2026 CVEs (page 400)
Page 400 of 684 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12578 | | 2026-06-30 | The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code. | |
CVE-2026-9576 | Medium | 4.9 | 2026-06-30 | The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, a… |
CVE-2026-56809 | Medium | 6.1 | 2026-06-30 | Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vulnerability. An ar… |
CVE-2026-56808 | High | 7.2 | 2026-06-30 | DGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability, which may lead to arbitrary command execution with the root… |
CVE-2026-56137 | High | 7.8 | 2026-06-30 | RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection vulnerability. If a user loads a specially crafted save-file, arbitrar… |
CVE-2026-14164 | High | 7.5 | 2026-06-30 | A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain st… |
CVE-2026-12819 | | 2026-06-30 | Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without authentication or access control, permitting unauthenticated interacti… | |
CVE-2026-12818 | | 2026-06-30 | Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits or throttling (CWE-770) within their Modbus TCP service. | |
CVE-2026-12240 | High | 8.0 | 2026-06-30 | The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all… |
CVE-2026-11590 | High | 8.6 | 2026-06-30 | The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array keys before using them in a SQL statement, al… |
CVE-2026-11589 | High | 8.8 | 2026-06-30 | The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload… |
CVE-2026-11581 | Medium | 5.9 | 2026-06-30 | The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column… |
CVE-2026-8944 | Medium | 4.3 | 2026-06-30 | The Plugin for Google Analytics by IO technologies plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1. This… |
CVE-2026-12560 | Medium | 4.4 | 2026-06-30 | The Editorial Rating – Product Review & Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Link URL' Field in all versions up… |
CVE-2026-12349 | Medium | 5.3 | 2026-06-30 | The Premium Addons for KingComposer plugin for WordPress is vulnerable to unauthorized modification and loss of data in versions up to, and including, 1.1.1. T… |
CVE-2026-12073 | Critical | 9.8 | 2026-06-30 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to… |
CVE-2026-11367 | Medium | 6.5 | 2026-06-30 | The PixMagix – WordPress Image Editor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.2 via the move_image_… |
CVE-2026-14160 | Medium | 5.9 | 2026-06-30 | Time-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Escargot allows Leveraging Race Conditions. This issue affects Escargot… |
CVE-2026-12114 | Medium | 4.4 | 2026-06-30 | The Team Members – Multi Language Supported Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up… |
CVE-2026-58302 | High | 8.4 | 2026-06-30 | rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by u… |
CVE-2026-8023 | High | 7.5 | 2026-06-29 | Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_FILE_SYSTEM is enabl… |
CVE-2026-7656 | High | 8.1 | 2026-06-29 | The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean expression that… |
CVE-2026-51219 | High | 7.5 | 2026-06-29 | A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.3.3 to v2.3.6 allows attackers to cause a Denial of Service… |
CVE-2026-51218 | High | 7.5 | 2026-06-29 | A heap buffer overflow in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3 allows attackers to cause a Denial of Service (D… |
CVE-2026-10648 | Medium | 6.2 | 2026-06-29 | mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on the result of smp_packet_alloc() before checking it for… |
CVE-2026-57997 | Medium | 4.8 | 2026-06-29 | Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance… |
CVE-2026-51221 | High | 7.5 | 2026-06-29 | A buffer overflow in the Get_Attribute_List function of EIPStackGroup OpENer commit 76b95c allows attackers to cause a Denial of Service (DoS) via supplying a… |
CVE-2026-34592 | High | 7.7 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, Coolify server and project lookups… |
CVE-2026-10647 | Medium | 5.3 | 2026-06-29 | The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of usbd_ep_enqueue() in its ethernet transmit callback cdc_… |
CVE-2026-55957 | High | 7.3 | 2026-06-29 | Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers t… |
CVE-2026-55956 | Medium | 6.5 | 2026-06-29 | Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission co… |
CVE-2026-55955 | Medium | 6.5 | 2026-06-29 | Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects… |
CVE-2026-55276 | Critical | 9.1 | 2026-06-29 | Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when… |
CVE-2026-53434 | Critical | 9.1 | 2026-06-29 | Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat… |
CVE-2026-53404 | High | 7.3 | 2026-06-29 | Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequen… |
CVE-2026-50229 | Medium | 6.1 | 2026-06-29 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects… |
CVE-2026-41896 | High | 7.5 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the HMAC key is the application's… |
CVE-2026-34597 | High | 8.8 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.470, a critical Authenticated Host Remo… |
CVE-2026-34594 | High | 8.8 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, an authenticated command injection… |
CVE-2026-13758 | Low | 3.7 | 2026-06-29 | CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path. The decrypt_done($tag) for… |
CVE-2026-57919 | High | 7.8 | 2026-06-29 | PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and GENERIC… |
CVE-2026-57498 | Critical | 9.6 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consiste… |
CVE-2026-56018 | High | 7.5 | 2026-06-29 | JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanu… |
CVE-2026-56017 | High | 7.5 | 2026-06-29 | JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. The rege… |
CVE-2026-54889 | | 2026-06-29 | Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandrocp mdex allows cross-site scripting via unsanitized URL schemes in Qu… | |
CVE-2026-54888 | | 2026-06-29 | Uncontrolled Recursion vulnerability in leandrocp mdex allows denial of service via deeply nested Markdown input. mdex converts between an Elixir %MDEx.Docume… | |
CVE-2026-53429 | | 2026-06-29 | Missing Release of Memory after Effective Lifetime vulnerability in leandrocp mdex and mdex_native allows an attacker who controls a rendered document to cause… | |
CVE-2026-53426 | | 2026-06-29 | Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation. MDEx.parse_document/2 accepts a {:json, json… | |
CVE-2026-43746 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43745 | Medium | 6.5 | 2026-06-29 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and… |
CVE-2026-43743 | Medium | 4.7 | 2026-06-29 | A race condition was addressed with improved state handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, iOS 26.7 and iPadOS 26.7, macOS Tahoe 26.5.2… |
CVE-2026-43742 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43740 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visio… |
CVE-2026-43735 | High | 8.1 | 2026-06-29 | The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 2… |
CVE-2026-43734 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43732 | Medium | 6.5 | 2026-06-29 | A path handling issue was addressed with improved validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6… |
CVE-2026-43731 | High | 8.8 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43727 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43726 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43725 | High | 7.1 | 2026-06-29 | The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, mac… |
CVE-2026-43724 | High | 7.8 | 2026-06-29 | The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15… |
CVE-2026-43722 | Medium | 5.5 | 2026-06-29 | The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15… |
CVE-2026-43721 | Medium | 6.5 | 2026-06-29 | This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6… |
CVE-2026-43720 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43718 | Medium | 6.5 | 2026-06-29 | A stack overflow was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26… |
CVE-2026-43717 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43716 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing malic… |
CVE-2026-43715 | High | 8.8 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, iOS 26.7 and iPadOS 2… |
CVE-2026-43713 | Medium | 6.5 | 2026-06-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26… |
CVE-2026-43712 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visio… |
CVE-2026-43709 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, t… |
CVE-2026-43708 | Medium | 4.3 | 2026-06-29 | The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, mac… |
CVE-2026-43707 | Medium | 6.5 | 2026-06-29 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2… |
CVE-2026-43706 | Medium | 6.5 | 2026-06-29 | A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8… |
CVE-2026-43705 | High | 8.8 | 2026-06-29 | A type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2… |
CVE-2026-43704 | Medium | 5.3 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, t… |
CVE-2026-43703 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Ta… |
CVE-2026-43701 | High | 7.1 | 2026-06-29 | The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 2… |
CVE-2026-43700 | Medium | 6.5 | 2026-06-29 | A cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2… |
CVE-2026-43699 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43676 | Medium | 6.5 | 2026-06-29 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and… |
CVE-2026-43663 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macO… |
CVE-2026-39872 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macO… |
CVE-2026-39868 | Critical | 9.1 | 2026-06-29 | This issue was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15… |
CVE-2026-37637 | Critical | 9.1 | 2026-06-29 | An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the filemanager.php component |
CVE-2026-31016 | Medium | 6.5 | 2026-06-29 | Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before allows a remote attacker to escalate privileges via the IdentityServer a… |
CVE-2026-28979 | Medium | 6.5 | 2026-06-29 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and… |
CVE-2026-13763 | Critical | 9.8 | 2026-06-29 | Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule b… |
CVE-2026-13762 | Critical | 9.8 | 2026-06-29 | Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspecti… |
CVE-2026-13593 | Medium | 6.5 | 2026-06-29 | CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away. The minify function has a memory leak when proce… |
CVE-2026-58000 | High | 8.8 | 2026-06-29 | luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta paramet… |
CVE-2026-57999 | High | 8.8 | 2026-06-29 | luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RPC method that allows authenticated users to execute arbitra… |
CVE-2026-53428 | | 2026-06-29 | Memory Allocation with Excessive Size Value vulnerability in leandrocp mdex allows an unauthenticated attacker to cause a denial of service through unbounded m… | |
CVE-2026-53427 | | 2026-06-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scri… | |
CVE-2026-13757 | Medium | 6.2 | 2026-06-29 | A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a… |
CVE-2026-57960 | Medium | 6.5 | 2026-06-29 | Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists inc… |
CVE-2026-57959 | Medium | 5.9 | 2026-06-29 | Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob inc… |
CVE-2026-57958 | Medium | 6.1 | 2026-06-29 | Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in authenti… |
CVE-2026-57957 | Medium | 4.7 | 2026-06-29 | Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration vulnerability that allows unauthenticated remote attackers to perform… |
CVE-2026-57956 | Medium | 6.4 | 2026-06-29 | SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a… |