2026 CVEs (page 39)
Page 39 of 662 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-51995 | High | 7.5 | 2026-09-24 | An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts… |
CVE-2026-51994 | Critical | 9.1 | 2026-09-24 | mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server… |
CVE-2026-19492 | Low | 3.2 | 2026-09-24 | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in a hypervisor… |
CVE-2026-18870 | Medium | 4.3 | 2026-09-24 | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remot… |
CVE-2026-13467 | High | 8.1 | 2026-09-24 | Out-of-bounds write vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue… |
CVE-2026-13466 | High | 8.1 | 2026-09-24 | Incorrect calculation of buffer size vulnerability in Altera Trusted Firmware on HPS allows Overflow Buffers. This issue affects Trusted Firmware: through soc… |
CVE-2026-13465 | High | 8.1 | 2026-09-24 | Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. Th… |
CVE-2026-12559 | | 2026-09-24 | A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. U… | |
CVE-2026-97360 | Critical | 10.0 | 2026-09-24 | HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, an… |
CVE-2026-97359 | Critical | 10.0 | 2026-09-24 | HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve rem… |
CVE-2026-97062 | Medium | 5.4 | 2026-09-24 | Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authentic… |
CVE-2026-97061 | Medium | 4.3 | 2026-09-24 | Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists… |
CVE-2026-97059 | High | 8.2 | 2026-09-24 | DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length… |
CVE-2026-97058 | Medium | 5.3 | 2026-09-24 | sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeErr… |
CVE-2026-97057 | High | 7.5 | 2026-09-24 | redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supp… |
CVE-2026-95521 | High | 7.8 | 2026-09-24 | A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm t… |
CVE-2026-95519 | High | 7.8 | 2026-09-24 | A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-proc… |
CVE-2026-91187 | | 2026-09-24 | Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary… | |
CVE-2026-88360 | | 2026-09-24 | libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes… | |
CVE-2026-88359 | Medium | 6.5 | 2026-09-24 | libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a very large li… |
CVE-2026-77798 | Medium | 6.5 | 2026-09-24 | Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management modu… |
CVE-2026-77797 | Low | 3.6 | 2026-09-24 | Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files. |
CVE-2026-18857 | Low | 3.4 | 2026-09-24 | IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware manage… |
CVE-2026-18104 | Low | 3.3 | 2026-09-24 | IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode fo… |
CVE-2026-17511 | Low | 3.4 | 2026-09-24 | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vu… |
CVE-2026-17504 | Medium | 5.1 | 2026-09-24 | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vu… |
CVE-2026-17503 | Medium | 5.1 | 2026-09-24 | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vu… |
CVE-2026-17413 | Medium | 5.1 | 2026-09-24 | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vu… |
CVE-2026-97182 | High | 7.3 | 2026-09-24 | A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo… |
CVE-2026-96515 | | 2026-09-24 | This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import fun… | |
CVE-2026-94416 | Medium | 6.8 | 2026-09-24 | An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new servi… |
CVE-2026-88916 | Medium | 6.8 | 2026-09-24 | Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation. This issue affects UlakPDF: through 09092026. |
CVE-2026-88907 | High | 7.4 | 2026-09-24 | Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026. |
CVE-2026-19072 | Critical | 9.9 | 2026-09-24 | Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field… |
CVE-2026-97311 | Medium | 4.3 | 2026-09-24 | A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specifi… |
CVE-2026-7169 | | 2026-09-24 | a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a… | |
CVE-2026-4806 | Medium | 6.5 | 2026-09-24 | The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the s… |
CVE-2026-3253 | Medium | 4.3 | 2026-09-24 | The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms… |
CVE-2026-19532 | Medium | 5.3 | 2026-09-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affe… |
CVE-2026-16302 | Medium | 4.3 | 2026-09-24 | The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the… |
CVE-2026-97179 | Medium | 4.3 | 2026-09-24 | A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/sr… |
CVE-2026-79680 | | 2026-09-24 | Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client tha… | |
CVE-2026-4638 | | 2026-09-24 | PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric val… | |
CVE-2026-92905 | Medium | 5.3 | 2026-09-24 | ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log collector… |
CVE-2026-57590 | High | 8.1 | 2026-09-24 | A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authentica… |
CVE-2026-4637 | | 2026-09-24 | Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a request is made for a no… | |
CVE-2026-18335 | Medium | 5.4 | 2026-09-24 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to… |
CVE-2026-15731 | Medium | 6.4 | 2026-09-24 | The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions u… |
CVE-2026-12227 | Critical | 9.8 | 2026-09-24 | The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-templ… |
CVE-2026-97185 | High | 7.8 | 2026-09-24 | A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing… |
CVE-2026-85682 | High | 8.8 | 2026-09-24 | The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting… |
CVE-2026-78313 | Medium | 6.5 | 2026-09-24 | Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. |
CVE-2026-78312 | Critical | 9.1 | 2026-09-24 | Path Traversal in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. |
CVE-2026-78311 | High | 8.8 | 2026-09-24 | SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. |
CVE-2026-78310 | Medium | 4.3 | 2026-09-24 | Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. |
CVE-2026-78309 | High | 8.8 | 2026-09-24 | SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. |
CVE-2026-78308 | Critical | 9.8 | 2026-09-24 | Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass. This issue affects DIAEnergie: before 1.11.00.022. |
CVE-2026-77193 | High | 7.5 | 2026-09-24 | The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` p… |
CVE-2026-97181 | Medium | 5.3 | 2026-09-24 | GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs. |
CVE-2026-87739 | | 2026-09-24 | An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report genera… | |
CVE-2026-82077 | | 2026-09-24 | An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allow… | |
CVE-2026-81645 | Medium | 5.9 | 2026-09-24 | Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability. |
CVE-2026-11744 | | 2026-09-24 | An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received… | |
CVE-2026-97177 | Medium | 6.6 | 2026-09-24 | A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for sp… |
CVE-2026-97176 | Medium | 4.2 | 2026-09-24 | A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client s… |
CVE-2026-93662 | Medium | 4.3 | 2026-09-24 | The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner va… |
CVE-2026-93661 | Low | 2.7 | 2026-09-24 | The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against… |
CVE-2026-89005 | Medium | 6.8 | 2026-09-24 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is e… |
CVE-2026-89004 | Low | 2.7 | 2026-09-24 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and… |
CVE-2026-89002 | Medium | 6.8 | 2026-09-24 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it… |
CVE-2026-88847 | Medium | 4.3 | 2026-09-24 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions ag… |
CVE-2026-88846 | Medium | 5.3 | 2026-09-24 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account… |
CVE-2026-88845 | Medium | 4.3 | 2026-09-24 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, a… |
CVE-2026-88843 | High | 7.2 | 2026-09-24 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template pa… |
CVE-2026-84151 | Low | 3.5 | 2026-09-24 | The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowin… |
CVE-2026-82850 | Medium | 4.3 | 2026-09-24 | The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve… |
CVE-2026-82849 | Medium | 4.3 | 2026-09-24 | The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any… |
CVE-2026-82195 | Medium | 6.5 | 2026-09-24 | The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connectio… |
CVE-2026-80513 | High | 7.5 | 2026-09-24 | The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, al… |
CVE-2026-80338 | Medium | 6.8 | 2026-09-24 | The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to cr… |
CVE-2026-74991 | Medium | 6.8 | 2026-09-24 | The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on… |
CVE-2026-14780 | | 2026-09-24 | A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embe… | |
CVE-2026-97155 | Medium | 6.5 | 2026-09-24 | Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict whi… |
CVE-2026-97152 | | 2026-09-24 | Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-W… | |
CVE-2026-97151 | | 2026-09-24 | mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allo… | |
CVE-2026-96898 | High | 7.3 | 2026-09-24 | A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the… |
CVE-2026-96892 | Medium | 4.3 | 2026-09-24 | A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of… |
CVE-2026-97149 | | 2026-09-24 | In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, ex… | |
CVE-2026-96891 | Critical | 9.8 | 2026-09-24 | A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipul… |
CVE-2026-96884 | Medium | 6.3 | 2026-09-24 | A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.cs of the component… |
CVE-2026-96882 | Medium | 5.3 | 2026-09-24 | A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the file src/main/java/… |
CVE-2026-96881 | Medium | 5.3 | 2026-09-24 | A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. Affected is the function getBooks of the file src/main/java/io/github/talelin/lattic… |
CVE-2026-97056 | Medium | 6.8 | 2026-09-24 | SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0… |
CVE-2026-97055 | High | 8.1 | 2026-09-24 | SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or the deprecated SIG… |
CVE-2026-96880 | Medium | 5.3 | 2026-09-24 | A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/con… |
CVE-2026-96810 | Low | 3.5 | 2026-09-24 | A vulnerability was identified in huanzi-qch base-admin up to 52816b760cd53244989fd664bbb2b3d4edbfdbf1. This issue affects the function Save of the file base-a… |
CVE-2026-96803 | High | 7.3 | 2026-09-24 | A vulnerability was identified in java110 MicroCommunity up to 2.0. Affected is the function QueryServiceSMOImpl.fallBack of the file BusinessApi.java of the c… |
CVE-2026-96777 | Medium | 6.3 | 2026-09-24 | A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server… |
CVE-2026-18467 | Critical | 9.8 | 2026-09-24 | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3… |
CVE-2026-96774 | Medium | 5.3 | 2026-09-24 | A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. This affects the function loadCfg of the file /ini/s… |