2026 CVEs (page 401)
Page 401 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20127 | Critical | 10.0 | 2026-02-25 | A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vMana… |
CVE-2026-20126 | High | 8.8 | 2026-02-25 | A vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying ope… |
CVE-2026-20122 | Medium | 5.4 | 2026-02-25 | A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system… |
CVE-2026-20107 | Medium | 5.5 | 2026-02-25 | A vulnerability in the Object Model CLI component of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, local attacker to… |
CVE-2026-20099 | Medium | 6.7 | 2026-02-25 | A vulnerability in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker w… |
CVE-2026-20091 | Medium | 4.8 | 2026-02-25 | A vulnerability in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, remote attacker to co… |
CVE-2026-20051 | High | 7.4 | 2026-02-25 | A vulnerability with the Ethernet VPN (EVPN) Layer 2 ingress packet processing of Cisco Nexus 3600 Platform Switches and Cisco Nexus 9500-R Series Switching Pl… |
CVE-2026-20048 | High | 7.7 | 2026-02-25 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an authenticated… |
CVE-2026-20037 | Medium | 4.4 | 2026-02-25 | A vulnerability in the NX-OS CLI privilege levels of Cisco UCS Manager Software could allow an authenticated, local attacker with read-only privileges to modif… |
CVE-2026-20036 | Medium | 6.5 | 2026-02-25 | A vulnerability in the CLI and web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker with valid administra… |
CVE-2026-20033 | High | 7.4 | 2026-02-25 | A vulnerability in Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) con… |
CVE-2026-20010 | High | 7.4 | 2026-02-25 | A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause the LLDP… |
CVE-2026-3206 | | 2026-02-25 | Improper Resource Shutdown or Release vulnerability in KrakenD, SLU KrakenD-CE (CircuitBreaker modules), KrakenD, SLU KrakenD-EE (CircuitBreaker modules). This… | |
CVE-2026-3188 | Medium | 4.3 | 2026-02-25 | A security flaw has been discovered in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This affects an unknown part of the file /api/admin/common/download/templa… |
CVE-2026-27848 | Critical | 9.8 | 2026-02-25 | Due to missing neutralization of special elements, OS commands can be injected via the handshake of a TLS-SRP connection, which are ultimately run as the root… |
CVE-2026-27847 | Critical | 9.8 | 2026-02-25 | Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known… |
CVE-2026-27846 | Medium | 6.2 | 2026-02-25 | Due to missing authentication, a user with physical access to the device can misuse the mesh functionality for adding a new mesh device to the network to gain… |
CVE-2026-27730 | High | 7.5 | 2026-02-25 | esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh’s `/ht… |
CVE-2026-27704 | High | 7.5 | 2026-02-25 | The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart SDK prior to 3.11.0 and the Flutter SDK… |
CVE-2026-27702 | Critical | 9.9 | 2026-02-25 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase… |
CVE-2026-27701 | | 2026-02-25 | LiveCode is an open-source, client-side code playground. Prior to commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11, LiveCode's `i18n-update-pull` GitHub Actions… | |
CVE-2026-27700 | High | 8.2 | 2026-02-25 | Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/a… |
CVE-2026-22866 | High | 7.5 | 2026-02-25 | Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. In versions 1.6.2 and prior, the `RSASHA256A… |
CVE-2026-3203 | Medium | 5.5 | 2026-02-25 | RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service |
CVE-2026-3202 | Medium | 4.7 | 2026-02-25 | NTS-KE protocol dissector crash in Wireshark 4.6.0 to 4.6.3 allows denial of service |
CVE-2026-3201 | Medium | 4.7 | 2026-02-25 | USB HID protocol dissector memory exhaustion in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service |
CVE-2026-3187 | Medium | 6.3 | 2026-02-25 | A vulnerability was identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this issue is some unknown functionality of the file /api/admin/sys… |
CVE-2026-2878 | Medium | 5.3 | 2026-02-25 | In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary… |
CVE-2026-27699 | Critical | 9.1 | 2026-02-25 | The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A m… |
CVE-2026-27695 | Medium | 4.3 | 2026-02-25 | zae-limiter is a rate limiting library using the token bucket algorithm. Prior to version 0.10.1, all rate limit buckets for a single entity share the same Dyn… |
CVE-2026-27692 | High | 7.1 | 2026-02-25 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, heap-buffer-overflow read… |
CVE-2026-27691 | Medium | 6.2 | 2026-02-25 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, signed integer overflow i… |
CVE-2026-3186 | Medium | 6.3 | 2026-02-25 | A vulnerability was determined in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unknown functionality of the file /api/adm… |
CVE-2026-3185 | Medium | 5.3 | 2026-02-25 | A vulnerability was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected is an unknown function of the file /api/admin/sys-message/ of the component… |
CVE-2026-28196 | Low | 2.3 | 2026-02-25 | In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk |
CVE-2026-28195 | Medium | 4.3 | 2026-02-25 | In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations |
CVE-2026-28194 | Medium | 4.3 | 2026-02-25 | In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow |
CVE-2026-28193 | High | 8.8 | 2026-02-25 | In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint |
CVE-2026-2624 | Critical | 9.8 | 2026-02-25 | Missing Authentication for Critical Function vulnerability in ePati Cyber Security Technologies Inc. Antikor Next Generation Firewall (NGFW) allows Authentic… |
CVE-2026-21725 | Low | 2.6 | 2026-02-25 | A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requi… |
CVE-2026-0704 | Critical | 9.1 | 2026-02-25 | In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation w… |
CVE-2026-3118 | Medium | 6.5 | 2026-02-25 | A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQ… |
CVE-2026-25701 | | 2026-02-25 | An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like: * gain access… | |
CVE-2026-26104 | Medium | 5.5 | 2026-02-25 | A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occ… |
CVE-2026-26103 | High | 7.1 | 2026-02-25 | A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization… |
CVE-2026-2410 | Medium | 4.3 | 2026-02-25 | The Disable Admin Notices – Hide Dashboard Notifications plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2026-2367 | Medium | 6.4 | 2026-02-25 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ays_block' shortcode… |
CVE-2026-2301 | Medium | 4.3 | 2026-02-25 | The Post Duplicator plugin for WordPress is vulnerable to unauthorized arbitrary protected post meta insertion in all versions up to, and including, 3.0.8. Thi… |
CVE-2026-3171 | Low | 3.5 | 2026-02-25 | A flaw has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this vulnerability is an unknown functiona… |
CVE-2026-2479 | Medium | 5.0 | 2026-02-25 | The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.1. This is due to… |
CVE-2026-2416 | High | 7.5 | 2026-02-25 | The Geo Mashup plugin for WordPress is vulnerable to SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.17. This is due to insuf… |
CVE-2026-1929 | High | 8.8 | 2026-02-25 | The Advanced Woo Labels plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.37. This is due to the use of `call… |
CVE-2026-1916 | High | 7.5 | 2026-02-25 | The WPGSI: Spreadsheet Integration plugin for WordPress is vulnerable to unauthorized modification and loss of data due to missing capability checks and an ins… |
CVE-2026-3170 | Low | 2.4 | 2026-02-25 | A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected is an unknown function of the file /pa… |
CVE-2026-3169 | High | 8.8 | 2026-02-25 | A security vulnerability has been detected in Tenda F453 1.0.0.3. This impacts the function fromSafeEmailFilter of the file /goform/SafeEmailFilter of the comp… |
CVE-2026-3168 | High | 8.8 | 2026-02-25 | A weakness has been identified in Tenda F453 1.0.0.3. This affects the function fromNatStaticSetting of the file /goform/NatStaticSetting of the component http… |
CVE-2026-3167 | High | 8.8 | 2026-02-25 | A security flaw has been discovered in Tenda F453 1.0.0.3. The impacted element is the function formWebTypeLibrary of the file /goform/webtypelibrary of the co… |
CVE-2026-3166 | High | 8.8 | 2026-02-25 | A vulnerability was identified in Tenda F453 1.0.0.3. The affected element is the function fromRouteStatic of the file /goform/RouteStatic of the component htt… |
CVE-2026-1614 | Medium | 6.4 | 2026-02-25 | The Rise Blocks – A Complete Gutenberg Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘logoTag’ Site Identity block att… |
CVE-2026-3179 | High | 8.1 | 2026-02-25 | The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings. A malicious server or MITM attacke… |
CVE-2026-3165 | High | 8.8 | 2026-02-25 | A vulnerability was determined in Tenda F453 1.0.0.3. Impacted is the function fromSetWifiGusetBasic of the file /goform/AdvSetWrlsafeset of the component http… |
CVE-2026-3164 | High | 7.3 | 2026-02-25 | A vulnerability was found in itsourcecode News Portal Project 1.0. This issue affects some unknown processing of the file /admin/contactus.php. The manipulatio… |
CVE-2026-3163 | Medium | 6.3 | 2026-02-25 | A vulnerability has been found in SourceCodester Website Link Extractor 1.0. This vulnerability affects the function file_get_contents of the component URL Han… |
CVE-2026-3153 | High | 7.3 | 2026-02-25 | A vulnerability has been found in itsourcecode Document Management System 1.0. Impacted is an unknown function of the file /register.php. Such manipulation of… |
CVE-2026-3152 | High | 7.3 | 2026-02-25 | A flaw has been found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/teacher-salary.php. This man… |
CVE-2026-3151 | High | 7.3 | 2026-02-25 | A vulnerability was detected in itsourcecode College Management System 1.0. This vulnerability affects unknown code of the file /login/login.php. The manipulat… |
CVE-2026-3100 | Medium | 6.5 | 2026-02-25 | The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to an FTP server using FTPES/FTPS. An improper valid… |
CVE-2026-25785 | Critical | 9.8 | 2026-02-25 | Path traversal vulnerability exists in Lanscope Endpoint Manager (On-Premises) Sub-Manager Server Ver.9.4.7.3 and earlier, which may allow an attacker to tampe… |
CVE-2026-3150 | Medium | 6.3 | 2026-02-25 | A security vulnerability has been detected in itsourcecode College Management System 1.0. This affects an unknown part of the file /admin/display-teacher.php… |
CVE-2026-3149 | Medium | 6.3 | 2026-02-25 | A weakness has been identified in itsourcecode College Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/asign-sin… |
CVE-2026-3148 | High | 7.3 | 2026-02-25 | A vulnerability was determined in SourceCodester Simple and Nice Shopping Cart Script 1.0. This impacts an unknown function of the file /signup.php. This manip… |
CVE-2026-27696 | High | 8.6 | 2026-02-25 | changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, changedetection.io is vulnerable to Server-Side Request F… |
CVE-2026-27645 | Medium | 6.1 | 2026-02-25 | changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path para… |
CVE-2026-27624 | High | 7.2 | 2026-02-25 | Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using "denied-peer-ip"… |
CVE-2026-3147 | Medium | 5.3 | 2026-02-25 | A vulnerability was found in libvips up to 8.18.0. This affects the function vips_foreign_load_csv_build of the file libvips/foreign/csvload.c. The manipulatio… |
CVE-2026-27747 | High | 8.8 | 2026-02-25 | The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated SQL injection vulnerability in interface_traduction_objets_pipelin… |
CVE-2026-27746 | Medium | 6.1 | 2026-02-25 | The SPIP jeux plugin versions prior to 4.1.1 contain a reflected cross-site scripting (XSS) vulnerability in the pre_propre pipeline. The plugin incorporates u… |
CVE-2026-27745 | High | 8.8 | 2026-02-25 | The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated remote code execution vulnerability in the translation interface w… |
CVE-2026-27744 | Critical | 9.8 | 2026-02-25 | The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket… |
CVE-2026-27743 | Critical | 9.8 | 2026-02-25 | The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_suppri… |
CVE-2026-27641 | Critical | 9.8 | 2026-02-25 | Flask-Reuploaded provides file uploads for Flask. A critical path traversal and extension bypass vulnerability in versions prior to 1.5.0 allows remote attacke… |
CVE-2026-27640 | High | 7.5 | 2026-02-25 | tfplan2md is software for converting Terraform plan JSON files into human-readable Markdown reports. Prior to version 1.26.1, a bug in tfplan2md affected sever… |
CVE-2026-27639 | Medium | 5.4 | 2026-02-25 | Mercator is an open source web application designed to enable mapping of information systems. A stored Cross-Site Scripting (XSS) vulnerability exists in Merca… |
CVE-2026-27637 | Critical | 9.8 | 2026-02-25 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's `TokenAuth` middleware uses a predicta… |
CVE-2026-27636 | High | 8.8 | 2026-02-25 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/M… |
CVE-2026-27627 | High | 8.2 | 2026-02-25 | Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns `readableContentHtml`, the HTML parsing subpr… |
CVE-2026-27597 | Critical | 10.0 | 2026-02-25 | Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to version 2.11.1, it is possible to escape the security boundraries se… |
CVE-2026-3146 | Low | 3.3 | 2026-02-25 | A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_header of the file libvips/foreign/matrix… |
CVE-2026-3145 | Medium | 5.3 | 2026-02-25 | A flaw has been found in libvips up to 8.18.0. The affected element is the function vips_foreign_load_matrix_file_is_a/vips_foreign_load_matrix_header of the f… |
CVE-2026-27822 | Critical | 9.0 | 2026-02-25 | RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting (XSS) vulnerability in the RustFS C… |
CVE-2026-27632 | Low | 2.6 | 2026-02-25 | Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48, the Talishar application lacks Cross-Site Request For… |
CVE-2026-27629 | Medium | 5.9 | 2026-02-25 | InvenTree is an Open Source Inventory Management System. Prior to version 1.2.3, insecure server-side templates can be hijacked to expose secure information to… |
CVE-2026-27628 | High | 7.5 | 2026-02-25 | pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loo… |
CVE-2026-27626 | Critical | 9.9 | 2026-02-25 | OliveTin gives access to predefined shell commands from a web interface. In versions up to and including 3000.10.0, OliveTin's shell mode safety check (`checkS… |
CVE-2026-27621 | Medium | 5.4 | 2026-02-25 | TypiCMS is a multilingual content management system based on the Laravel framework. A Stored Cross-Site Scripting (XSS) vulnerability exists in the file upload… |
CVE-2026-27615 | High | 7.8 | 2026-02-25 | ADB Explorer is a fluent UI for ADB on Windows. In versions prior to Beta 0.9.26022, ADB-Explorer allows the `ManualAdbPath` settings variable, which determine… |
CVE-2026-27614 | Critical | 9.3 | 2026-02-25 | Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.13, an unauthenticated attacker who can submit events to a Bugsink project can store arb… |
CVE-2026-27612 | Medium | 6.1 | 2026-02-25 | Repostat is a React component to fetch and display GitHub repository info. Prior to version 1.0.1, the `RepoCard` component is vulnerable to Reflected Cross-Si… |
CVE-2026-27611 | Medium | 6.5 | 2026-02-25 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when users share password-protected files, t… |
CVE-2026-27610 | Medium | 5.3 | 2026-02-25 | Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the `ConfigKeyCache` uses the same… |