2026 CVEs (page 362)
Page 362 of 448 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20692 | Medium | 5.3 | 2026-03-25 | A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 1… |
CVE-2026-20691 | Medium | 4.3 | 2026-03-25 | An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 2… |
CVE-2026-20690 | Medium | 6.5 | 2026-03-25 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS… |
CVE-2026-20688 | Critical | 9.3 | 2026-03-25 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS… |
CVE-2026-20687 | High | 7.1 | 2026-03-25 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequ… |
CVE-2026-20686 | Medium | 5.3 | 2026-03-25 | This issue was addressed with improved input validation. This issue is fixed in iOS 26.3 and iPadOS 26.3. An app may be able to access sensitive user data. |
CVE-2026-20684 | Low | 3.3 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.4. An app may bypass Gatekeeper checks. |
CVE-2026-20670 | Medium | 5.5 | 2026-03-25 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be able to access… |
CVE-2026-20668 | Medium | 5.5 | 2026-03-25 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.5… |
CVE-2026-20665 | Medium | 6.5 | 2026-03-25 | This issue was addressed through improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS T… |
CVE-2026-20664 | Medium | 4.3 | 2026-03-25 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processin… |
CVE-2026-20657 | Medium | 6.5 | 2026-03-25 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequo… |
CVE-2026-20651 | Medium | 6.2 | 2026-03-25 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An… |
CVE-2026-20639 | High | 7.5 | 2026-03-25 | An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3. Processin… |
CVE-2026-20637 | Medium | 6.2 | 2026-03-25 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequ… |
CVE-2026-20633 | Medium | 5.5 | 2026-03-25 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be… |
CVE-2026-20632 | Medium | 5.3 | 2026-03-25 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to… |
CVE-2026-20631 | High | 8.8 | 2026-03-25 | A logic issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. A user may be able to elevate privileges. |
CVE-2026-20622 | High | 7.5 | 2026-03-25 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may be able to c… |
CVE-2026-20607 | Medium | 4.0 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may… |
CVE-2026-4781 | Medium | 6.3 | 2026-03-25 | A flaw has been found in SourceCodester Sales and Inventory System 1.0. The affected element is an unknown function of the file update_purchase.php of the comp… |
CVE-2026-4780 | Medium | 6.3 | 2026-03-25 | A vulnerability was detected in SourceCodester Sales and Inventory System 1.0. Impacted is an unknown function of the file update_out_standing.php of the compo… |
CVE-2026-4779 | Medium | 6.3 | 2026-03-24 | A security vulnerability has been detected in SourceCodester Sales and Inventory System 1.0. This issue affects some unknown processing of the file update_cust… |
CVE-2026-4778 | Medium | 6.3 | 2026-03-24 | A weakness has been identified in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file update_category.php of the… |
CVE-2026-4777 | Medium | 6.3 | 2026-03-24 | A security flaw has been discovered in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file view_supplier.php of the compone… |
CVE-2026-4433 | | 2026-03-24 | An SSH misconfigurations exists in Tenable OT that led to the potential exfiltration of socket, port, and service information via the ostunnel user and Gateway… | |
CVE-2026-4371 | High | 7.4 | 2026-03-24 | A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connectio… |
CVE-2026-3912 | | 2026-03-24 | Injection vulnerabilities due to validation/sanitisation of user-supplied input in ActiveMatrix BusinessWorks and Enterprise Administrator allows information d… | |
CVE-2026-3889 | Medium | 6.5 | 2026-03-24 | Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9. |
CVE-2026-33215 | Medium | 6.5 | 2026-03-24 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to ver… |
CVE-2026-24159 | High | 7.8 | 2026-03-24 | NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution. A successful exploit of this vulnerability might lead to code… |
CVE-2026-24158 | High | 7.5 | 2026-03-24 | NVIDIA Triton Inference Server contains a vulnerability in the HTTP endpoint where an attacker may cause a denial of service by providing a large compressed pa… |
CVE-2026-24157 | High | 7.8 | 2026-03-24 | NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution. A successful exploit of this vulnerab… |
CVE-2026-24152 | High | 7.8 | 2026-03-24 | NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A… |
CVE-2026-24151 | High | 7.8 | 2026-03-24 | NVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by convincing a user to load a maliciously crafted input. A succe… |
CVE-2026-24150 | High | 7.8 | 2026-03-24 | NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A… |
CVE-2026-24141 | High | 7.8 | 2026-03-24 | NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe deserialization by prov… |
CVE-2026-21790 | Medium | 6.3 | 2026-03-24 | HCL Traveler is susceptible to a weak default HTTP header validation vulnerability, which could allow an attacker to bypass additional authentication checks. |
CVE-2026-33511 | Critical | 9.8 | 2026-03-24 | pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's… |
CVE-2026-33509 | High | 7.5 | 2026-03-24 | pyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API endpoint al… |
CVE-2026-33419 | High | 7.5 | 2026-03-24 | MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentit… |
CVE-2026-33412 | Medium | 5.6 | 2026-03-24 | Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like syst… |
CVE-2026-33353 | Medium | 6.5 | 2026-03-24 | Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.6, an authorization flaw in repo import allows any aut… |
CVE-2026-33349 | Medium | 5.9 | 2026-03-24 | fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the D… |
CVE-2026-33347 | Medium | 6.1 | 2026-03-24 | league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an a… |
CVE-2026-33345 | Medium | 6.5 | 2026-03-24 | solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/{org}/projects/{project} allows a… |
CVE-2026-33344 | High | 8.1 | 2026-03-24 | Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to C… |
CVE-2026-33332 | High | 7.5 | 2026-03-24 | NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled… |
CVE-2026-33331 | High | 8.2 | 2026-03-24 | oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XS… |
CVE-2026-33330 | High | 7.1 | 2026-03-24 | FileRise is a self-hosted web file manager / WebDAV server. Prior to version 3.10.0, a broken access control issue in FileRise's ONLYOFFICE integration allows… |
CVE-2026-33329 | High | 8.1 | 2026-03-24 | FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js… |
CVE-2026-33326 | Medium | 4.3 | 2026-03-24 | Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany queries by passing… |
CVE-2026-33322 | Critical | 9.8 | 2026-03-24 | MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerab… |
CVE-2026-33314 | Medium | 6.5 | 2026-03-24 | pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, a Host Header Spoofing vulnerability in the @local_check d… |
CVE-2026-32948 | High | 7.8 | 2026-03-24 | sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS command… |
CVE-2026-22559 | High | 8.8 | 2026-03-24 | An Improper Input Validation vulnerability in UniFi Network Server may allow unauthorized access to an account if the account owner is socially engineered into… |
CVE-2026-21783 | Medium | 4.3 | 2026-03-24 | HCL Traveler is affected by sensitive information disclosure. The application generates some error messages that provide detailed information about errors and… |
CVE-2026-33769 | Medium | 5.3 | 2026-03-24 | Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by se… |
CVE-2026-33768 | Medium | 6.5 | 2026-03-24 | Astro is a web framework. Prior to version 10.0.2, the @astrojs/vercel serverless entrypoint reads the x-astro-path header and x_astro_path query parameter to… |
CVE-2026-33627 | Medium | 6.5 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.61 and 9.6.0-alpha.55, an authent… |
CVE-2026-33624 | Low | 2.7 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.60 and 9.6.0-alpha.54, an attacke… |
CVE-2026-33539 | High | 7.2 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacke… |
CVE-2026-33538 | High | 7.5 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.58 and 9.6.0-alpha.52, an unauthe… |
CVE-2026-33527 | Medium | 4.3 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0-alpha.48, an authent… |
CVE-2026-33508 | High | 7.5 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0-alpha.45, Parse Serv… |
CVE-2026-33498 | High | 7.5 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.55 and 9.6.0-alpha.44, an attacke… |
CVE-2026-33429 | Medium | 5.3 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacke… |
CVE-2026-33421 | Medium | 6.5 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.53 and 9.6.0-alpha.42, Parse Serv… |
CVE-2026-33417 | Medium | 6.5 | 2026-03-24 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.2, password reset tokens in Wallos never expire. The password_reset… |
CVE-2026-33409 | Critical | 9.1 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0-alpha.41, an authent… |
CVE-2026-33323 | Medium | 5.3 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.51 and 9.6.0-alpha.40, the Pages… |
CVE-2026-30932 | High | 8.8 | 2026-03-24 | Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) does… |
CVE-2026-2417 | | 2026-03-24 | A Missing Authentication for Critical Function vulnerability in Pharos Controls Mosaic Show Controller firmware version 2.15.3 could allow an unauthenticated a… | |
CVE-2026-29772 | Medium | 5.9 | 2026-03-24 | Astro is a web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a siz… |
CVE-2026-23924 | | 2026-03-24 | Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable o… | |
CVE-2026-23923 | | 2026-03-24 | An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup bu… | |
CVE-2026-23921 | | 2026-03-24 | A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL sel… | |
CVE-2026-23920 | | 2026-03-24 | Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used… | |
CVE-2026-23919 | | 2026-03-24 | For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to co… | |
CVE-2026-1995 | High | 7.8 | 2026-03-24 | In versions before 7.0.0.64, IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several files under the C:\ProgramData\IDri… |
CVE-2026-33407 | Critical | 9.1 | 2026-03-24 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTP_PROXY and HTTPS_P… |
CVE-2026-33401 | Medium | 6.5 | 2026-03-24 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the patch introduced in commit e8a513591 (CVE-2026-30840) added… |
CVE-2026-33400 | Medium | 5.4 | 2026-03-24 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting (XSS) vulnerability in the payment… |
CVE-2026-33399 | High | 7.7 | 2026-03-24 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the SSRF fix applied in version 4.6.2 for CVE-2026-30839 and CVE… |
CVE-2026-33162 | Medium | 6.5 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 5.3.0 to before version 5.9.14, an authenticated control panel user with only accessCp can move en… |
CVE-2026-33161 | Medium | 4.3 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-priv… |
CVE-2026-33160 | Medium | 5.3 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, an unauthe… |
CVE-2026-33159 | Medium | 6.5 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, guest user… |
CVE-2026-33158 | Medium | 6.5 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-priv… |
CVE-2026-33157 | High | 7.2 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.13, a Remote Code Execution (RCE) vulnerability exists in Craft CMS, i… |
CVE-2026-32854 | High | 7.5 | 2026-03-24 | LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcess… |
CVE-2026-32853 | High | 8.1 | 2026-03-24 | LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a… |
CVE-2026-33340 | Critical | 9.1 | 2026-03-24 | LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSRF) vulnerability ha… |
CVE-2026-33700 | Medium | 4.9 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DELETE /api/v1/projects/:project/shares/:share` endpoint does not… |
CVE-2026-33680 | High | 7.5 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenticated user… |
CVE-2026-33679 | Medium | 6.4 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DownloadImage` function in `pkg/utils/avatar.go` uses a bare `http… |
CVE-2026-33678 | High | 8.1 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id =… |
CVE-2026-33677 | Medium | 6.5 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `GET /api/v1/projects/:project/webhooks` endpoint returns webhook B… |
CVE-2026-33676 | Medium | 6.5 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the `related_tasks` fi… |
CVE-2026-33675 | Medium | 6.4 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions `DownloadFile` and `DownloadFileWithHead… |