2026 CVEs (page 384)
Page 384 of 447 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-30985 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow write in C… |
CVE-2026-30984 | Medium | 6.1 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CIccCalcul… |
CVE-2026-30983 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow in icFixXml() (… |
CVE-2026-30982 | Medium | 6.1 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CIccPcsXfo… |
CVE-2026-30981 | Medium | 6.1 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-buffer-overflow read in CIccXmlA… |
CVE-2026-30980 | Medium | 5.5 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack overflow in CIccBasicStructFact… |
CVE-2026-30979 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow in CIccCal… |
CVE-2026-30978 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-use-after-free in CIccCmm::AddXf… |
CVE-2026-30977 | | 2026-03-10 | RenderBlocking is a MediaWiki extension that allows interface administrators to specify render-blocking CSS and JavaScript. Prior to 0.1.1, there is Stored XSS… | |
CVE-2026-30974 | Medium | 4.6 | 2026-03-10 | Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did… |
CVE-2026-30973 | Medium | 6.5 | 2026-03-10 | Appium is an automation framework that provides WebDriver-based automation possibilities for a wide range platforms. Prior to 7.0.6, @appium/support contains a… |
CVE-2026-30970 | Critical | 9.1 | 2026-03-10 | Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Cora… |
CVE-2026-30969 | Critical | 9.1 | 2026-03-10 | Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Cora… |
CVE-2026-30968 | Critical | 9.8 | 2026-03-10 | Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, the… |
CVE-2026-30964 | Medium | 5.4 | 2026-03-10 | web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web… |
CVE-2026-30960 | | 2026-03-10 | rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulation… | |
CVE-2026-30959 | Medium | 5.0 | 2026-03-10 | OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verificat… |
CVE-2026-30958 | High | 7.2 | 2026-03-10 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName e… |
CVE-2026-30957 | Critical | 9.9 | 2026-03-10 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, OneUptime Synthetic Monitors allow a low-privileged authenticated projec… |
CVE-2026-30956 | Critical | 9.9 | 2026-03-10 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in O… |
CVE-2026-30945 | High | 7.1 | 2026-03-10 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint… |
CVE-2026-30944 | High | 8.8 | 2026-03-10 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows… |
CVE-2026-30942 | Medium | 6.5 | 2026-03-10 | Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to 1.7.3, an authenticated path traversal vulnerabil… |
CVE-2026-30941 | High | 7.5 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.14 and 9.5.2-alpha.1, NoSQL injection vuln… |
CVE-2026-30939 | High | 7.5 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.13 and 9.5.1-alpha.2, an unauthenticated a… |
CVE-2026-30938 | Medium | 5.3 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.12 and 9.5.1-alpha.1, the requestKeywordDe… |
CVE-2026-30934 | High | 8.9 | 2026-03-10 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, Stored XSS is possible via share metadata fields (e.g… |
CVE-2026-30933 | High | 7.5 | 2026-03-10 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Pas… |
CVE-2026-30930 | Critical | 9.8 | 2026-03-10 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenatio… |
CVE-2026-30928 | High | 7.5 | 2026-03-10 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configur… |
CVE-2026-30897 | Medium | 6.6 | 2026-03-10 | A stack-based buffer overflow vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2… |
CVE-2026-2742 | Medium | 5.3 | 2026-03-10 | An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applica… |
CVE-2026-2741 | Medium | 6.8 | 2026-03-10 | Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 thr… |
CVE-2026-2724 | High | 7.2 | 2026-03-10 | The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form entry fields in all versions up to, and inc… |
CVE-2026-2339 | High | 7.5 | 2026-03-10 | Missing Authentication for Critical Function vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Remote Code Inclusion… |
CVE-2026-2273 | High | 8.2 | 2026-03-10 | CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause execution of untrusted commands on the engineering works… |
CVE-2026-27661 | Medium | 4.3 | 2026-03-10 | A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application leaks confidential information in metadata, and… |
CVE-2026-26738 | High | 7.8 | 2026-03-10 | Buffer Overflow vulnerability in Uderzo Software SpaceSniffer v.2.0.5.18 allows a remote attacker to execute arbitrary code via a crafted .sns snapshot file. |
CVE-2026-26148 | High | 8.1 | 2026-03-10 | External initialization of trusted variables or data stores in Azure Entra ID allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-26144 | High | 7.5 | 2026-03-10 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an unauthorized attacker to disclose info… |
CVE-2026-26141 | High | 7.8 | 2026-03-10 | Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally. |
CVE-2026-26134 | High | 7.8 | 2026-03-10 | Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally. |
CVE-2026-26132 | High | 7.8 | 2026-03-10 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-26131 | High | 7.8 | 2026-03-10 | Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally. |
CVE-2026-26130 | High | 7.5 | 2026-03-10 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-26128 | High | 7.8 | 2026-03-10 | Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-26127 | High | 7.5 | 2026-03-10 | Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-26121 | High | 7.5 | 2026-03-10 | Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-26118 | High | 8.8 | 2026-03-10 | Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-26117 | High | 7.8 | 2026-03-10 | Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally. |
CVE-2026-26116 | High | 8.8 | 2026-03-10 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2026-26115 | High | 8.8 | 2026-03-10 | Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-26114 | High | 8.8 | 2026-03-10 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-26113 | High | 8.4 | 2026-03-10 | Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-26112 | High | 7.8 | 2026-03-10 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-26111 | High | 8.0 | 2026-03-10 | Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2026-26110 | High | 8.4 | 2026-03-10 | Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-26109 | High | 8.4 | 2026-03-10 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-26108 | High | 7.8 | 2026-03-10 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-26107 | High | 7.8 | 2026-03-10 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-26106 | High | 8.8 | 2026-03-10 | Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-26105 | High | 8.1 | 2026-03-10 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform… |
CVE-2026-25972 | Medium | 4.3 | 2026-03-10 | An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3… |
CVE-2026-25836 | High | 7.2 | 2026-03-10 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox… |
CVE-2026-25689 | Medium | 6.5 | 2026-03-10 | An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeceptor 6.0 all vers… |
CVE-2026-25605 | Medium | 6.7 | 2026-03-10 | A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application performs file deletion without properly validating the… |
CVE-2026-25573 | High | 7.4 | 2026-03-10 | A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application builds shell commands with caller-provided strings and… |
CVE-2026-25572 | Medium | 5.1 | 2026-03-10 | A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The SICAM SIAPP SDK server component does not enforce maximum length checks on… |
CVE-2026-25571 | Medium | 5.1 | 2026-03-10 | A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The SICAM SIAPP SDK client component does not enforce maximum length checks on… |
CVE-2026-25570 | High | 7.4 | 2026-03-10 | A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The SICAM SIAPP SDK does not perform checks on input values potentially resulti… |
CVE-2026-25569 | High | 7.4 | 2026-03-10 | A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). An out-of-bounds write vulnerability exists in SICAM SIAPP SDK. This could allo… |
CVE-2026-25190 | High | 7.8 | 2026-03-10 | Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally. |
CVE-2026-25189 | High | 7.8 | 2026-03-10 | Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2026-25188 | High | 8.8 | 2026-03-10 | Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to elevate privileges over an adjacent network. |
CVE-2026-25187 | High | 7.8 | 2026-03-10 | Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally. |
CVE-2026-25186 | Medium | 5.5 | 2026-03-10 | Exposure of sensitive information to an unauthorized actor in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to disclose inf… |
CVE-2026-25185 | Medium | 5.3 | 2026-03-10 | Exposure of sensitive information to an unauthorized actor in Windows Shell Link Processing allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-25181 | High | 7.5 | 2026-03-10 | Out-of-bounds read in Windows GDI+ allows an unauthorized attacker to disclose information over a network. |
CVE-2026-25180 | Medium | 5.5 | 2026-03-10 | Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally. |
CVE-2026-25179 | High | 7.0 | 2026-03-10 | Improper validation of specified type of input in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-25178 | High | 7.0 | 2026-03-10 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-25177 | High | 8.8 | 2026-03-10 | Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a netw… |
CVE-2026-25176 | High | 7.8 | 2026-03-10 | Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-25175 | High | 7.8 | 2026-03-10 | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. |
CVE-2026-25174 | High | 7.8 | 2026-03-10 | Out-of-bounds read in Windows Extensible File Allocation allows an authorized attacker to elevate privileges locally. |
CVE-2026-25173 | High | 8.0 | 2026-03-10 | Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2026-25172 | High | 8.0 | 2026-03-10 | Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2026-25171 | High | 7.0 | 2026-03-10 | Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. |
CVE-2026-25170 | High | 7.0 | 2026-03-10 | Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2026-25169 | Medium | 6.2 | 2026-03-10 | Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally. |
CVE-2026-25168 | Medium | 6.2 | 2026-03-10 | Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally. |
CVE-2026-25167 | High | 7.4 | 2026-03-10 | Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-25166 | High | 7.8 | 2026-03-10 | Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally. |
CVE-2026-25165 | High | 7.8 | 2026-03-10 | Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate privileges locally. |
CVE-2026-24641 | Low | 2.7 | 2026-03-10 | A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versi… |
CVE-2026-24640 | Medium | 6.6 | 2026-03-10 | A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all ve… |
CVE-2026-24297 | Medium | 6.5 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kerberos allows an unauthorized attacker to bypass a sec… |
CVE-2026-24296 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker… |
CVE-2026-24295 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker… |
CVE-2026-24294 | High | 7.8 | 2026-03-10 | Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally. |