2026 CVEs (page 372)
Page 372 of 687 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15542 | High | 7.3 | 2026-07-13 | A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection… |
CVE-2026-15541 | High | 7.3 | 2026-07-13 | A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the compo… |
CVE-2026-15540 | Medium | 4.3 | 2026-07-13 | A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the co… |
CVE-2026-14165 | High | 7.5 | 2026-07-13 | An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access… |
CVE-2026-15539 | Medium | 4.7 | 2026-07-13 | A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=bo… |
CVE-2026-15538 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/ut… |
CVE-2026-15537 | High | 7.3 | 2026-07-13 | A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The ma… |
CVE-2026-15536 | Medium | 6.3 | 2026-07-13 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patviewprescription.php. The manipulat… |
CVE-2026-12582 | High | 8.6 | 2026-07-13 | The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing… |
CVE-2026-12397 | Medium | 4.3 | 2026-07-13 | The WP Job Portal WordPress plugin before 2.5.5 does not verify ownership when returning an employer's contact email for a given job, allowing authenticated u… |
CVE-2026-12396 | Medium | 5.4 | 2026-07-13 | The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated… |
CVE-2026-12275 | High | 7.1 | 2026-07-13 | The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course c… |
CVE-2026-12274 | Medium | 6.5 | 2026-07-13 | The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its con… |
CVE-2026-12273 | Medium | 4.3 | 2026-07-13 | The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, an… |
CVE-2026-12271 | Medium | 5.4 | 2026-07-13 | The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with su… |
CVE-2026-12081 | Medium | 5.0 | 2026-07-13 | The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacke… |
CVE-2026-11964 | Critical | 9.1 | 2026-07-13 | The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before ac… |
CVE-2026-11963 | High | 8.1 | 2026-07-13 | The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user t… |
CVE-2026-10551 | Medium | 6.1 | 2026-07-13 | The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used du… |
CVE-2026-15535 | Medium | 6.3 | 2026-07-13 | A vulnerability was determined in AkariAsai self-rag up to 1fcdc420e48f50a7d7ab1ece5494221b93252e99. Affected by this issue is the function Indexer.deserialize… |
CVE-2026-15533 | Medium | 4.7 | 2026-07-13 | A security flaw has been discovered in DedeCMS 5.7.118. Impacted is an unknown function of the file /plus/search.php of the component Column Management. Perfor… |
CVE-2026-15532 | Low | 2.4 | 2026-07-13 | A vulnerability was identified in SourceCodester Online Book Store System 1.0. This issue affects some unknown processing of the component User Management Modu… |
CVE-2026-15531 | Medium | 5.3 | 2026-07-13 | A vulnerability has been found in yashbhalgat HashNeRF-pytorch up to 82885e698295982504eb6a26d060a6b2473e3706. Affected by this issue is the function torch.loa… |
CVE-2026-15530 | Medium | 5.3 | 2026-07-13 | A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=up… |
CVE-2026-9492 | High | 7.8 | 2026-07-13 | The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access Control vulnerability… |
CVE-2026-7162 | High | 7.8 | 2026-07-13 | Successful exploitation of the integer overflow vulnerability could allow an attacker to achieve system-level access to the affected software. |
CVE-2026-15553 | Medium | 5.3 | 2026-07-13 | Enterprise Cloud Database developed by Ragic has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload malicious files and… |
CVE-2026-15552 | Medium | 6.1 | 2026-07-13 | Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated remote attackers to inject persistent Ja… |
CVE-2026-15529 | Medium | 6.3 | 2026-07-13 | A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performi… |
CVE-2026-15528 | Low | 3.3 | 2026-07-13 | A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown processing of the file kicad_mcp/utils/path_validator.py. Perfo… |
CVE-2026-15527 | Medium | 5.3 | 2026-07-13 | A vulnerability has been found in better-auth better-icons up to 1.0.5. This vulnerability affects unknown code of the component scan_project_icons/sync_icon… |
CVE-2026-15526 | Low | 3.3 | 2026-07-13 | A flaw has been found in augmnt augments-mcp-server 7.1.0. This issue affects the function scanProjectDeps of the file src/tools/v4/scan-project-deps.ts of the… |
CVE-2026-15525 | Medium | 6.3 | 2026-07-13 | A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function _validate_urls of the file src/adloop/ads/write.py. Performin… |
CVE-2026-15524 | Low | 3.3 | 2026-07-13 | A security vulnerability has been detected in alioshr memory-bank-mcp up to 0.2.1/3.1. This affects an unknown part of the file list-project-files-validation-f… |
CVE-2026-15523 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /Simple… |
CVE-2026-15522 | Medium | 5.3 | 2026-07-13 | A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js… |
CVE-2026-15521 | Medium | 5.3 | 2026-07-13 | A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the file build/server.cjs of the component upd… |
CVE-2026-15520 | Medium | 5.3 | 2026-07-13 | A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompress_R2004_section of the file src/decode.c of the compone… |
CVE-2026-15519 | Medium | 5.0 | 2026-07-13 | A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file system_prompt.jinja of the component PyPI Handler. Perfor… |
CVE-2026-15551 | Medium | 5.5 | 2026-07-13 | Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects . |
CVE-2026-15518 | Medium | 4.7 | 2026-07-13 | A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Con… |
CVE-2026-15517 | High | 7.3 | 2026-07-13 | A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx. This manipulatio… |
CVE-2026-15516 | Medium | 5.6 | 2026-07-13 | A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/install/controller/Index.php of the com… |
CVE-2026-15515 | High | 7.0 | 2026-07-13 | A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the library qmudisk64.sys of the… |
CVE-2026-15514 | High | 7.3 | 2026-07-13 | A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affects the function RPCService.query of the file /customizemt/x… |
CVE-2026-15513 | Medium | 6.3 | 2026-07-13 | A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the file /cgi-bin/adm.cgi. Performing a mani… |
CVE-2026-15512 | Medium | 6.3 | 2026-07-13 | A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen… |
CVE-2026-15511 | Critical | 9.8 | 2026-07-12 | A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /us… |
CVE-2026-15510 | Medium | 6.3 | 2026-07-12 | A vulnerability was found in Leantime up to 3.8.0. Affected is the function Setting::saveSetting of the component API. The manipulation results in improper aut… |
CVE-2026-15509 | Medium | 6.3 | 2026-07-12 | A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the… |
CVE-2026-15508 | Medium | 6.3 | 2026-07-12 | A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function build_target_url of the file ai-gateway/src/dispatcher/service.rs o… |
CVE-2026-15507 | Medium | 6.3 | 2026-07-12 | A vulnerability was detected in coollabsio Coolify up to 4.1.1. The impacted element is an unknown function of the file /app/Policies/ of the component Policy… |
CVE-2026-15506 | High | 7.8 | 2026-07-12 | A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected element is an unknown function in the library saappctl.sys of the… |
CVE-2026-15505 | Low | 3.5 | 2026-07-12 | A weakness has been identified in vnotex vnote up to 3.20.1. Impacted is an unknown function of the file /src/data/extra/web/js/markdownit.js of the component… |
CVE-2026-10668 | Low | 2.4 | 2026-07-12 | The Nuvoton NuMaker HSUSBD USB device-controller driver (drivers/usb/udc/udc_numaker.c) armed the control Data IN stage unconditionally (base->CEPTXCNT = len i… |
CVE-2026-10667 | High | 7.8 | 2026-07-12 | Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list) of dynamically al… |
CVE-2026-10666 | High | 8.1 | 2026-07-12 | parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the port substring into a fixed 17-byte st… |
CVE-2026-10665 | High | 7.4 | 2026-07-12 | In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload into a fixed… |
CVE-2026-10664 | Medium | 5.0 | 2026-07-12 | The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied TWT (Target Wake Ti… |
CVE-2026-10663 | Medium | 6.1 | 2026-07-12 | In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) freed the root usb_device slab object… |
CVE-2026-58596 | High | 8.3 | 2026-07-12 | Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-15502 | Medium | 6.3 | 2026-07-12 | A vulnerability was detected in AojiaoZero Antaris 1.0. This affects the function _rewardPurchase of the file /ipn.php of the component PayPal IPN Payment Hand… |
CVE-2026-15501 | Medium | 6.3 | 2026-07-12 | A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function ToolsRoute.test_mcp_connection of the fi… |
CVE-2026-61876 | High | 8.8 | 2026-07-12 | LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Atta… |
CVE-2026-61875 | High | 8.8 | 2026-07-12 | luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOA… |
CVE-2026-61874 | Low | 3.1 | 2026-07-12 | filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stal… |
CVE-2026-59260 | High | 8.8 | 2026-07-12 | OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-… |
CVE-2026-56336 | Medium | 5.3 | 2026-07-12 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id a… |
CVE-2026-56313 | High | 8.1 | 2026-07-12 | Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise administrators to delet… |
CVE-2026-56308 | High | 7.3 | 2026-07-12 | Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing email address. An attac… |
CVE-2026-56281 | Low | 3.8 | 2026-07-12 | Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidat… |
CVE-2026-56271 | Critical | 9.8 | 2026-07-12 | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and is… |
CVE-2026-56260 | Critical | 9.1 | 2026-07-12 | Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_path parameter accep… |
CVE-2026-56259 | High | 8.2 | 2026-07-12 | Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-cont… |
CVE-2026-56252 | Medium | 5.4 | 2026-07-12 | Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook… |
CVE-2026-56241 | High | 8.3 | 2026-07-12 | Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to delete_non_compliant_bundles and count_non… |
CVE-2026-56238 | High | 7.5 | 2026-07-12 | Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint that allows unauthenticated attackers to… |
CVE-2026-15500 | Medium | 6.3 | 2026-07-12 | A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Affected by this vulnerability is the function get_online_plugins of the file astrbot/dashb… |
CVE-2026-15499 | Medium | 6.3 | 2026-07-12 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/cron_tools… |
CVE-2026-15498 | High | 7.3 | 2026-07-12 | A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa45ce12c. This impacts an unknown function of the file users… |
CVE-2026-15497 | High | 7.3 | 2026-07-12 | A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2. This affects an unknown function of the file sonic-server-controller/src/main/java/org… |
CVE-2026-15496 | Medium | 6.3 | 2026-07-12 | A vulnerability was found in SonicCloudOrg sonic-agent up to 2.7.2. The impacted element is the function evalIsFailed of the file sonic-agent/src/main/java/org… |
CVE-2026-15495 | Medium | 6.3 | 2026-07-12 | A vulnerability has been found in SonicCloudOrg sonic-agent up to 2.7.2. The affected element is an unknown function of the file AndroidWSServer.java of the co… |
CVE-2026-15494 | Medium | 4.7 | 2026-07-12 | A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switch_status.php. Executing a… |
CVE-2026-15493 | Low | 3.5 | 2026-07-12 | A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. This issue affects some unknown processing… |
CVE-2026-15492 | Medium | 4.3 | 2026-07-12 | A security vulnerability has been detected in igweze wizgrade up to b1d55f22b90cd7e7a6e5002f006d7c649e8086d6. This vulnerability affects unknown code of the fi… |
CVE-2026-15491 | High | 7.3 | 2026-07-12 | A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation caus… |
CVE-2026-15490 | High | 7.3 | 2026-07-12 | A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this issue is some unknown function… |
CVE-2026-15489 | High | 7.3 | 2026-07-12 | A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this vulnerability is an unknown functio… |
CVE-2026-15488 | High | 7.3 | 2026-07-12 | A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of the file app/common/controller/FileContr… |
CVE-2026-15487 | Medium | 6.3 | 2026-07-12 | A vulnerability was found in TRENDnet TEW-821DAP 1.11B03. This impacts the function sub_41FBD0 of the file /goform/system_ntp of the component Firmware Update… |
CVE-2026-15486 | Medium | 6.3 | 2026-07-12 | A vulnerability has been found in TRENDnet TEW-821DAP 1.11B03. This affects the function sub_42026C of the file /goform/tools_ddns of the component Firmware Up… |
CVE-2026-15485 | Medium | 6.3 | 2026-07-12 | A flaw has been found in TRENDnet TEW-821DAP 1.11B03. The impacted element is the function sub_43F2C4 of the file /goform/tools_nslookup of the component DNS L… |
CVE-2026-15484 | High | 8.8 | 2026-07-12 | A vulnerability was detected in TRENDnet TEW-821DAP 1.12B01. The affected element is the function sub_41EC14 of the file /goform/tools_nslookup of the componen… |
CVE-2026-15483 | High | 8.8 | 2026-07-12 | A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function sub_41EC14 of the file /goform/tools_nslookup of the compon… |
CVE-2026-15482 | High | 7.3 | 2026-07-12 | A weakness has been identified in Aster Telecom Azcall 10/11. This issue affects some unknown processing of the file /azcall/adm/gestao_loja/sis.php?t=consulta… |
CVE-2026-15481 | High | 8.8 | 2026-07-12 | A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoa_test of the file /sbin/rc of the compone… |
CVE-2026-15480 | High | 8.8 | 2026-07-12 | A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. This affects the function start_httpd of the file /sbin/rc of the component Web Service. S… |
CVE-2026-15479 | High | 7.3 | 2026-07-12 | A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Adm… |
CVE-2026-15478 | Medium | 6.3 | 2026-07-12 | A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the co… |