2026 CVEs (page 405)
Page 405 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2906 | High | 8.8 | 2026-02-22 | A security flaw has been discovered in Tenda HG9 300001138. Affected is an unknown function of the file /boaform/formSamba of the component Samba Configuration… |
CVE-2026-2905 | High | 8.8 | 2026-02-22 | A vulnerability was identified in Tenda HG9 300001138. This impacts an unknown function of the file /boaform/formWlanSetup of the component Wireless Configurat… |
CVE-2026-2904 | High | 8.8 | 2026-02-22 | A vulnerability was determined in UTT HiPER 810G 1.7.7-171114. This affects the function strcpy of the file /goform/ConfigExceptAli. Executing a manipulation c… |
CVE-2026-2903 | Low | 3.3 | 2026-02-22 | A flaw has been found in skvadrik re2c up to 4.4. Impacted is the function check_and_merge_special_rules of the file src/parse/ast.cc. This manipulation causes… |
CVE-2026-2898 | Medium | 5.5 | 2026-02-22 | A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the… |
CVE-2026-2897 | Low | 2.4 | 2026-02-22 | A security vulnerability has been detected in funadmin up to 7.1.0-rc4. This vulnerability affects unknown code of the file app/backend/view/index/index.html o… |
CVE-2026-2896 | High | 7.3 | 2026-02-22 | A weakness has been identified in funadmin up to 7.1.0-rc4. This affects the function setConfig of the file app/backend/controller/Ajax.php of the component Co… |
CVE-2026-2895 | Low | 3.7 | 2026-02-21 | A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php… |
CVE-2026-2894 | Medium | 5.3 | 2026-02-21 | A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of the file app/frontend/view/login/forget… |
CVE-2026-2889 | Low | 3.3 | 2026-02-21 | A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation resul… |
CVE-2026-2887 | Low | 3.3 | 2026-02-21 | A security vulnerability has been detected in aardappel lobster up to 2025.4. This impacts the function lobster::TypeName in the library dev/src/lobster/idents… |
CVE-2026-2886 | High | 8.8 | 2026-02-21 | A weakness has been identified in Tenda A21 1.0.0.0. This affects the function set_device_name of the file /goform/SetOnlineDevName. This manipulation of the a… |
CVE-2026-2885 | High | 8.8 | 2026-02-21 | A security flaw has been discovered in D-Link DWR-M960 1.01.07. The impacted element is the function sub_469104 of the file /boafrm/formIpv6Setup. The manipula… |
CVE-2026-2884 | High | 8.8 | 2026-02-21 | A vulnerability was identified in D-Link DWR-M960 1.01.07. The affected element is the function sub_41914C of the file /boafrm/formWanConfigSetup of the compon… |
CVE-2026-2883 | High | 8.8 | 2026-02-21 | A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_427D74 of the file /boafrm/formIpQoS. Executing a manipulation of the a… |
CVE-2026-2882 | High | 8.8 | 2026-02-21 | A vulnerability was found in D-Link DWR-M960 1.01.07. This issue affects the function sub_46385C of the file /boafrm/formDosCfg. Performing a manipulation of t… |
CVE-2026-2881 | High | 8.8 | 2026-02-21 | A vulnerability has been found in D-Link DWR-M960 1.01.07. This vulnerability affects the function sub_425FF8 of the file /boafrm/formFirewallAdv of the compon… |
CVE-2026-2877 | High | 8.8 | 2026-02-21 | A vulnerability has been found in Tenda A18 15.13.07.13. This affects the function strcpy of the file /goform/WifiExtraSet of the component Httpd Service. The… |
CVE-2026-2876 | High | 8.8 | 2026-02-21 | A vulnerability was determined in Tenda A18 15.13.07.13. This affects the function parse_macfilter_rule of the file /goform/setBlackRule. This manipulation of… |
CVE-2026-2874 | High | 8.8 | 2026-02-21 | A flaw has been found in Tenda A21 1.0.0.0. Impacted is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. Executing a manipula… |
CVE-2026-2873 | High | 8.8 | 2026-02-21 | A vulnerability was detected in Tenda A21 1.0.0.0. This issue affects the function setSchedWifi of the file /goform/openSchedWifi. Performing a manipulation of… |
CVE-2026-2872 | High | 8.8 | 2026-02-21 | A security vulnerability has been detected in Tenda A21 1.0.0.0. This vulnerability affects the function set_device_name of the file /goform/setBlackRule of th… |
CVE-2026-2871 | High | 8.8 | 2026-02-21 | A weakness has been identified in Tenda A21 1.0.0.0. This affects the function fromSetIpMacBind of the file /goform/SetIpMacBind. This manipulation of the argu… |
CVE-2026-2870 | High | 8.8 | 2026-02-21 | A security flaw has been discovered in Tenda A21 1.0.0.0. Affected by this issue is the function set_qosMib_list of the file /goform/formSetQosBand. The manipu… |
CVE-2026-2869 | Low | 3.3 | 2026-02-21 | A vulnerability was identified in janet-lang janet up to 1.40.1. Affected by this vulnerability is the function janetc_varset of the file src/core/specials.c o… |
CVE-2026-2867 | High | 7.3 | 2026-02-21 | A vulnerability was determined in itsourcecode Vehicle Management System 1.0. Affected is an unknown function of the file /billaction.php. Executing a manipula… |
CVE-2026-27579 | High | 7.4 | 2026-02-21 | CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the application is miscon… |
CVE-2026-27574 | Critical | 9.9 | 2026-02-21 | OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm mod… |
CVE-2026-27492 | Medium | 4.7 | 2026-02-21 | Lettermint Node.js SDK is the official Node.js SDK for Lettermint. In versions 1.5.0 and below, email properties (such as to, subject, html, text, and attachme… |
CVE-2026-1787 | Medium | 4.8 | 2026-02-21 | The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability c… |
CVE-2026-27576 | Medium | 4.0 | 2026-02-21 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the ACP bridge accepts very large prompt text blocks and can assemble oversized prompt pa… |
CVE-2026-27488 | High | 7.3 | 2026-02-21 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook tar… |
CVE-2026-27487 | High | 7.6 | 2026-02-21 | OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain credential refresh path constructed a shell com… |
CVE-2026-27486 | Medium | 5.3 | 2026-02-21 | OpenClaw is a personal AI assistant. In versions 2026.2.13 and below of the OpenClaw CLI, the process cleanup uses system-wide process enumeration and pattern… |
CVE-2026-27485 | Medium | 4.4 | 2026-02-21 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, skills/skill-creator/scripts/package_skill.py (a local helper script used when authors pa… |
CVE-2026-27484 | Medium | 4.3 | 2026-02-21 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling (timeout, kick, ban) uses sender identity from req… |
CVE-2026-27482 | Medium | 5.9 | 2026-02-21 | Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE en… |
CVE-2026-27480 | Medium | 5.3 | 2026-02-21 | Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enu… |
CVE-2026-27479 | High | 7.7 | 2026-02-21 | Wallos is an open-source, self-hostable personal subscription tracker. Versions 4.6.0 and below contain a Server-Side Request Forgery (SSRF) vulnerability in t… |
CVE-2026-2865 | High | 7.3 | 2026-02-21 | A vulnerability was found in itsourcecode Agri-Trading Online Shopping System 1.0. This impacts an unknown function of the file admin/productcontroller.php of… |
CVE-2026-2864 | Medium | 5.4 | 2026-02-21 | A vulnerability has been found in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. This affects the function pictu… |
CVE-2026-27470 | High | 8.8 | 2026-02-21 | ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-o… |
CVE-2026-27469 | Medium | 6.1 | 2026-02-21 | Isso is a lightweight commenting server written in Python and JavaScript. In commits before 0afbfe0691ee237963e8fb0b2ee01c9e55ca2144, there is a stored Cross-S… |
CVE-2026-27467 | Low | 2.0 | 2026-02-21 | BigBlueButton is an open-source virtual classroom. In versions 3.0.19 and below, when first joining a session with the microphone muted, the client sends audio… |
CVE-2026-27466 | High | 7.2 | 2026-02-21 | BigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for "Server Customization" on Support for ClamAV as… |
CVE-2026-27464 | High | 7.7 | 2026-02-21 | Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve s… |
CVE-2026-27471 | Critical | 9.1 | 2026-02-21 | ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access… |
CVE-2026-27458 | Medium | 5.4 | 2026-02-21 | LinkAce is a self-hosted archive to collect website links. Versions 2.4.2 and below have a Stored Cross-site Scripting vulnerability through the Atom feed endp… |
CVE-2026-27452 | Medium | 5.3 | 2026-02-21 | ASN.1 TypeScript ESM library, including codecs for Basic Encoding Rules (BER) and Distinguished Encoding Rules (DER). In versions 11.0.5 and below, in some cas… |
CVE-2026-27206 | High | 8.1 | 2026-02-21 | Zumba Json Serializer is a library to serialize PHP variables in JSON format. In versions 3.2.2 and below, the library allows deserialization of PHP objects fr… |
CVE-2026-2863 | Medium | 5.4 | 2026-02-21 | A flaw has been found in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. The impacted element is the function del… |
CVE-2026-2861 | Medium | 5.3 | 2026-02-21 | A vulnerability was detected in Foswiki up to 2.1.10. The affected element is an unknown function of the component Changes/Viewfile/Oops. The manipulation resu… |
CVE-2026-27212 | High | 7.8 | 2026-02-21 | Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vu… |
CVE-2026-27211 | Critical | 10.0 | 2026-02-21 | Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. Versions 34.0 through 50.0 arevulnerable to arbitrary host file exfiltration (constrained by… |
CVE-2026-27210 | Medium | 6.1 | 2026-02-21 | Pannellum is a lightweight, free, and open source panorama viewer for the web. In versions 3.5.0 through 2.5.6, the hot spot attributes configuration property… |
CVE-2026-27205 | Medium | 4.3 | 2026-02-21 | Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set th… |
CVE-2026-27199 | Medium | 5.3 | 2026-02-21 | Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded… |
CVE-2026-27198 | High | 8.8 | 2026-02-21 | Formwork is a flat file-based Content Management System (CMS). In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorizat… |
CVE-2026-26047 | Medium | 6.5 | 2026-02-21 | A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient execution time limits c… |
CVE-2026-26046 | High | 7.2 | 2026-02-21 | A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection. O… |
CVE-2026-26045 | High | 7.2 | 2026-02-21 | A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicio… |
CVE-2026-2860 | Medium | 6.3 | 2026-02-21 | A security vulnerability has been detected in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. Impacted is an unkn… |
CVE-2026-27197 | Critical | 9.1 | 2026-02-21 | Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO imple… |
CVE-2026-27196 | High | 8.1 | 2026-02-21 | Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS… |
CVE-2026-27194 | Critical | 9.8 | 2026-02-21 | D-Tale is a visualizer for pandas data structures. Versions prior to 3.20.0 are vulnerable to Remote Code Execution through the /save-column-filter endpoint. U… |
CVE-2026-27193 | Medium | 5.3 | 2026-02-21 | Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, all HTTP request header… |
CVE-2026-27192 | High | 8.1 | 2026-02-21 | Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, origin validation uses… |
CVE-2026-27191 | Medium | 6.1 | 2026-02-21 | Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.39 and below the redirect query paramete… |
CVE-2026-27203 | High | 8.3 | 2026-02-21 | eBay API MCP Server is an open source local MCP server providing AI assistants with comprehensive access to eBay's Sell APIs. All versions are vulnerable to En… |
CVE-2026-27202 | High | 7.5 | 2026-02-21 | GetSimple CMS is a content management system. All versions of GetSimple CMS have a flaw in the Uploaded Files feature that allows for arbitrary file reads. Thi… |
CVE-2026-27189 | Medium | 6.6 | 2026-02-21 | OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Versions 1.1.2-alpha and below, use non-atomic and insu… |
CVE-2026-27170 | High | 7.1 | 2026-02-21 | OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. In versions 1.1.2-alpha and below, URL ingest allows ov… |
CVE-2026-27169 | High | 8.9 | 2026-02-21 | OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Versions 1.1.2-alpha and below render untrusted user/mo… |
CVE-2026-27168 | High | 8.8 | 2026-02-21 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. All versions are vulnerable to Heap-base… |
CVE-2026-27161 | High | 7.5 | 2026-02-21 | GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/… |
CVE-2026-27147 | Medium | 5.4 | 2026-02-21 | GetSimple CMS is a content management system. All versions of GetSimple CMS are vulnerable to XSS through SVG file uploads. Authenticated users can upload SVG… |
CVE-2026-27146 | Medium | 4.5 | 2026-02-21 | GetSimple CMS is a content management system. All versions of GetSimple CMS do not implement CSRF protection on the administrative file upload endpoint. As a r… |
CVE-2026-27134 | High | 8.1 | 2026-02-21 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when… |
CVE-2026-2635 | High | 7.3 | 2026-02-20 | MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installatio… |
CVE-2026-2492 | High | 7.8 | 2026-02-20 | TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privil… |
CVE-2026-2490 | Medium | 5.5 | 2026-02-20 | RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive… |
CVE-2026-2048 | High | 7.8 | 2026-02-20 | GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2026-2047 | High | 7.8 | 2026-02-20 | GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-2045 | High | 7.3 | 2026-02-20 | GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2026-2044 | High | 8.8 | 2026-02-20 | GIMP PGM File Parsing Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2026-2043 | High | 8.8 | 2026-02-20 | Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2026-2042 | High | 8.8 | 2026-02-20 | Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2026-2041 | High | 8.8 | 2026-02-20 | Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2026-2040 | High | 7.3 | 2026-02-20 | PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escala… |
CVE-2026-2039 | Critical | 9.8 | 2026-02-20 | GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affec… |
CVE-2026-2038 | Critical | 9.8 | 2026-02-20 | GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affect… |
CVE-2026-2037 | High | 8.8 | 2026-02-20 | GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2026-2036 | High | 8.8 | 2026-02-20 | GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2026-2035 | Medium | 6.8 | 2026-02-20 | Deciso OPNsense diag_backup.php filename Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute… |
CVE-2026-2034 | High | 7.8 | 2026-02-20 | Sante DICOM Viewer Pro DCM File Parsing Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2026-2033 | High | 7.3 | 2026-02-20 | MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2026-27133 | Medium | 5.9 | 2026-02-20 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a cha… |
CVE-2026-27125 | Medium | 6.8 | 2026-02-20 | svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inheri… |
CVE-2026-27122 | Medium | 5.4 | 2026-02-20 | svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not valid… |
CVE-2026-27121 | Medium | 5.4 | 2026-02-20 | svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When u… |