2026 CVEs (page 402)
Page 402 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27608 | High | 8.1 | 2026-02-25 | Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /a… |
CVE-2026-27607 | High | 8.1 | 2026-02-25 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in p… |
CVE-2026-27606 | Critical | 9.8 | 2026-02-25 | Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current… |
CVE-2026-27595 | High | 7.5 | 2026-02-25 | Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (POST `/a… |
CVE-2026-25135 | Medium | 4.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 have an information disclosure… |
CVE-2026-2914 | High | 7.8 | 2026-02-25 | CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogs |
CVE-2026-25131 | High | 8.8 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulner… |
CVE-2026-25127 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the server does not properly v… |
CVE-2026-25124 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the OpenEMR application is vul… |
CVE-2026-24896 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulner… |
CVE-2026-24849 | Critical | 9.9 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, the `disposeDocument()` method… |
CVE-2026-24847 | Medium | 6.1 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Eye Exam form module allow… |
CVE-2026-21443 | Medium | 6.1 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the `xl()` translation functio… |
CVE-2026-3137 | Medium | 5.3 | 2026-02-25 | A security vulnerability has been detected in CodeAstro Food Ordering System 1.0. This affects an unknown function of the file food_ordering.exe. Such manipula… |
CVE-2026-3135 | High | 7.3 | 2026-02-25 | A weakness has been identified in itsourcecode News Portal Project 1.0. The impacted element is an unknown function of the file /admin/add-category.php. This m… |
CVE-2026-27598 | Medium | 6.5 | 2026-02-25 | Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the `CreateNewDAG` API endpoint (`POST /api/v1/dags`) doe… |
CVE-2026-3134 | High | 7.3 | 2026-02-25 | A security flaw has been discovered in itsourcecode News Portal Project 1.0. The affected element is an unknown function of the file /newsportal/admin/edit-cat… |
CVE-2026-3133 | High | 7.3 | 2026-02-25 | A vulnerability has been found in itsourcecode Document Management System 1.0. This issue affects some unknown processing of the file /loging.php of the compon… |
CVE-2026-26351 | Medium | 4.8 | 2026-02-24 | GetSimpleCMS Community Edition (CE) versions prior to 3.3.22 (3.3.16 tested) contains a stored cross-site scripting (XSS) vulnerability in the Theme to Compone… |
CVE-2026-27593 | Critical | 9.3 | 2026-02-24 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the pa… |
CVE-2026-27572 | High | 7.5 | 2026-02-24 | Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields`… |
CVE-2026-27204 | Medium | 6.5 | 2026-02-24 | Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interfaces are susc… |
CVE-2026-27195 | High | 7.5 | 2026-02-24 | Wasmtime is a runtime for WebAssembly. Starting with Wasmtime 39.0.0, the `component-model-async` feature became the default, which brought with it a new imple… |
CVE-2026-27117 | Medium | 5.5 | 2026-02-24 | bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.11, a path traversal vulnerability (… |
CVE-2026-25899 | High | 7.5 | 2026-02-24 | Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an unbound… |
CVE-2026-25891 | High | 7.5 | 2026-02-24 | Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middle… |
CVE-2026-25882 | High | 7.5 | 2026-02-24 | Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the… |
CVE-2026-24443 | High | 8.8 | 2026-02-24 | EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the Web Reports interface… |
CVE-2026-22553 | Critical | 9.8 | 2026-02-24 | All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface. Malicious users that use the v… |
CVE-2026-21410 | Critical | 9.8 | 2026-02-24 | InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint are potentially able… |
CVE-2026-3131 | Medium | 6.5 | 2026-02-24 | Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only permiss… |
CVE-2026-3105 | High | 7.6 | 2026-02-24 | SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query co… |
CVE-2026-27477 | Medium | 5.9 | 2026-02-24 | Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 t… |
CVE-2026-26342 | Critical | 9.8 | 2026-02-24 | Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expirati… |
CVE-2026-26341 | Critical | 9.8 | 2026-02-24 | Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during inst… |
CVE-2026-26340 | High | 7.5 | 2026-02-24 | Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can… |
CVE-2026-24241 | Medium | 4.3 | 2026-02-24 | NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker could exploit an improper authentication issue. A suc… |
CVE-2026-23859 | Low | 2.7 | 2026-02-24 | Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of Server-Side Security vulnerability. A high privileged attacker with… |
CVE-2026-23858 | Medium | 5.4 | 2026-02-24 | Dell Wyse Management Suite, versions prior to WMS 5.5, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerab… |
CVE-2026-22766 | High | 7.2 | 2026-02-24 | Dell Wyse Management Suite, versions prior to WMS 5.5, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker wit… |
CVE-2026-22765 | High | 8.8 | 2026-02-24 | Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potent… |
CVE-2026-1768 | Medium | 4.3 | 2026-02-24 | A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This issue affects Devoluti… |
CVE-2026-27468 | High | 8.2 | 2026-02-24 | Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 t… |
CVE-2026-27156 | Medium | 6.1 | 2026-02-24 | NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements (`Element.run_method()`, `AgG… |
CVE-2026-26222 | Critical | 9.8 | 2026-02-24 | Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService… |
CVE-2026-25603 | Medium | 6.6 | 2026-02-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Linksys MR9600, Linksys MX4200 allows that contents of a USB dr… |
CVE-2026-27590 | Critical | 9.8 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lo… |
CVE-2026-27589 | Medium | 6.5 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a… |
CVE-2026-27588 | Critical | 9.1 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-insensitive… |
CVE-2026-27587 | Critical | 9.1 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-insensitiv… |
CVE-2026-27586 | Critical | 9.1 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS… |
CVE-2026-27585 | Medium | 6.5 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backsl… |
CVE-2026-27571 | Medium | 5.9 | 2026-02-24 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed mes… |
CVE-2026-27521 | High | 7.5 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior do not implement rate limiting or account lockout on failed login attempts, ena… |
CVE-2026-27520 | High | 7.5 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 store a user password in a client-side cookie as a Base64-encoded value accessi… |
CVE-2026-27519 | High | 7.5 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded in client-side JavaScript. Because the k… |
CVE-2026-27518 | Medium | 4.3 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior lack CSRF protections for state-changing actions in the administrative interfac… |
CVE-2026-27517 | Medium | 6.1 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior reflect unsanitized user input in the web interface, allowing an attacker to in… |
CVE-2026-27516 | High | 7.5 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior expose user passwords in plaintext within the administrative interface and HTTP… |
CVE-2026-27515 | Critical | 9.1 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 generate predictable numeric session identifiers in the web management interfac… |
CVE-2026-27507 | Critical | 9.8 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain hard-coded administrative credentials that cannot be changed by users… |
CVE-2026-23678 | High | 8.8 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerability in the traceroute diagnostic function… |
CVE-2026-3102 | Medium | 6.3 | 2026-02-24 | A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the co… |
CVE-2026-3101 | Medium | 6.3 | 2026-02-24 | A vulnerability was found in Intelbras TIP 635G 1.12.3.5. This vulnerability affects unknown code of the component Ping Handler. The manipulation results in os… |
CVE-2026-27732 | High | 8.1 | 2026-02-24 | WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches th… |
CVE-2026-27584 | High | 7.5 | 2026-02-24 | Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unaut… |
CVE-2026-27568 | Medium | 6.1 | 2026-02-24 | WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode ena… |
CVE-2026-27567 | Medium | 6.5 | 2026-02-24 | Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Payload's e… |
CVE-2026-27483 | High | 8.8 | 2026-02-24 | MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb'… |
CVE-2026-27208 | Critical | 9.2 | 2026-02-24 | bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involving OS Command Injection and Privilege E… |
CVE-2026-0402 | Medium | 4.9 | 2026-02-24 | A post-authentication Out-of-bounds Read vulnerability in SonicOS allows a remote attacker to crash a firewall. |
CVE-2026-0401 | Medium | 4.9 | 2026-02-24 | A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall. |
CVE-2026-0400 | Medium | 4.9 | 2026-02-24 | A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall. |
CVE-2026-0399 | Medium | 4.9 | 2026-02-24 | Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to improper bounds checking in a API endpoint. |
CVE-2026-2807 | Critical | 9.8 | 2026-02-24 | Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2026-2806 | Critical | 9.1 | 2026-02-24 | Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2805 | Critical | 9.8 | 2026-02-24 | Invalid pointer in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2804 | Medium | 5.4 | 2026-02-24 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2803 | High | 7.5 | 2026-02-24 | Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2802 | Medium | 4.2 | 2026-02-24 | Race condition in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2801 | High | 7.5 | 2026-02-24 | Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2800 | Critical | 9.8 | 2026-02-24 | Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2799 | Critical | 9.8 | 2026-02-24 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2798 | High | 8.8 | 2026-02-24 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2797 | Critical | 9.8 | 2026-02-24 | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2796 | Critical | 9.8 | 2026-02-24 | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2795 | Critical | 9.8 | 2026-02-24 | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2794 | High | 7.5 | 2026-02-24 | Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 148. |
CVE-2026-2793 | Critical | 9.8 | 2026-02-24 | Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence… |
CVE-2026-2792 | Critical | 9.8 | 2026-02-24 | Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruptio… |
CVE-2026-2791 | Critical | 9.8 | 2026-02-24 | Mitigation bypass in the Networking: Cache component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2790 | Critical | 9.8 | 2026-02-24 | Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 14… |
CVE-2026-2789 | Critical | 9.8 | 2026-02-24 | Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Th… |
CVE-2026-2788 | Critical | 9.8 | 2026-02-24 | Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbir… |
CVE-2026-2787 | Critical | 9.8 | 2026-02-24 | Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148… |
CVE-2026-2786 | Critical | 9.8 | 2026-02-24 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2785 | Critical | 9.8 | 2026-02-24 | Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2784 | Critical | 9.8 | 2026-02-24 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2783 | High | 7.5 | 2026-02-24 | Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thund… |
CVE-2026-2782 | Critical | 9.8 | 2026-02-24 | Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |