open-source, event-driven orchestration platform Versions up to and including 1.3.3 render user-supplied flow YAML metadata fields — description… |
CVE-2026-33661 | High | 8.6 | 2026-03-26 | Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/… |
CVE-2026-33658 | Medium | 6.5 | 2026-03-26 | Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy contr… |
CVE-2026-33653 | Medium | 4.6 | 2026-03-26 | Ulloady is a file uploader script with multi-file upload support. A Stored Cross-Site Scripting (XSS) vulnerability exists in versions prior to 3.1.2 due to im… |
CVE-2026-28377 | High | 7.5 | 2026-03-26 | A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users… |
CVE-2026-1556 | Medium | 6.5 | 2026-03-26 | Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated user… |
CVE-2026-0748 | Medium | 4.3 | 2026-03-26 | In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" p… |
CVE-2026-4933 | High | 7.5 | 2026-03-26 | Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing.This issue affects Unpublished Node Permissions: from 0.0… |
CVE-2026-4393 | Medium | 4.3 | 2026-03-26 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue affects Automated Logout: from 0.0.0 be… |
CVE-2026-3622 | High | 7.5 | 2026-03-26 | The vulnerability exists in the UPnP component of TL-WR841N v14, where improper input validation leads to an out-of-bounds read, potentially causing a crash of… |
CVE-2026-3573 | High | 7.5 | 2026-03-26 | Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.This issue affects AI (Artificial Intelligence): from 0… |
CVE-2026-3532 | Medium | 4.2 | 2026-03-26 | Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAu… |
CVE-2026-3531 | Medium | 6.5 | 2026-03-26 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects… |
CVE-2026-3530 | Medium | 4.3 | 2026-03-26 | Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect /… |
CVE-2026-3529 | Medium | 6.1 | 2026-03-26 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Analytics GA4 allows Cross-Site Scripting (… |
CVE-2026-3528 | Medium | 6.1 | 2026-03-26 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Calculation Fields allows Cross-Site Scripting (XS… |
CVE-2026-3527 | Medium | 6.5 | 2026-03-26 | Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-3526 | Medium | 5.3 | 2026-03-26 | Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0… |
CVE-2026-3525 | Medium | 5.3 | 2026-03-26 | Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0… |
CVE-2026-33742 | Medium | 5.4 | 2026-03-26 | Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw H… |
CVE-2026-33738 | Medium | 5.4 | 2026-03-26 | Lychee is a free, open-source photo-management tool. Prior to version 7.5.3, the photo `description` field is stored without HTML sanitization and rendered usi… |
CVE-2026-33645 | High | 7.1 | 2026-03-26 | Fireshare facilitates self-hosted media and link sharing. In version 1.5.1, an authenticated path traversal vulnerability in Fireshare’s chunked upload endpoin… |
CVE-2026-33644 | Medium | 4.3 | 2026-03-26 | Lychee is a free, open-source photo-management tool. Prior to version 7.5.2, the SSRF protection in `PhotoUrlRule.php` can be bypassed using DNS rebinding. The… |
CVE-2026-33640 | Critical | 9.8 | 2026-03-26 | Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users not associated with an Identity Provider… |
CVE-2026-33638 | Medium | 5.3 | 2026-03-26 | Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, `GET /api/allusers` is mounted as a public endpoint… |