2026 CVEs (page 374)
Page 374 of 448 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32254 | High | 7.1 | 2026-03-18 | Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router's proxy module does not validate externalIPs or loadBalancer I… |
CVE-2026-31938 | Critical | 9.6 | 2026-03-18 | jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to… |
CVE-2026-31898 | High | 8.1 | 2026-03-18 | jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject ar… |
CVE-2026-31891 | High | 7.7 | 2026-03-18 | Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected by… |
CVE-2026-31865 | Medium | 6.5 | 2026-03-18 | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an El… |
CVE-2026-30922 | High | 7.5 | 2026-03-18 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled rec… |
CVE-2026-30884 | Critical | 9.6 | 2026-03-18 | mdjnelson/moodle-mod_customcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser. Prior to ve… |
CVE-2026-2575 | Medium | 5.3 | 2026-03-18 | A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRe… |
CVE-2026-29112 | High | 7.5 | 2026-03-18 | DiceBear is an avatar library for designers and developers. Prior to version 9.4.0, the `ensureSize()` function in `@dicebear/converter` read the `width` and `… |
CVE-2026-1926 | Medium | 5.3 | 2026-03-18 | The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `wps_sfw_adm… |
CVE-2026-1780 | Medium | 6.1 | 2026-03-18 | The [CR]Paid Link Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL path in all versions up to, and including, 0.5 due t… |
CVE-2026-4356 | Low | 2.4 | 2026-03-18 | A flaw has been found in itsourcecode University Management System 1.0. Affected is an unknown function of the file /add_result.php. Executing a manipulation o… |
CVE-2026-4268 | Medium | 6.4 | 2026-03-18 | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpgmza_custom_js’ parameter in all versions… |
CVE-2026-2603 | High | 8.1 | 2026-03-18 | A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the… |
CVE-2026-2092 | High | 7.7 | 2026-03-18 | A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the ove… |
CVE-2026-29056 | High | 8.8 | 2026-03-18 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registration endpoint (`UserInviteController::re… |
CVE-2026-28500 | High | 8.6 | 2026-03-18 | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypas… |
CVE-2026-28499 | Medium | 6.1 | 2026-03-18 | LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection… |
CVE-2026-27545 | Medium | 6.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute commands from unintended… |
CVE-2026-27524 | Medium | 4.3 | 2026-03-18 | OpenClaw versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set override object values, allowing prototype pollution attacks. Authori… |
CVE-2026-27523 | Medium | 6.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.24 contain a sandbox bind validation vulnerability allowing attackers to bypass allowed-root and blocked-path checks via syml… |
CVE-2026-27522 | Medium | 6.5 | 2026-03-18 | OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is uns… |
CVE-2026-22217 | Medium | 6.1 | 2026-03-18 | OpenClaw version 2026.2.22 prior to 2026.2.23 contains an arbitrary code execution vulnerability in shell-env that allows attackers to execute attacker-control… |
CVE-2026-22181 | High | 7.6 | 2026-03-18 | OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allows attackers to circumvent SSRF guards when e… |
CVE-2026-22180 | Medium | 5.3 | 2026-03-18 | OpenClaw versions prior to 2026.3.2 contain a path-confinement bypass vulnerability in browser output handling that allows writes outside intended root directo… |
CVE-2026-22179 | High | 7.2 | 2026-03-18 | OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowl… |
CVE-2026-22178 | Medium | 6.5 | 2026-03-18 | OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex i… |
CVE-2026-22177 | Medium | 6.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution… |
CVE-2026-22175 | High | 7.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.23 contain an exec approval bypass vulnerability in allowlist mode where allow-always grants could be circumvented through un… |
CVE-2026-22174 | Medium | 6.8 | 2026-03-18 | OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loopback interfaces, allowing local processes to… |
CVE-2026-22171 | High | 8.2 | 2026-03-18 | OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated direc… |
CVE-2026-22170 | Medium | 6.5 | 2026-03-18 | OpenClaw versions prior to 2026.2.22 with the optional BlueBubbles plugin contain an access control bypass vulnerability where empty allowFrom configuration ca… |
CVE-2026-22169 | Medium | 6.7 | 2026-03-18 | OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows attackers to invoke external helpers t… |
CVE-2026-22168 | Medium | 6.5 | 2026-03-18 | OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrar… |
CVE-2026-29057 | Medium | 6.5 | 2026-03-18 | Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrite… |
CVE-2026-28674 | High | 7.2 | 2026-03-18 | xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the `AdminPaymentPluginUpload… |
CVE-2026-28673 | High | 7.2 | 2026-03-18 | xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system al… |
CVE-2026-27980 | High | 7.5 | 2026-03-18 | Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimi… |
CVE-2026-27979 | High | 7.5 | 2026-03-18 | Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the `next-r… |
CVE-2026-4355 | Low | 3.5 | 2026-03-18 | A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar_servidor_curso_lst.php of the component… |
CVE-2026-4354 | Low | 3.5 | 2026-03-18 | A vulnerability was identified in TRENDnet TEW-824DRU 1.010B01/1.04B01. The impacted element is the function sub_420A78 of the file apply_sec.cgi of the compon… |
CVE-2026-27978 | Medium | 4.3 | 2026-03-18 | Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, `origin: null` was treated as a… |
CVE-2026-27977 | Medium | 5.4 | 2026-03-18 | Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protec… |
CVE-2026-27895 | Medium | 4.3 | 2026-03-18 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF… |
CVE-2026-27894 | High | 8.8 | 2026-03-18 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local… |
CVE-2026-27811 | High | 8.8 | 2026-03-18 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in th… |
CVE-2026-27459 | Critical | 9.8 | 2026-03-18 | pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_ge… |
CVE-2026-27448 | Medium | 5.3 | 2026-03-18 | pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_se… |
CVE-2026-26004 | Medium | 6.5 | 2026-03-18 | Sentry is a developer-first error tracking and performance monitoring tool. Versions prior to 26.1.0 have a cross-organization Insecure Direct Object Reference… |
CVE-2026-26001 | High | 7.1 | 2026-03-18 | The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user in… |
CVE-2026-25937 | Medium | 6.5 | 2026-03-18 | GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's c… |
CVE-2026-3856 | Medium | 5.3 | 2026-03-17 | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 could allow an attacker to modify or corrupt data due to an insecure mechanism used for verifying… |
CVE-2026-22727 | High | 7.5 | 2026-03-17 | Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on all platforms allows any user who has by… |
CVE-2026-21994 | Critical | 9.8 | 2026-03-17 | Vulnerability in the Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit product of Oracle Open Source Projects (component: Desktop). The sup… |
CVE-2026-20643 | Medium | 5.4 | 2026-03-17 | A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadO… |
CVE-2026-1264 | High | 7.1 | 2026-03-17 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 allows a… |
CVE-2026-4349 | Medium | 5.6 | 2026-03-17 | A vulnerability was determined in Duende IdentityServer4 up to 4.1.2. The affected element is an unknown function of the file /connect/authorize of the compone… |
CVE-2026-32842 | Medium | 6.5 | 2026-03-17 | Edimax GS-5008PL firmware version 1.00.54 and prior contain an insecure credential storage vulnerability that allows attackers to obtain administrator credenti… |
CVE-2026-32841 | High | 8.1 | 2026-03-17 | Edimax GS-5008PL firmware versions 1.00.54 and prior contain an authentication bypass vulnerability that allows unauthenticated attackers to access the managem… |
CVE-2026-32840 | Medium | 5.4 | 2026-03-17 | Edimax GS-5008PL firmware version 1.00.54 and prior contain a stored cross-site scripting vulnerability in the system_name_set.cgi script that allows attackers… |
CVE-2026-32839 | Medium | 4.3 | 2026-03-17 | Edimax GS-5008PL firmware version 1.00.54 and prior contain a cross-site request forgery vulnerability that allows remote attackers to perform unauthorized adm… |
CVE-2026-32838 | High | 7.5 | 2026-03-17 | Edimax GS-5008PL firmware version 1.00.54 and prior use cleartext HTTP for the web management interface without implementing TLS or SSL encryption. Attackers o… |
CVE-2026-1376 | High | 7.5 | 2026-03-17 | IBM i 7.6 could allow a remote attacker to cause a denial of service using failed authentication connections due to improper allocation of resources. |
CVE-2026-1267 | Medium | 6.5 | 2026-03-17 | IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to la… |
CVE-2026-2809 | | 2026-03-17 | Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can poten… | |
CVE-2026-4359 | Low | 2.0 | 2026-03-17 | A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C… |
CVE-2026-4358 | Medium | 6.4 | 2026-03-17 | A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the… |
CVE-2026-4295 | High | 7.8 | 2026-03-17 | Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat actor to execute ar… |
CVE-2026-4064 | High | 8.3 | 2026-03-17 | Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to by… |
CVE-2026-3563 | Medium | 5.5 | 2026-03-17 | Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to crea… |
CVE-2026-32981 | High | 7.5 | 2026-03-17 | A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization… |
CVE-2026-32837 | Medium | 4.0 | 2026-03-17 | miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser th… |
CVE-2026-32836 | Medium | 6.2 | 2026-03-17 | dr_libs dr_flac.h version 0.13.3 and earlier (fixed in commits fefced4, 4f5a4cd, and 663239a) contain an uncontrolled memory allocation vulnerability in drflac… |
CVE-2026-30707 | High | 8.1 | 2026-03-17 | An issue was discovered in SpeedExam Online Examination System (SaaS) after v.FEV2026. It allows Broken Access Control via the ReviewAnswerDetails ASP.NET Page… |
CVE-2026-25936 | Medium | 6.5 | 2026-03-17 | GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injecti… |
CVE-2026-3207 | Critical | 9.8 | 2026-03-17 | Configuration issue in Java Management Extensions (JMX) in TIBCO BPM Enterprise version 4.x allows unauthorised access. |
CVE-2026-25790 | Medium | 4.9 | 2026-03-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, multiple s… |
CVE-2026-25772 | Medium | 4.9 | 2026-03-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.14.3, a stack-ba… |
CVE-2026-25771 | Medium | 5.3 | 2026-03-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.3.0 and prior to version 4.14.3, a Denial o… |
CVE-2026-22882 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2026-20726 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2026-4319 | High | 7.3 | 2026-03-17 | A vulnerability was identified in code-projects Simple Food Order System 1.0. Affected by this vulnerability is an unknown functionality of the file /routers/a… |
CVE-2026-32298 | Critical | 9.1 | 2026-03-17 | The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level co… |
CVE-2026-32297 | High | 7.5 | 2026-03-17 | The Angeet ES3 KVM allows a remote, unauthenticated attacker to write arbitrary files, including configuration files or system binaries. Modified configuration… |
CVE-2026-32296 | High | 8.2 | 2026-03-17 | Sipeed NanoKVM before 2.3.1 exposes a Wi-Fi configuration endpoint without proper security checks, allowing an unauthenticated attacker with network access to… |
CVE-2026-32295 | High | 7.5 | 2026-03-17 | JetKVM before 0.5.4 does not rate limit login requests, enabling brute-force attempts to guess credentials. |
CVE-2026-32294 | Medium | 4.7 | 2026-03-17 | JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. An attacker-in-the-middle or a compromised update server could modify the… |
CVE-2026-32293 | Low | 3.7 | 2026-03-17 | The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used… |
CVE-2026-32292 | High | 7.5 | 2026-03-17 | The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials. |
CVE-2026-32291 | Medium | 6.8 | 2026-03-17 | The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and… |
CVE-2026-32290 | Medium | 4.7 | 2026-03-17 | The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a co… |
CVE-2026-25770 | Critical | 9.1 | 2026-03-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privileg… |
CVE-2026-25769 | Critical | 9.1 | 2026-03-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution (RCE)… |
CVE-2026-25534 | Critical | 9.1 | 2026-03-17 | ### Impact Spinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver. However, they missed that Java UR… |
CVE-2026-21570 | High | 8.8 | 2026-03-17 | This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of B… |
CVE-2026-4148 | High | 8.8 | 2026-03-17 | A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $grap… |
CVE-2026-4147 | Medium | 6.5 | 2026-03-17 | An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command. |
CVE-2026-28506 | Medium | 4.3 | 2026-03-17 | Outline is a service that allows for collaborative documentation. Prior to 1.5.0, the events.list API endpoint, used for retrieving activity logs, contains a l… |
CVE-2026-24901 | High | 8.1 | 2026-03-17 | Outline is a service that allows for collaborative documentation. Prior to 1.4.0, an Insecure Direct Object Reference (IDOR) vulnerability in the document rest… |
CVE-2026-23759 | High | 7.2 | 2026-03-17 | Perle IOLAN STS/SCS terminal server models with firmware versions prior to 6.0 allow authenticated OS command injection via the restricted shell accessed over… |