2026 CVEs (page 380)
Page 380 of 447 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4041 | High | 8.8 | 2026-03-12 | A security flaw has been discovered in Tenda i12 1.0.0.6(2204). Impacted is the function vos_strcpy of the file /goform/exeCommand. The manipulation of the arg… |
CVE-2026-28384 | | 2026-03-12 | An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daem… | |
CVE-2026-21671 | Critical | 9.1 | 2026-03-12 | A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments… |
CVE-2026-21670 | High | 7.7 | 2026-03-12 | A vulnerability allowing a low-privileged user to extract saved SSH credentials. |
CVE-2026-21669 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. |
CVE-2026-21668 | High | 8.8 | 2026-03-12 | A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository. |
CVE-2026-21667 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. |
CVE-2026-21666 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. |
CVE-2026-3099 | Medium | 5.8 | 2026-03-12 | A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or en… |
CVE-2026-2987 | Medium | 6.1 | 2026-03-12 | The Simple Ajax Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'c' parameter in versions up to, and including, 20260217 due to… |
CVE-2026-2514 | | 2026-03-12 | In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft mali… | |
CVE-2026-2513 | | 2026-03-12 | A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacke… | |
CVE-2026-0809 | | 2026-03-12 | Use of a custom token encoding algorithm in Streamsoft Prestiż software allows the value of the KSeF (Krajowy System e-Faktur) token to be guessed after analyz… | |
CVE-2026-4040 | Low | 3.3 | 2026-03-12 | A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The ma… |
CVE-2026-4039 | Medium | 6.3 | 2026-03-12 | A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler… |
CVE-2026-3989 | High | 7.8 | 2026-03-12 | SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by pr… |
CVE-2026-3060 | Critical | 9.8 | 2026-03-12 | SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes unt… |
CVE-2026-3059 | Critical | 9.8 | 2026-03-12 | SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pi… |
CVE-2026-3234 | Medium | 4.3 | 2026-03-12 | A flaw was found in mod_proxy_cluster. This vulnerability, a Carriage Return Line Feed (CRLF) injection in the decodeenc() function, allows a remote attacker… |
CVE-2026-2366 | Low | 3.1 | 2026-03-12 | A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative… |
CVE-2026-4016 | Medium | 5.3 | 2026-03-12 | A security vulnerability has been detected in GPAC 26.03-DEV. Affected by this vulnerability is the function svgin_process of the file src/filters/load_svg.c o… |
CVE-2026-4015 | Medium | 5.3 | 2026-03-12 | A weakness has been identified in GPAC 26.03-DEV. Affected is the function txtin_process_texml of the file src/filters/load_text.c of the component TeXML File… |
CVE-2026-4014 | High | 7.3 | 2026-03-12 | A security flaw has been discovered in itsourcecode Cafe Reservation System 1.0. This impacts an unknown function of the file /curvus2/signup.php of the compon… |
CVE-2026-4013 | Medium | 6.3 | 2026-03-12 | A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown function of the file add_admin.php… |
CVE-2026-4012 | Low | 3.3 | 2026-03-12 | A vulnerability was determined in rxi fe up to ed4cda96bd582cbb08520964ba627efb40f3dd91. The impacted element is the function read_ of the file src/fe.c. This… |
CVE-2026-4010 | Low | 3.3 | 2026-03-12 | A vulnerability was found in ThakeeNathees pocketlang up to cc73ca61b113d48ee130d837a7a8b145e41de5ce. The affected element is the function pkByteBufferAddStrin… |
CVE-2026-4009 | Low | 3.3 | 2026-03-12 | A vulnerability has been found in jarikomppa soloud up to 20200207. Impacted is the function drwav_read_pcm_frames_s16__msadpcm in the library src/audiosource/… |
CVE-2026-4008 | High | 8.8 | 2026-03-12 | A flaw has been found in Tenda W3 1.0.0.3(2204). This issue affects some unknown processing of the file /goform/wifiSSIDset of the component POST Parameter Han… |
CVE-2026-4007 | High | 8.8 | 2026-03-12 | A vulnerability was detected in Tenda W3 1.0.0.3(2204). This vulnerability affects unknown code of the file /goform/wifiSSIDget of the component POST Parameter… |
CVE-2026-3994 | Medium | 5.3 | 2026-03-12 | A vulnerability was detected in rui314 mold up to 2.40.4. This issue affects the function mold::ObjectFilemold::X86_64::initialize_sections of the file src/inp… |
CVE-2026-3993 | Medium | 4.3 | 2026-03-12 | A security vulnerability has been detected in itsourcecode Payroll Management System 1.0. This vulnerability affects unknown code of the file /manage_employee_… |
CVE-2026-3992 | Medium | 6.3 | 2026-03-12 | A weakness has been identified in CodeGenieApp serverless-express up to 4.17.1. This affects an unknown part of the file utils/dynamodb.ts of the component Use… |
CVE-2026-3990 | Medium | 4.3 | 2026-03-12 | A security flaw has been discovered in CesiumGS CesiumJS up to 1.137.0. Affected by this issue is some unknown functionality of the file Apps/Sandcastle/standa… |
CVE-2026-3984 | Low | 3.5 | 2026-03-12 | A weakness has been identified in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This vulnerability affects unknown code of the file… |
CVE-2026-3983 | Low | 3.5 | 2026-03-12 | A security flaw has been discovered in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This affects an unknown part of the file save-g… |
CVE-2026-2687 | Medium | 4.3 | 2026-03-12 | The Reading progressbar WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2026-3982 | Medium | 4.3 | 2026-03-12 | A vulnerability was determined in itsourcecode University Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_r… |
CVE-2026-3981 | High | 7.3 | 2026-03-12 | A vulnerability was found in itsourcecode Online Doctor Appointment System 1.0. Affected is an unknown function of the file /admin/doctor_action.php. Performin… |
CVE-2026-3980 | High | 7.3 | 2026-03-12 | A vulnerability has been found in itsourcecode Online Doctor Appointment System 1.0. This impacts an unknown function of the file /admin/patient_action.php. Su… |
CVE-2026-3979 | Medium | 5.3 | 2026-03-12 | A flaw has been found in quickjs-ng quickjs up to 0.12.1. This affects the function js_iterator_concat_return of the file quickjs.c. This manipulation causes u… |
CVE-2026-3978 | High | 8.8 | 2026-03-12 | A vulnerability was detected in D-Link DIR-513 1.10. The impacted element is an unknown function of the file /goform/formEasySetupWizard3. The manipulation of… |
CVE-2026-3977 | Medium | 6.3 | 2026-03-12 | A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipul… |
CVE-2026-3976 | High | 8.8 | 2026-03-12 | A weakness has been identified in Tenda W3 1.0.0.3(2204). Impacted is the function formWifiMacFilterSet of the file /goform/WifiMacFilterSet of the component P… |
CVE-2026-3975 | High | 8.8 | 2026-03-12 | A security flaw has been discovered in Tenda W3 1.0.0.3(2204). This issue affects the function formWifiMacFilterGet of the file /goform/WifiMacFilterGet of the… |
CVE-2026-3974 | High | 8.8 | 2026-03-12 | A vulnerability was identified in Tenda W3 1.0.0.3(2204). This vulnerability affects the function formexeCommand of the file /goform/exeCommand of the componen… |
CVE-2026-3657 | High | 7.5 | 2026-03-12 | The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX action in all versions up to, and including… |
CVE-2026-3226 | Medium | 4.3 | 2026-03-12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all… |
CVE-2026-1878 | | 2026-03-12 | An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM. The vulnerab… | |
CVE-2026-3973 | High | 8.8 | 2026-03-12 | A vulnerability was determined in Tenda W3 1.0.0.3(2204). This affects the function formSetAutoPing of the file /goform/setAutoPing of the component POST Param… |
CVE-2026-3972 | High | 8.8 | 2026-03-12 | A vulnerability was found in Tenda W3 1.0.0.3(2204). Affected by this issue is the function formSetCfm of the file /goform/setcfm of the component HTTP Handler… |
CVE-2026-1182 | Medium | 4.3 | 2026-03-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allow… |
CVE-2026-3971 | High | 8.8 | 2026-03-12 | A vulnerability has been found in Tenda i3 1.0.0.6(2204). Affected by this vulnerability is the function formwrlSSIDset of the file /goform/wifiSSIDset. The ma… |
CVE-2026-3970 | High | 8.8 | 2026-03-12 | A flaw has been found in Tenda i3 1.0.0.6(2204). Affected is the function formwrlSSIDget of the file /goform/wifiSSIDget. Executing a manipulation of the argum… |
CVE-2026-3969 | High | 7.3 | 2026-03-12 | A vulnerability was detected in FeMiner wms up to 1.0. This impacts an unknown function of the file /wms-master/src/basic/depart/depart_add_bg.php of the compo… |
CVE-2026-3968 | Medium | 6.3 | 2026-03-12 | A vulnerability has been found in AutohomeCorp frostmourne up to 1.0. This affects the function scriptEngine.eval of the file ExpressionRule.java of the compon… |
CVE-2026-3967 | Medium | 6.3 | 2026-03-12 | A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-co… |
CVE-2026-3966 | Medium | 6.3 | 2026-03-12 | A vulnerability was detected in 648540858 wvp-GB28181-pro up to 2.7.4-20260107. Affected by this vulnerability is the function getDownloadFilePath of the file… |
CVE-2026-3965 | Medium | 6.3 | 2026-03-12 | A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the componen… |
CVE-2026-2808 | Medium | 6.8 | 2026-03-12 | HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. T… |
CVE-2026-3964 | Medium | 5.3 | 2026-03-11 | A weakness has been identified in OpenAkita up to 1.24.3. This impacts the function run of the file src/openakita/tools/shell.py of the component Chat API Endp… |
CVE-2026-3963 | Low | 3.7 | 2026-03-11 | A security flaw has been discovered in perfree go-fastdfs-web up to 1.3.7. This affects the function rememberMeManager of the file src/main/java/com/perfree/co… |
CVE-2026-3962 | Medium | 4.3 | 2026-03-11 | A vulnerability was identified in Jcharis Machine-Learning-Web-Apps up to a6996b634d98ccec4701ac8934016e8175b60eb5. The impacted element is the function render… |
CVE-2026-31988 | Medium | 5.3 | 2026-03-11 | yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLa… |
CVE-2026-3961 | Medium | 6.3 | 2026-03-11 | A vulnerability was determined in zyddnys manga-image-translator up to beta-0.3. The affected element is the function to_pil_image of the file manga-image-tran… |
CVE-2026-3959 | Medium | 5.3 | 2026-03-11 | A vulnerability was found in 0xKoda WireMCP up to 7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e. Impacted is the function server.tool of the file index.js of the co… |
CVE-2026-3958 | Medium | 6.3 | 2026-03-11 | A vulnerability has been found in Woahai321 ListSync up to 0.6.6. This issue affects the function requests.post of the file list-sync-main/api_server.py of the… |
CVE-2026-3942 | Medium | 4.3 | 2026-03-11 | Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-3941 | Medium | 4.3 | 2026-03-11 | Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2026-3940 | Medium | 5.3 | 2026-03-11 | Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2026-3939 | Medium | 5.3 | 2026-03-11 | Insufficient policy enforcement in PDF in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted PDF fi… |
CVE-2026-3938 | Medium | 4.3 | 2026-03-11 | Insufficient policy enforcement in Clipboard in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the renderer process to leak… |
CVE-2026-3937 | Medium | 6.5 | 2026-03-11 | Incorrect security UI in Downloads in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page… |
CVE-2026-3936 | High | 8.8 | 2026-03-11 | Use after free in WebView in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2026-3935 | Medium | 6.5 | 2026-03-11 | Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chro… |
CVE-2026-3934 | Medium | 6.5 | 2026-03-11 | Insufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass same origin policy via a crafted HT… |
CVE-2026-3932 | High | 7.5 | 2026-03-11 | Insufficient policy enforcement in PDF in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a cra… |
CVE-2026-3931 | High | 8.8 | 2026-03-11 | Heap buffer overflow in Skia in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page… |
CVE-2026-3930 | Medium | 5.3 | 2026-03-11 | Unsafe navigation in Navigation in Google Chrome on iOS prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML p… |
CVE-2026-3929 | Low | 3.1 | 2026-03-11 | Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2026-3928 | Medium | 4.3 | 2026-03-11 | Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-3927 | Medium | 4.3 | 2026-03-11 | Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-3926 | High | 8.8 | 2026-03-11 | Out of bounds read in V8 in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chr… |
CVE-2026-3925 | Medium | 4.3 | 2026-03-11 | Incorrect security UI in LookalikeChecks in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML… |
CVE-2026-3924 | High | 7.5 | 2026-03-11 | use after free in WindowDialog in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the renderer process to potentially perfor… |
CVE-2026-3923 | High | 8.8 | 2026-03-11 | Use after free in WebMIDI in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2026-3922 | High | 8.8 | 2026-03-11 | Use after free in MediaStream in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-3921 | High | 8.8 | 2026-03-11 | Use after free in TextEncoding in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-3920 | High | 8.8 | 2026-03-11 | Out of bounds memory access in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2026-3919 | High | 8.8 | 2026-03-11 | Use after free in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension to potentially e… |
CVE-2026-3918 | High | 8.8 | 2026-03-11 | Use after free in WebMCP in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2026-3917 | High | 8.8 | 2026-03-11 | Use after free in Agents in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2026-3916 | Critical | 9.6 | 2026-03-11 | Out of bounds read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML p… |
CVE-2026-3915 | High | 8.8 | 2026-03-11 | Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2026-3914 | High | 8.8 | 2026-03-11 | Integer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2026-3913 | High | 8.8 | 2026-03-11 | Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-32136 | Critical | 9.8 | 2026-03-11 | AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.73, an unauthenticated remote attacker can bypass all authentication in A… |
CVE-2026-32133 | Critical | 9.1 | 2026-03-11 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in… |
CVE-2026-32132 | High | 7.4 | 2026-03-11 | ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints… |
CVE-2026-32131 | High | 7.7 | 2026-03-11 | ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a vulnerability in Zitadel's Management API has been reported, which allowed… |
CVE-2026-32130 | High | 7.5 | 2026-03-11 | ZITADEL is an open source identity management platform. From 2.68.0 to before 3.4.8 and 4.12.2, Zitadel provides a System for Cross-domain Identity Management… |