2026 CVEs (page 373)
Page 373 of 448 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-25873 | Critical | 9.8 | 2026-03-18 | OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary co… |
CVE-2026-25745 | Medium | 6.5 | 2026-03-18 | OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, the message/not… |
CVE-2026-4396 | High | 8.1 | 2026-03-18 | Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack v… |
CVE-2026-31971 | High | 8.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety o… |
CVE-2026-31970 | High | 8.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. GZI files are used to index block-compressed GZIP [BGZF] files. In the GZI loading fu… |
CVE-2026-31969 | High | 8.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety o… |
CVE-2026-31968 | High | 8.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety o… |
CVE-2026-31967 | Critical | 9.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_dec… |
CVE-2026-31966 | Critical | 9.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of… |
CVE-2026-3479 | | 2026-03-18 | DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation… | |
CVE-2026-31965 | High | 8.2 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_dec… |
CVE-2026-31964 | High | 7.5 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety o… |
CVE-2026-31963 | High | 8.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of… |
CVE-2026-32634 | High | 8.1 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, Glances stores both the Zeroconf-advertised s… |
CVE-2026-32633 | Critical | 9.1 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw… |
CVE-2026-32632 | Medium | 5.9 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5… |
CVE-2026-32611 | High | 7.0 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by… |
CVE-2026-31962 | High | 8.8 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. While most align… |
CVE-2026-30704 | Critical | 9.1 | 2026-03-18 | The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) exposes an unprotected UART interface through accessible hardware pads on the PCB |
CVE-2026-30703 | Critical | 9.8 | 2026-03-18 | A command injection vulnerability exists in the web management interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02). The adm.cgi endpoint im… |
CVE-2026-30702 | Critical | 9.8 | 2026-03-18 | The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication mechanism in its web management interface. The login page does no… |
CVE-2026-30701 | Critical | 9.1 | 2026-03-18 | The web interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) contains hardcoded credential disclosure mechanisms (in the form of Server Side… |
CVE-2026-30048 | Medium | 5.4 | 2026-03-18 | A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget thru 1.4.4. User-supplied input is not properly sanitized before bein… |
CVE-2026-29859 | Critical | 9.8 | 2026-03-18 | An arbitrary file upload vulnerability in aaPanel v7.57.0 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2026-29858 | High | 7.5 | 2026-03-18 | A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion (LFI), leadingot sensitive information exposure. |
CVE-2026-29856 | High | 7.5 | 2026-03-18 | An issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows attackers to cause a Regular Expression Denial of Service (ReDoS)… |
CVE-2026-27135 | High | 7.5 | 2026-03-18 | nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data wh… |
CVE-2026-26948 | Medium | 4.9 | 2026-03-18 | Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.174, 15G and 16G versions prior to 7.10.90.00, contain an Exposure of Sensitive… |
CVE-2026-26945 | Medium | 5.3 | 2026-03-18 | Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions prior to 7.20.10.50 and Dell Integrated Dell Remote Ac… |
CVE-2026-26740 | High | 8.2 | 2026-03-18 | Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphi… |
CVE-2026-23270 | High | 7.8 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo… |
CVE-2026-23269 | High | 7.1 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read fro… |
CVE-2026-23268 | High | 7.8 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged… |
CVE-2026-23267 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and… |
CVE-2026-23266 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: fbdev: rivafb: fix divide error in nv3_arb() A userspace program can trigger the RIVA NV3… |
CVE-2026-23265 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on node footer in {read,write}_end_io -----------[ cut here… |
CVE-2026-23264 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" This reverts commit 729486… |
CVE-2026-23263 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix page array leak d9f595b9a65e ("io_uring/zcrx: fix leaking pages on sg… |
CVE-2026-23262 | High | 7.8 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: gve: Fix stats report corruption on queue count change The driver and the NIC share a reg… |
CVE-2026-23261 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: nvme-fc: release admin tagset if init fails nvme_fabrics creates an NVMe/FC controller in… |
CVE-2026-23260 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: regmap: maple: free entry on mas_store_gfp() failure regcache_maple_write() allocates a n… |
CVE-2026-23259 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: free potentially allocated iovec on cache put failure If a read/write reques… |
CVE-2026-23258 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Initialize netdev pointer before queue setup In setup_nic_devices(), the n… |
CVE-2026-23257 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup In setup_nic_device… |
CVE-2026-23256 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup In setup_nic_device… |
CVE-2026-23255 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: net: add proper RCU protection to /proc/net/ptype Yin Fengwei reported an RCU stall in pt… |
CVE-2026-23254 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: net: gro: fix outer network offset The udp GRO complete stage assumes that all the packet… |
CVE-2026-23253 | High | 7.8 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: fix wrong reinitialization of ringbuffer on reopen dvb_dvr_open() calls… |
CVE-2026-23252 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: xfs: get rid of the xchk_xfile_*_descr calls The xchk_xfile_*_descr macros call kasprintf… |
CVE-2026-23251 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: xfs: only call xf{array,blob}_destroy if we have a valid pointer Only call the xfarray an… |
CVE-2026-23250 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: xfs: check return value of xchk_scrub_create_subord Fix this function to return NULL inst… |
CVE-2026-23249 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: xfs: check for deleted cursors when revalidating two btrees The free space and inode btre… |
CVE-2026-32610 | High | 8.1 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuratio… |
CVE-2026-30695 | Medium | 6.1 | 2026-03-18 | A Cross-Site Scripting (XSS) vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices, including XA4, X3/X3BIO… |
CVE-2026-30345 | High | 7.5 | 2026-03-18 | A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitrary files outside the intended directori… |
CVE-2026-1463 | High | 8.8 | 2026-03-18 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includi… |
CVE-2026-3090 | High | 7.2 | 2026-03-18 | The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored… |
CVE-2026-33004 | Medium | 4.3 | 2026-03-18 | Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential for attackers to ob… |
CVE-2026-33003 | Medium | 4.3 | 2026-03-18 | Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by us… |
CVE-2026-33002 | High | 7.5 | 2026-03-18 | Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebS… |
CVE-2026-33001 | High | 8.8 | 2026-03-18 | Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted a… |
CVE-2026-2992 | High | 8.2 | 2026-03-18 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the `/wp-jso… |
CVE-2026-2991 | High | 7.3 | 2026-03-18 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2… |
CVE-2026-2559 | Medium | 5.3 | 2026-03-18 | The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `handle_office365_oauth_redirect… |
CVE-2026-2512 | Medium | 6.4 | 2026-03-18 | The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field meta values in all versions up to, and including, 2.5.1. This… |
CVE-2026-24063 | High | 8.2 | 2026-03-18 | When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written… |
CVE-2026-24062 | High | 7.8 | 2026-03-18 | The "Privileged Helper" component of the Arturia Software Center (MacOS) does not perform sufficient client code signature validation when a client connects. T… |
CVE-2026-32609 | High | 7.5 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on… |
CVE-2026-3278 | Medium | 6.1 | 2026-03-18 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ ZENworks Service Desk allows Cross-Site Scripti… |
CVE-2026-32694 | Medium | 6.6 | 2026-03-18 | In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictabl… |
CVE-2026-25449 | Critical | 9.8 | 2026-03-18 | Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1. |
CVE-2026-32693 | High | 8.8 | 2026-03-18 | In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret c… |
CVE-2026-32692 | High | 7.6 | 2026-03-18 | An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to… |
CVE-2026-32691 | Medium | 5.3 | 2026-03-18 | A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly ini… |
CVE-2026-33265 | Medium | 6.3 | 2026-03-18 | In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API. |
CVE-2026-23248 | High | 7.8 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix refcount bug and potential UAF in perf_mmap Syzkaller reported a refcount_… |
CVE-2026-23247 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: tcp: secure_seq: add back ports to TS offset This reverts 28ee1b746f49 ("secure_seq: down… |
CVE-2026-23246 | High | 8.8 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration link_id is taken fro… |
CVE-2026-23245 | High | 7.8 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gate: snapshot parameters with RCU on replace The gate action can be repla… |
CVE-2026-23244 | High | 7.1 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: nvme: fix memory allocation in nvme_pr_read_keys() nvme_pr_read_keys() takes num_keys fro… |
CVE-2026-23243 | High | 7.8 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from… |
CVE-2026-23242 | High | 7.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix potential NULL pointer dereference in header processing If siw_get_hdr() re… |
CVE-2026-32565 | Medium | 5.3 | 2026-03-18 | Missing Authorization vulnerability in Ajay Contextual Related Posts contextual-related-posts allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-1217 | Medium | 5.4 | 2026-03-18 | The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_han… |
CVE-2026-22730 | High | 8.8 | 2026-03-18 | A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute ar… |
CVE-2026-22729 | High | 8.6 | 2026-03-18 | A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through… |
CVE-2026-22323 | High | 7.1 | 2026-03-18 | A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users into sending unauth… |
CVE-2026-22322 | High | 7.1 | 2026-03-18 | A stored cross‑site scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to create a trunk e… |
CVE-2026-22321 | Medium | 5.3 | 2026-03-18 | A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send an oversized or unexpected username inpu… |
CVE-2026-22320 | Medium | 6.5 | 2026-03-18 | A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker with Telnet/SSH access to trigger memory corrup… |
CVE-2026-22319 | Medium | 4.9 | 2026-03-18 | A stack-based buffer overflow in the device's file installation workflow allows a high-privileged attacker to send oversized POST parameters that overflow a fi… |
CVE-2026-22318 | Medium | 4.9 | 2026-03-18 | A stack-based buffer overflow vulnerability in the device's file transfer parameter workflow allows a high-privileged attacker to send oversized POST parameter… |
CVE-2026-22317 | High | 7.2 | 2026-03-18 | A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests th… |
CVE-2026-22316 | Medium | 6.5 | 2026-03-18 | A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, res… |
CVE-2026-3512 | Medium | 6.1 | 2026-03-18 | The Writeprint Stylometry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'p' GET parameter in all versions up to and including 0… |
CVE-2026-32608 | High | 7.0 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when… |
CVE-2026-32606 | High | 7.6 | 2026-03-18 | IncusOS is an immutable OS image dedicated to running Incus. Prior to 202603142010, the default configuration of systemd-cryptenroll as used by IncusOS through… |
CVE-2026-32596 | High | 7.5 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `g… |
CVE-2026-32268 | | 2026-03-18 | The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.1.1, unauthentic… | |
CVE-2026-4366 | Medium | 5.8 | 2026-03-18 | A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client config… |