2026 CVEs (page 390)
Page 390 of 446 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-21622 | Critical | 9.8 | 2026-03-05 | Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. Password reset toke… |
CVE-2026-29188 | Critical | 9.1 | 2026-03-05 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to ver… |
CVE-2026-29081 | Medium | 6.5 | 2026-03-05 | Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafte… |
CVE-2026-29077 | High | 7.1 | 2026-03-05 | Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could shar… |
CVE-2026-28492 | Medium | 6.5 | 2026-03-05 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to ver… |
CVE-2026-28443 | Critical | 9.8 | 2026-03-05 | OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field pa… |
CVE-2026-28442 | High | 8.5 | 2026-03-05 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting inter… |
CVE-2026-28436 | High | 7.2 | 2026-03-05 | Frappe is a full-stack web application framework. Prior to versions 16.11.0 and 15.102.0, an attacker can set a crafted image URL that results in XSS when the… |
CVE-2026-28413 | Medium | 5.3 | 2026-03-05 | Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?came_from=////evil.example m… |
CVE-2026-28410 | High | 8.1 | 2026-03-05 | The Graph is an indexing protocol for querying networks like Ethereum, IPFS, Polygon, and other blockchains. Prior to version 3.0.0, a flaw in the token vestin… |
CVE-2026-28405 | High | 8.0 | 2026-03-05 | MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.1, the courses/<:course_id>/assignments/<:assignment_id… |
CVE-2026-22723 | Medium | 6.5 | 2026-03-05 | Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfo… |
CVE-2026-0848 | Critical | 10.0 | 2026-03-05 | NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads… |
CVE-2026-28790 | High | 7.5 | 2026-03-05 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate runn… |
CVE-2026-28789 | High | 7.5 | 2026-03-05 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists… |
CVE-2026-28353 | | 2026-03-05 | Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was distributed via OpenVSX… | |
CVE-2026-28350 | Medium | 6.1 | 2026-03-05 | lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the <base> tag passes through the default… |
CVE-2026-28348 | Medium | 6.1 | 2026-03-05 | lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the _has_sneaky_javascript() method strip… |
CVE-2026-28343 | Medium | 6.4 | 2026-03-05 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XS… |
CVE-2026-28342 | High | 7.5 | 2026-03-05 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users… |
CVE-2026-28277 | Medium | 6.8 | 2026-03-05 | LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In version 1.0.9 and pr… |
CVE-2026-28223 | Medium | 6.1 | 2026-03-05 | Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vuln… |
CVE-2026-28222 | Medium | 6.1 | 2026-03-05 | Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vuln… |
CVE-2026-21621 | Medium | 5.3 | 2026-03-05 | Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privilege Escalation. An API key created with… |
CVE-2026-3459 | High | 8.1 | 2026-03-05 | The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation i… |
CVE-2026-3047 | High | 8.8 | 2026-03-05 | A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-init… |
CVE-2026-3009 | High | 8.1 | 2026-03-05 | A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it… |
CVE-2026-29054 | High | 7.5 | 2026-03-05 | Traefik is an HTTP reverse proxy and load balancer. From version 2.11.9 to 2.11.37 and from version 3.1.3 to 3.6.8, there is a potential vulnerability in Traef… |
CVE-2026-28287 | High | 8.8 | 2026-03-05 | FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilit… |
CVE-2026-28284 | High | 8.8 | 2026-03-05 | FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, the FreePBX logfiles module contains several authenticated SQL injection vulnerabilitie… |
CVE-2026-28210 | High | 8.8 | 2026-03-05 | FreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnerable to SQL query injection. This issue… |
CVE-2026-28209 | High | 7.2 | 2026-03-05 | FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exist… |
CVE-2026-27944 | Critical | 9.8 | 2026-03-05 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses… |
CVE-2026-27723 | Medium | 4.3 | 2026-03-05 | OpenProject is an open-source, web-based project management software. Prior to versions 17.0.5 and 17.1.2, an attacker can create wiki pages belonging to unper… |
CVE-2026-27023 | Medium | 5.0 | 2026-03-05 | Twenty is an open source CRM. Prior to version 1.18, the SSRF protection in SecureHttpClientService validated request URLs at the request level but did not val… |
CVE-2026-26999 | High | 7.5 | 2026-03-05 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing TLS handshake o… |
CVE-2026-26998 | Medium | 4.4 | 2026-03-05 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing the ForwardAuth… |
CVE-2026-26418 | High | 7.5 | 2026-03-05 | Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application fun… |
CVE-2026-26417 | High | 8.1 | 2026-03-05 | A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to r… |
CVE-2026-26416 | High | 8.8 | 2026-03-05 | An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privileges across role bound… |
CVE-2026-26276 | High | 7.3 | 2026-03-05 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and… |
CVE-2026-26196 | Medium | 5.3 | 2026-03-05 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params like token and access_token, which can lea… |
CVE-2026-26195 | Medium | 6.1 | 2026-03-05 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input w… |
CVE-2026-26194 | High | 7.3 | 2026-03-05 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlle… |
CVE-2026-26022 | High | 8.7 | 2026-03-05 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue desc… |
CVE-2026-25921 | Critical | 9.3 | 2026-03-05 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS o… |
CVE-2026-24457 | Critical | 9.1 | 2026-03-05 | An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A… |
CVE-2026-30798 | High | 7.5 | 2026-03-05 | Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk-client on… |
CVE-2026-30797 | High | 8.1 | 2026-03-05 | Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, conf… |
CVE-2026-30796 | High | 7.5 | 2026-03-05 | Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windo… |
CVE-2026-30795 | High | 7.5 | 2026-03-05 | Cleartext Transmission of Sensitive Information vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartb… |
CVE-2026-30793 | Critical | 9.8 | 2026-03-05 | Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme h… |
CVE-2026-30792 | High | 8.1 | 2026-03-05 | A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Strategy sync, HTTP API client, config op… |
CVE-2026-30789 | Critical | 9.8 | 2026-03-05 | Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication Attempts vulnerability in rustdesk-client RustDes… |
CVE-2026-30785 | Medium | 5.5 | 2026-03-05 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerab… |
CVE-2026-30783 | Critical | 9.8 | 2026-03-05 | A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config m… |
CVE-2026-26377 | Medium | 5.4 | 2026-03-05 | Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via the News function. |
CVE-2026-25048 | High | 7.5 | 2026-03-05 | xgrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to version 0.1.32, the multi-level nested syntax caused a… |
CVE-2026-3598 | High | 7.5 | 2026-03-05 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-server-pro RustDesk Server Pro rustdesk-server-pro on Windows, MacOS, Linux (Config… |
CVE-2026-30791 | High | 7.5 | 2026-03-05 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebCl… |
CVE-2026-27750 | High | 7.8 | 2026-03-05 | Avira Internet Security contains a time-of-check time-of-use (TOCTOU) vulnerability in the Optimizer component. A privileged service running as SYSTEM identifi… |
CVE-2026-27749 | High | 7.8 | 2026-03-05 | Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component. The Avira.SystemSpeedup.RealTimeOptimizer.e… |
CVE-2026-27748 | High | 7.8 | 2026-03-05 | Avira Internet Security contains an improper link resolution vulnerability in the Software Updater component. During the update process, a privileged service r… |
CVE-2026-1720 | High | 8.8 | 2026-03-05 | The WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation plugin for WordPress is vulnerable to unauthorized arbitrary plugin… |
CVE-2026-2599 | Critical | 9.8 | 2026-03-05 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4… |
CVE-2026-3236 | Medium | 4.3 | 2026-03-05 | In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exc… |
CVE-2026-21628 | Critical | 9.8 | 2026-03-05 | A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution. |
CVE-2026-1605 | High | 7.5 | 2026-03-05 | In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: g… |
CVE-2026-28551 | Medium | 4.7 | 2026-03-05 | Race condition vulnerability in the device security management module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28549 | Medium | 6.6 | 2026-03-05 | Race condition vulnerability in the permission management service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28548 | High | 7.1 | 2026-03-05 | Vulnerability of improper verification in the email application. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-28547 | Medium | 6.8 | 2026-03-05 | Vulnerability of uninitialized pointer access in the scanning module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28546 | Medium | 5.9 | 2026-03-05 | Buffer overflow vulnerability in the scanning module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28542 | High | 7.3 | 2026-03-05 | Permission bypass vulnerability in the system service framework. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-2893 | Medium | 6.5 | 2026-03-05 | The Page and Post Clone plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' parameter in the content_clone() function in all versions up to… |
CVE-2026-28552 | Medium | 6.5 | 2026-03-05 | Out-of-bounds write vulnerability in the IMS module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28550 | Medium | 4.0 | 2026-03-05 | Race condition vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28545 | Medium | 5.9 | 2026-03-05 | Race condition vulnerability in the printing module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28544 | Medium | 6.2 | 2026-03-05 | Race condition vulnerability in the printing module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28543 | Medium | 4.4 | 2026-03-05 | Race condition vulnerability in the maintenance and diagnostics module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28541 | Medium | 4.0 | 2026-03-05 | Permission control vulnerability in the cellular_data module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28540 | Medium | 4.0 | 2026-03-05 | Out-of-bounds character read vulnerability in Bluetooth. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-28539 | Medium | 6.2 | 2026-03-05 | Data processing vulnerability in the certificate management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-28538 | Medium | 5.9 | 2026-03-05 | Path traversal vulnerability in the certificate management module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28537 | Medium | 5.1 | 2026-03-05 | Double free vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-21786 | Low | 3.3 | 2026-03-05 | HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs. |
CVE-2026-1321 | High | 8.1 | 2026-03-05 | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.20. This is due t… |
CVE-2026-2743 | Critical | 9.8 | 2026-03-05 | Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface. The affected feature is the large file transfer (LFT)… |
CVE-2026-28536 | Critical | 9.6 | 2026-03-05 | Authentication bypass vulnerability in the device authentication module. Impact: Successful exploitation of this vulnerability will affect integrity and confid… |
CVE-2026-25702 | High | 7.3 | 2026-03-05 | A Improper Access Control vulnerability in the kernel of SUSE SUSE Linux Enterprise Server 12 SP5 breaks nftables, causing firewall rules applied via nftables… |
CVE-2026-1678 | Critical | 9.4 | 2026-03-05 | dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the fin… |
CVE-2026-3072 | Medium | 4.3 | 2026-03-05 | The Media Library Assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mla_update_compat_… |
CVE-2026-30777 | Medium | 6.5 | 2026-03-05 | EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who has obtained a valid administrator ID a… |
CVE-2026-2418 | Critical | 9.1 | 2026-03-05 | The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauthenticated users t… |
CVE-2026-29128 | Critical | 10.0 | 2026-03-05 | IDC SFX2100 Satellite Receiver firmware ships with multiple daemon configuration files for routing components (e.g., zebra, bgpd, ospfd, and ripd) that are own… |
CVE-2026-29053 | High | 7.6 | 2026-03-05 | Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server runn… |
CVE-2026-29052 | Medium | 6.1 | 2026-03-05 | The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activitie… |
CVE-2026-28137 | High | 7.1 | 2026-03-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicente… |
CVE-2026-28135 | High | 8.2 | 2026-03-05 | Inclusion of Functionality from Untrusted Control Sphere vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Accessing Functionality… |
CVE-2026-28134 | High | 8.5 | 2026-03-05 | Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetE… |