2026 CVEs (page 377)
Page 377 of 448 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32630 | Medium | 5.3 | 2026-03-16 | file-type detects the file type of a file, stream, or data. From 20.0.0 to 21.3.1, a crafted ZIP file can trigger excessive memory growth during type detection… |
CVE-2026-32628 | High | 8.8 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, a SQL inject… |
CVE-2026-32627 | High | 8.7 | 2026-03-16 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set… |
CVE-2026-32626 | Critical | 9.6 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, AnythingLLM… |
CVE-2026-32621 | Critical | 9.9 | 2026-03-16 | Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability… |
CVE-2026-32617 | High | 7.1 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, On default i… |
CVE-2026-32616 | High | 8.2 | 2026-03-16 | Pigeon is a message board/notepad/social system/blog. Prior to 1.0.201, the application uses $_SERVER['HTTP_HOST'] without validation to construct email verifi… |
CVE-2026-32614 | High | 7.5 | 2026-03-16 | Go ShangMi (Commercial Cryptography) Library (GMSM) is a cryptographic library that covers the Chinese commercial cryptographic public algorithms SM2/SM3/SM4/S… |
CVE-2026-32600 | High | 8.2 | 2026-03-16 | xml-security is a library that implements XML signatures and encryption. Prior to versions 2.3.1 and 1.13.9, XML nodes encrypted with either aes-128-gcm, aes-1… |
CVE-2026-32594 | High | 7.3 | 2026-03-16 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.40 and 9.6.0-alpha.14, the GraphQL WebSock… |
CVE-2026-32314 | High | 7.5 | 2026-03-16 | Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing a… |
CVE-2026-32313 | High | 8.2 | 2026-03-16 | xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. Prior to 3.1.5, XML nodes encrypted with either aes-128-gcm, aes-192-gcm… |
CVE-2026-31386 | High | 7.2 | 2026-03-16 | OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by… |
CVE-2026-2923 | High | 7.8 | 2026-03-16 | GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affect… |
CVE-2026-2922 | High | 7.8 | 2026-03-16 | GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af… |
CVE-2026-2921 | High | 7.8 | 2026-03-16 | GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected i… |
CVE-2026-2920 | High | 7.8 | 2026-03-16 | GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-2578 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members to access unreveale… |
CVE-2026-2493 | High | 7.5 | 2026-03-16 | IceWarp collaboration Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on… |
CVE-2026-2491 | Medium | 6.3 | 2026-03-16 | Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected inst… |
CVE-2026-2476 | High | 7.6 | 2026-03-16 | Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain or… |
CVE-2026-2463 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, which allows regular users to… |
CVE-2026-2462 | Medium | 6.6 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to restrict plugin installation on CI test instances with default admin creden… |
CVE-2026-2461 | Medium | 4.3 | 2026-03-16 | Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised a… |
CVE-2026-2458 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate team membership when searching channels which allows a re… |
CVE-2026-2457 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata which allows an authenticated attack… |
CVE-2026-2456 | Medium | 5.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints… |
CVE-2026-2233 | Medium | 5.3 | 2026-03-16 | The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modi… |
CVE-2026-28522 | Medium | 6.5 | 2026-03-16 | arduino-TuyaOpen before version 1.2.1 contains a null pointer dereference vulnerability in the WiFiUDP component. An attacker on the same local area network ca… |
CVE-2026-28521 | High | 7.7 | 2026-03-16 | arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component. An attacker who hijacks or controls the Tuy… |
CVE-2026-28520 | High | 8.4 | 2026-03-16 | arduino-TuyaOpen before version 1.2.1 contains a single-byte buffer overflow vulnerability in the WiFiMulti component. When the victim's smart hardware connect… |
CVE-2026-28519 | High | 8.8 | 2026-03-16 | arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer component. An attacker on the same local area networ… |
CVE-2026-26246 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files which allows an aut… |
CVE-2026-26133 | High | 7.1 | 2026-03-16 | AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2026-25783 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated at… |
CVE-2026-25780 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing DOC files which allows an authentic… |
CVE-2026-25083 | High | 8.3 | 2026-03-16 | GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows a shared AI assist… |
CVE-2026-24458 | High | 7.5 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long passwords, which allows an attacker to overload t… |
CVE-2026-21005 | Medium | 6.5 | 2026-03-16 | Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilege. |
CVE-2026-21004 | Medium | 6.5 | 2026-03-16 | Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service. |
CVE-2026-21002 | Medium | 5.5 | 2026-03-16 | Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary application. |
CVE-2026-21001 | Medium | 5.5 | 2026-03-16 | Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege. |
CVE-2026-21000 | Medium | 5.5 | 2026-03-16 | Improper access control in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege. |
CVE-2026-20999 | High | 7.5 | 2026-03-16 | Authentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote attackers to trigger privileged functions. |
CVE-2026-20998 | Critical | 9.8 | 2026-03-16 | Improper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication. |
CVE-2026-20997 | Critical | 9.8 | 2026-03-16 | Improper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15 allows remote attackers to potentially bypass authentication. |
CVE-2026-20996 | Medium | 5.3 | 2026-03-16 | Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.69.15 allows remote attackers to configure a downgraded scheme for authen… |
CVE-2026-20995 | Medium | 5.3 | 2026-03-16 | Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a specific configuration. |
CVE-2026-20994 | Medium | 6.1 | 2026-03-16 | URL redirection in Samsung Account prior to version 15.5.01.1 allows local attackers to potentially get access token. |
CVE-2026-20993 | Medium | 5.5 | 2026-03-16 | Improper export of android application components in Samsung Assistant prior to version 9.3.10.7 allows local attacker to access saved information. |
CVE-2026-20992 | Low | 3.3 | 2026-03-16 | Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application. |
CVE-2026-20991 | Medium | 4.4 | 2026-03-16 | Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents. |
CVE-2026-20990 | High | 8.1 | 2026-03-16 | Improper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local attackers to launch arbitrary activity with Sec… |
CVE-2026-20989 | Low | 2.4 | 2026-03-16 | Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom font. |
CVE-2026-20988 | Medium | 5.0 | 2026-03-16 | Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary activity with Setti… |
CVE-2026-1948 | Medium | 4.3 | 2026-03-16 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2026-1947 | High | 7.5 | 2026-03-16 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including… |
CVE-2026-1883 | Medium | 4.3 | 2026-03-16 | The Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types plugin for WordPress is vulnerable to Insecure Direct Object Reference in all ver… |
CVE-2026-1870 | Medium | 5.3 | 2026-03-16 | The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing val… |
CVE-2026-0977 | Medium | 5.1 | 2026-03-16 | IBM CICS Transaction Gateway for Multiplatforms 9.3 and 10.1 could allow a user to transfer or view files due to improper access controls. |
CVE-2026-0849 | Low | 3.8 | 2026-03-16 | Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus… |
CVE-2026-0639 | Low | 3.3 | 2026-03-16 | in OpenHarmony v6.0 and prior versions allow a local attacker case DOS through missing release of memory. |
CVE-2026-0385 | Medium | 5.0 | 2026-03-16 | Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability |
CVE-2026-4111 | High | 7.5 | 2026-03-13 | A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a sp… |
CVE-2026-4105 | Medium | 6.7 | 2026-03-13 | A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class paramet… |
CVE-2026-4092 | High | 8.8 | 2026-03-13 | Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a malicious Google Apps Script project contain… |
CVE-2026-4063 | Medium | 4.3 | 2026-03-13 | The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the add_men… |
CVE-2026-3999 | High | 8.8 | 2026-03-13 | A broken access control may allow an authenticated user to perform a horizontal privilege escalation. The vulnerability only impacts specific configurations. |
CVE-2026-3986 | Medium | 6.4 | 2026-03-13 | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form settings in all versions up to, and including, 5.4.5… |
CVE-2026-3910 | High | 8.8 | 2026-03-13 | Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
CVE-2026-3909 | High | 8.8 | 2026-03-13 | Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (… |
CVE-2026-3891 | Critical | 9.8 | 2026-03-13 | The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'l… |
CVE-2026-3873 | High | 7.2 | 2026-03-13 | Use of Hard-coded Credentials vulnerability in Avantra allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Avantra: before 25… |
CVE-2026-3045 | High | 7.5 | 2026-03-13 | The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up… |
CVE-2026-32746 | Critical | 9.8 | 2026-03-13 | telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check… |
CVE-2026-32745 | Medium | 6.3 | 2026-03-13 | In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings |
CVE-2026-32612 | Medium | 5.4 | 2026-03-13 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticat… |
CVE-2026-32598 | Medium | 6.5 | 2026-03-13 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containin… |
CVE-2026-32597 | High | 7.5 | 2026-03-13 | PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11… |
CVE-2026-32543 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2026-32487 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in raratheme Lawyer Landing Page lawyer-landing-page allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2026-32486 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in wptravelengine Travel Booking travel-booking allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-32462 | Medium | 5.9 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons al… |
CVE-2026-32461 | Medium | 4.3 | 2026-03-13 | Missing Authorization vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-32460 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addo… |
CVE-2026-32459 | High | 7.6 | 2026-03-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows B… |
CVE-2026-32458 | High | 7.6 | 2026-03-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 WOLF bulk-editor allows Blind SQL Injection.Th… |
CVE-2026-32457 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in Wombat Plugins Advanced Product Fields (Product Addons) for WooCommerce advanced-product-fields-for-woocommerce allows E… |
CVE-2026-32456 | Medium | 4.3 | 2026-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor admin-menu-editor allows Cross Site Request Forgery.This issue affects Admin M… |
CVE-2026-32455 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter a… |
CVE-2026-32454 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Avada Core fusion-core allows DOM-Based XSS.T… |
CVE-2026-32453 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2026-32452 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-32451 | Medium | 6.5 | 2026-03-13 | Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-32450 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-… |
CVE-2026-32449 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post themify-event-post allows St… |
CVE-2026-32448 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting… |
CVE-2026-32447 | Medium | 4.3 | 2026-03-13 | Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-32446 | Medium | 4.3 | 2026-03-13 | Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-32445 | Low | 2.7 | 2026-03-13 | Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |