2026 CVEs (page 389)
Page 389 of 446 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28799 | High | 7.5 | 2026-03-06 | PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-free vulnerability exists in PJSIP's eve… |
CVE-2026-28795 | Critical | 9.8 | 2026-03-06 | OpenChatBI is an intelligent chat-based BI tool powered by large language models, designed to help users query, analyze, and visualize data through natural lan… |
CVE-2026-28438 | Critical | 9.8 | 2026-03-06 | CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creatin… |
CVE-2026-2446 | Critical | 9.8 | 2026-03-06 | The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to upda… |
CVE-2026-1128 | Medium | 4.3 | 2026-03-06 | The WP eCommerce WordPress plugin through 3.15.1 does not have CSRF check in place when deleting coupons, which could allow attackers to make a logged in admin… |
CVE-2026-29084 | Medium | 4.6 | 2026-03-06 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the login flow accepts credential-bearing… |
CVE-2026-29061 | Medium | 5.4 | 2026-03-06 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a privilege escalation vulnerability in t… |
CVE-2026-29060 | Medium | 5.0 | 2026-03-06 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a registered user without privileges to c… |
CVE-2026-28794 | Critical | 9.8 | 2026-03-06 | oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.6, a prototype pollution vulnerabili… |
CVE-2026-28787 | High | 8.2 | 2026-03-06 | OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store th… |
CVE-2026-28785 | Critical | 9.8 | 2026-03-06 | Ghostfolio is an open source wealth management software. Prior to version 2.244.0, by bypassing symbol validation, an attacker can execute arbitrary SQL comman… |
CVE-2026-28685 | Medium | 6.5 | 2026-03-06 | Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission… |
CVE-2026-28683 | High | 8.7 | 2026-03-06 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if a malicious authenticated user uploads… |
CVE-2026-28682 | Medium | 6.4 | 2026-03-06 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /… |
CVE-2026-28681 | High | 8.1 | 2026-03-06 | Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and… |
CVE-2026-28680 | Critical | 9.3 | 2026-03-06 | Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-re… |
CVE-2026-28679 | High | 8.6 | 2026-03-06 | Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. Prior to version 1.21.0, when a user requests a download, the a… |
CVE-2026-28677 | High | 8.2 | 2026-03-06 | OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline a… |
CVE-2026-28676 | High | 8.8 | 2026-03-06 | OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, multiple storage helpers… |
CVE-2026-28675 | Medium | 5.3 | 2026-03-06 | OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, some endpoints returned r… |
CVE-2026-28509 | Medium | 6.3 | 2026-03-06 | LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead… |
CVE-2026-28508 | High | 8.6 | 2026-03-06 | Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service… |
CVE-2026-28507 | High | 7.2 | 2026-03-06 | Idno is a social publishing platform. Prior to version 1.6.4, there is a remote code execution vulnerability via chained import file write and template path tr… |
CVE-2026-28429 | High | 7.5 | 2026-03-06 | Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871, a Path Traversal vulnerability was identified in the gameName parameter. While the app… |
CVE-2026-28428 | Medium | 5.3 | 2026-03-06 | Talishar is a fan-made Flesh and Blood project. Prior to commit a9c218e, an authentication bypass vulnerability in Talishar's game endpoint validation logic al… |
CVE-2026-27605 | Medium | 6.3 | 2026-03-06 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the appl… |
CVE-2026-27603 | High | 7.5 | 2026-03-06 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the char… |
CVE-2026-27005 | Critical | 9.8 | 2026-03-06 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.3, an unaut… |
CVE-2026-25888 | High | 8.8 | 2026-03-06 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is… |
CVE-2026-25887 | High | 7.2 | 2026-03-06 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is… |
CVE-2026-25877 | Medium | 6.5 | 2026-03-06 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, the appl… |
CVE-2026-29093 | High | 8.1 | 2026-03-06 | WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0… |
CVE-2026-29046 | High | 8.2 | 2026-03-06 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI en… |
CVE-2026-29041 | High | 8.8 | 2026-03-06 | Chamilo is a learning management system. Prior to version 1.11.34, Chamilo LMS is affected by an authenticated remote code execution vulnerability caused by im… |
CVE-2026-28502 | High | 8.8 | 2026-03-06 | WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo relate… |
CVE-2026-28501 | Critical | 9.8 | 2026-03-06 | WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos… |
CVE-2026-28497 | Critical | 9.1 | 2026-03-06 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.03, an integer overflow vulnerability in the string-to-integer conversion… |
CVE-2026-27807 | Medium | 4.9 | 2026-03-06 | MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML file… |
CVE-2026-25962 | Medium | 6.5 | 2026-03-06 | MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs currently extracts zip files without any size… |
CVE-2026-3616 | Medium | 6.3 | 2026-03-06 | A vulnerability was detected in DefaultFuction Jeson Customer Relationship Management System 1.0.0. Impacted is an unknown function of the file /modules/custom… |
CVE-2026-3613 | High | 7.2 | 2026-03-06 | A vulnerability was identified in Wavlink WL-NU516U1 V240425. This vulnerability affects the function sub_401A0C of the file /cgi-bin/login.cgi. Such manipulat… |
CVE-2026-3612 | High | 7.2 | 2026-03-06 | A vulnerability was determined in Wavlink WL-NU516U1 V240425. This affects the function sub_405AF4 of the file /cgi-bin/adm.cgi of the component OTA Online Upg… |
CVE-2026-3610 | Medium | 4.3 | 2026-03-06 | A vulnerability was found in HSC Cybersecurity Mailinspector up to 5.3.2-3. Affected by this issue is some unknown functionality of the file /mailinspector/mli… |
CVE-2026-2589 | Medium | 5.3 | 2026-03-06 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1… |
CVE-2026-28727 | High | 7.8 | 2026-03-06 | Local privilege escalation due to insecure Unix socket permissions. The following products are affected: Acronis Cyber Protect 17 (macOS) before build 41186, A… |
CVE-2026-28726 | Medium | 4.3 | 2026-03-06 | Sensitive information disclosure due to improper access control. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41… |
CVE-2026-28725 | Medium | 5.5 | 2026-03-06 | Sensitive information disclosure due to improper configuration of a headless browser. The following products are affected: Acronis Cyber Protect 17 (Linux, Win… |
CVE-2026-28724 | Medium | 4.3 | 2026-03-06 | Unauthorized data access due to insufficient access control validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before b… |
CVE-2026-28723 | Medium | 4.3 | 2026-03-06 | Unauthorized report deletion due to insufficient access control. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41… |
CVE-2026-28722 | High | 7.3 | 2026-03-06 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. |
CVE-2026-28721 | High | 7.3 | 2026-03-06 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. |
CVE-2026-28720 | Medium | 4.3 | 2026-03-06 | Unauthorized modification of settings due to insufficient authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows)… |
CVE-2026-28719 | Medium | 4.3 | 2026-03-06 | Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before… |
CVE-2026-28718 | High | 7.5 | 2026-03-06 | Denial of service due to insufficient input validation in authentication logging. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows… |
CVE-2026-28717 | Medium | 5.0 | 2026-03-06 | Local privilege escalation due to improper directory permissions. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. |
CVE-2026-28716 | Medium | 4.4 | 2026-03-06 | Information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) be… |
CVE-2026-28715 | Medium | 6.5 | 2026-03-06 | Sensitive information disclosure due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before bu… |
CVE-2026-28714 | Medium | 4.8 | 2026-03-06 | Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. |
CVE-2026-28713 | High | 7.1 | 2026-03-06 | Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cyber Protect Cloud Agent (VMware) before… |
CVE-2026-28712 | Medium | 6.3 | 2026-03-06 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. |
CVE-2026-28711 | Medium | 6.3 | 2026-03-06 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. |
CVE-2026-28710 | Critical | 9.8 | 2026-03-06 | Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows… |
CVE-2026-28709 | Medium | 4.3 | 2026-03-06 | Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before… |
CVE-2026-27778 | High | 7.5 | 2026-03-06 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacke… |
CVE-2026-27770 | Medium | 6.5 | 2026-03-06 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-24912 | High | 7.3 | 2026-03-06 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifi… |
CVE-2026-22552 | Critical | 9.4 | 2026-03-06 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the bac… |
CVE-2026-26125 | High | 8.6 | 2026-03-05 | Payment Orchestrator Service Elevation of Privilege Vulnerability |
CVE-2026-26124 | Medium | 6.7 | 2026-03-05 | '.../...//' in Azure Compute Gallery allows an authorized attacker to elevate privileges locally. |
CVE-2026-26122 | Medium | 6.5 | 2026-03-05 | Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose information over a network. |
CVE-2026-23651 | Medium | 6.7 | 2026-03-05 | Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally. |
CVE-2026-21536 | Critical | 9.8 | 2026-03-05 | Microsoft Devices Pricing Program Remote Code Execution Vulnerability |
CVE-2026-3606 | Low | 3.3 | 2026-03-05 | A vulnerability has been found in Ettercap 0.8.4-Garofalo. Affected by this vulnerability is the function add_data_segment of the file src/ettercap/utils/etter… |
CVE-2026-2593 | Medium | 6.4 | 2026-03-05 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `_gspb_post_css` post meta value a… |
CVE-2026-29613 | Medium | 5.9 | 2026-03-05 | OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based sole… |
CVE-2026-29612 | Medium | 5.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger… |
CVE-2026-29611 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a local file inclusion vulnerability in BlueBubbles extension (must be installed and enabled) media path handling… |
CVE-2026-29610 | High | 8.8 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a command hijacking vulnerability that allows attackers to execute unintended binaries by manipulating PATH enviro… |
CVE-2026-29609 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory… |
CVE-2026-29606 | Medium | 6.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the… |
CVE-2026-28486 | Medium | 6.1 | 2026-03-05 | OpenClaw versions 2026.1.16-2 prior to 2026.2.14 contain a path traversal vulnerability in archive extraction during installation commands that allows arbitrar… |
CVE-2026-28485 | High | 8.4 | 2026-03-05 | OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized loca… |
CVE-2026-28482 | High | 7.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionFile paths without enforcing directory c… |
CVE-2026-28481 | Medium | 6.5 | 2026-03-05 | OpenClaw versions 2026.1.30 and earlier, contain an information disclosure vulnerability, patched in 2026.2.1, in the MS Teams attachment downloader (optional… |
CVE-2026-28480 | Medium | 6.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immut… |
CVE-2026-28479 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.15 use SHA-1 to hash sandbox identifier cache keys for Docker and browser sandbox configurations, which is deprecated and vul… |
CVE-2026-28478 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request bodies without strict byte or time limit… |
CVE-2026-28477 | High | 7.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSR… |
CVE-2026-28476 | High | 8.3 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base U… |
CVE-2026-28475 | Medium | 4.8 | 2026-03-05 | OpenClaw versions prior to 2026.2.13 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measu… |
CVE-2026-28474 | Critical | 9.8 | 2026-03-05 | OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, all… |
CVE-2026-28473 | High | 8.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval req… |
CVE-2026-28472 | High | 8.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket connect handshake in which it allows skipping device identity checks when… |
CVE-2026-28471 | Medium | 5.3 | 2026-03-05 | OpenClaw version 2026.1.14-1 prior to 2026.2.2, with the Matrix plugin installed and enabled, contain a vulnerability in which DM allowlist matching could be b… |
CVE-2026-28470 | Critical | 9.8 | 2026-03-05 | OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary comma… |
CVE-2026-28469 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the Google Chat monitor component that allows cross-account policy context misr… |
CVE-2026-28468 | High | 7.7 | 2026-03-05 | OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.14 contain a vulnerability in the sandbox browser bridge server in which it accepts requests without requiri… |
CVE-2026-28467 | Medium | 6.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.2 contain a server-side request forgery vulnerability in attachment and media URL hydration that allows remote attackers to f… |
CVE-2026-28466 | Critical | 9.9 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, a… |
CVE-2026-28465 | Medium | 5.9 | 2026-03-05 | OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to… |