2026 CVEs (page 407)
Page 407 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22346 | High | 8.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow slider-responsive-slideshow allows O… |
CVE-2026-22345 | High | 8.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery new-image-gallery allo… |
CVE-2026-22344 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes FiveStar fivestar allows… |
CVE-2026-22341 | Medium | 6.7 | 2026-02-20 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Case-Themes Booked booked allows Authentication Abuse.This issue affects Booked: from… |
CVE-2026-20761 | High | 8.1 | 2026-02-20 | A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to s… |
CVE-2026-21627 | | 2026-02-20 | The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions… | |
CVE-2026-2486 | Medium | 6.4 | 2026-02-20 | The Master Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ma_el_bh_table_btn_text' parameter in versions up to… |
CVE-2026-21620 | | 2026-02-20 | Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file mod… | |
CVE-2026-26050 | High | 7.8 | 2026-02-20 | The installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール versions prior to Ver.1.3.7 contains an issue with the DLL search path, which may lead to insecurely loading… |
CVE-2026-26370 | Medium | 6.1 | 2026-02-20 | WordPress Plugin "Survey Maker" versions 5.1.7.7 and prior contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary scrip… |
CVE-2026-2825 | Low | 3.5 | 2026-02-20 | A vulnerability has been found in rachelos WeRSS we-mp-rss up to 1.4.8. This impacts the function fix_html of the file tools/fix.py of the component Article Mo… |
CVE-2026-2824 | Medium | 6.3 | 2026-02-20 | A flaw has been found in Comfast CF-E7 2.6.0.9. This affects the function sub_441CF4 of the file /cgi-bin/mbox-config?method=SET§ion=ping_config of the com… |
CVE-2026-2823 | Medium | 6.3 | 2026-02-20 | A vulnerability was detected in Comfast CF-E7 2.6.0.9. The impacted element is the function sub_41ACCC of the file /cgi-bin/mbox-config?method=SET§ion=ntp_… |
CVE-2026-2822 | Medium | 6.3 | 2026-02-20 | A security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airag… |
CVE-2026-2739 | Medium | 5.3 | 2026-02-20 | This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and oth… |
CVE-2026-2821 | High | 7.3 | 2026-02-20 | A weakness has been identified in Fujian Smart Integrated Management Platform System up to 7.5. Impacted is an unknown function of the file /Module/CRXT/Contro… |
CVE-2026-2384 | Medium | 6.4 | 2026-02-20 | The Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `vc_quizmaker` shortcode in all versions up to, and including… |
CVE-2026-27017 | Medium | 5.3 | 2026-02-20 | uTLS is a fork of crypto/tls, created to customize ClientHello for fingerprinting resistance while still using it for the handshake. Versions 1.6.0 through 1.8… |
CVE-2026-26996 | High | 7.5 | 2026-02-20 | minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Exp… |
CVE-2026-26994 | Medium | 6.5 | 2026-02-20 | uTLS is a fork of crypto/tls, created to customize ClientHello for fingerprinting resistance while still using it for the handshake. In versions 1.6.7 and belo… |
CVE-2026-26993 | Medium | 4.6 | 2026-02-20 | Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Versions 1.7.0 and below allow users to upload files witho… |
CVE-2026-26992 | Medium | 4.8 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the port group name is not sanitized, allowing atta… |
CVE-2026-26991 | Medium | 4.8 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the device group name is not sanitized, allowing at… |
CVE-2026-2820 | High | 7.3 | 2026-02-20 | A security flaw has been discovered in Fujian Smart Integrated Management Platform System up to 7.5. This issue affects some unknown processing of the file /Mo… |
CVE-2026-2819 | Medium | 6.3 | 2026-02-20 | A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3. This vulnerability affects the function SaServletFilter of the file /workflow/instance/de… |
CVE-2026-27016 | Medium | 5.4 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit paramet… |
CVE-2026-26990 | High | 8.8 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in… |
CVE-2026-26989 | Medium | 4.3 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vu… |
CVE-2026-26988 | Critical | 9.1 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_tab… |
CVE-2026-26987 | Medium | 6.1 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email fie… |
CVE-2026-26980 | Critical | 9.4 | 2026-02-20 | Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This… |
CVE-2026-26977 | Medium | 5.3 | 2026-02-20 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are abl… |
CVE-2026-26960 | High | 7.1 | 2026-02-20 | node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink insid… |
CVE-2026-26065 | High | 8.8 | 2026-02-20 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal… |
CVE-2026-26064 | High | 8.8 | 2026-02-20 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerab… |
CVE-2026-26975 | High | 8.8 | 2026-02-20 | Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthentica… |
CVE-2026-26974 | Critical | 9.8 | 2026-02-20 | Slyde is a program that creates animated presentations from XML. In versions 0.0.4 and below, Node.js automatically imports **/*.plugin.{js,mjs} files includin… |
CVE-2026-26967 | Medium | 5.3 | 2026-02-20 | PJSIP is a free and open source multimedia communication library written in C. In versions 2.16 and below, there is a critical Heap-based Buffer Overflow vulne… |
CVE-2026-2605 | Medium | 5.3 | 2026-02-20 | Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS. |
CVE-2026-2435 | Medium | 6.3 | 2026-02-20 | Tanium addressed a SQL injection vulnerability in Asset. |
CVE-2026-2408 | Medium | 4.7 | 2026-02-20 | Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension. |
CVE-2026-2350 | Medium | 6.5 | 2026-02-20 | Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS. |
CVE-2026-27009 | Medium | 5.8 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar)… |
CVE-2026-27008 | Medium | 6.7 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a bug in `download` skill installation allowed `targetDir` values from skill frontmatter to re… |
CVE-2026-27007 | Low | 3.3 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, `normalizeForHash` in `src/agents/sandbox/config-hash.ts` recursively sorted arrays that conta… |
CVE-2026-27004 | Medium | 5.5 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in some shared-agent deployments, OpenClaw session tools (`sessions_list`, `sessions_history`… |
CVE-2026-27003 | Medium | 5.5 | 2026-02-20 | OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include `https://api.tel… |
CVE-2026-27002 | Critical | 9.8 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker option… |
CVE-2026-27001 | High | 7.8 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, OpenClaw embedded the current working directory (workspace path) into the agent system prompt… |
CVE-2026-26972 | Medium | 6.7 | 2026-02-20 | OpenClaw is a personal AI assistant. In versions 2026.1.12 through 2026.2.12, OpenClaw browser download helpers accepted an unsanitized output path. When invok… |
CVE-2026-26964 | Low | 2.7 | 2026-02-20 | Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to… |
CVE-2026-26963 | Medium | 6.1 | 2026-02-20 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from… |
CVE-2026-26959 | High | 7.8 | 2026-02-20 | ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below fail to validate the integrity or authenticity of the ADB binary path specified in… |
CVE-2026-26329 | Medium | 6.5 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.14, authenticated attackers can read arbitrary files from the Gateway host by supplying absolute p… |
CVE-2026-26328 | Medium | 6.5 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender ident… |
CVE-2026-1292 | Medium | 6.5 | 2026-02-20 | Tanium addressed an insertion of sensitive information into log file vulnerability in Trends. |
CVE-2026-26958 | | 2026-02-19 | filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and ear… | |
CVE-2026-26953 | Medium | 5.4 | 2026-02-19 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.0 and above have a S… |
CVE-2026-26952 | Medium | 5.4 | 2026-02-19 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.4 and below are vulne… |
CVE-2026-26327 | Medium | 6.5 | 2026-02-19 | OpenClaw is a personal AI assistant. Discovery beacons (Bonjour/mDNS and DNS-SD) include TXT records such as `lanHost`, `tailnetDns`, `gatewayPort`, and `gatew… |
CVE-2026-26326 | Medium | 4.3 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to version 2026.2.14, `skills.status` could disclose secrets to `operator.read` clients by returning raw resolved co… |
CVE-2026-26325 | High | 7.2 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to version 2026.2.14, a mismatch between `rawCommand` and `command[]` in the node host `system.run` handler could ca… |
CVE-2026-26324 | High | 7.5 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to version 2026.2.14, OpenClaw's SSRF protection could be bypassed using full-form IPv4-mapped IPv6 literals such as… |
CVE-2026-26323 | High | 8.8 | 2026-02-19 | OpenClaw is a personal AI assistant. Versions 2026.1.8 through 2026.2.13 have a command injection in the maintainer/dev script `scripts/update-clawtributors.ts… |
CVE-2026-26322 | High | 7.6 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Gateway tool accepted a tool-supplied `gatewayUrl` without sufficient restriction… |
CVE-2026-26321 | High | 7.5 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Feishu extension previously allowed `sendMediaFeishu` to treat attacker-controlle… |
CVE-2026-26320 | Medium | 6.5 | 2026-02-19 | OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the `openclaw://` URL scheme. For `openclaw://agent` deep links without an unatten… |
CVE-2026-26319 | High | 7.5 | 2026-02-19 | OpenClaw is a personal AI assistant. Versions 2026.2.13 and below allow the optional @openclaw/voice-call plugin Telnyx webhook handler to accept unsigned inbo… |
CVE-2026-24122 | Low | 3.7 | 2026-02-19 | Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires bef… |
CVE-2026-21535 | High | 8.2 | 2026-02-19 | Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network. |
CVE-2026-1658 | Medium | 5.3 | 2026-02-19 | User Interface (UI) Misrepresentation of Critical Information vulnerability in OpenText™ Directory Services allows Cache Poisoning. The vulnerability could b… |
CVE-2026-26744 | Medium | 5.3 | 2026-02-19 | A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The applicati… |
CVE-2026-26317 | High | 7.1 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to 2026.2.14, browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origi… |
CVE-2026-26316 | High | 7.5 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to 2026.2.13, the optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based… |
CVE-2026-26315 | High | 7.5 | 2026-02-19 | go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography imple… |
CVE-2026-26314 | High | 7.5 | 2026-02-19 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, a vulnerable node can be forced to shutdown/cr… |
CVE-2026-26275 | High | 7.5 | 2026-02-19 | httpsig-hyper is a hyper extension for http message signatures. An issue was discovered in `httpsig-hyper` prior to version 0.0.23 where Digest header verifica… |
CVE-2026-2738 | | 2026-02-19 | Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag… | |
CVE-2026-27476 | Critical | 9.8 | 2026-02-19 | RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism that accepts hex-encoded instructions over UDP port 5005 without pr… |
CVE-2026-27440 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred allows Stored XSS.This issue aff… |
CVE-2026-27387 | Medium | 5.4 | 2026-02-19 | Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-27368 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Exploiting Incorrectly C… |
CVE-2026-27360 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored… |
CVE-2026-27343 | High | 7.5 | 2026-02-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VanKarWai Airtifact airtifact allows P… |
CVE-2026-27328 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in DevsBlink EduBlink edublink allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects E… |
CVE-2026-27327 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in YayCommerce YayMail yaymail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Y… |
CVE-2026-27114 | High | 7.5 | 2026-02-19 | NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, circular `NextOffset` chains cause an infinite loop in… |
CVE-2026-27014 | Medium | 5.5 | 2026-02-19 | NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, circular `NextOffset` chains cause an infinite loop, and… |
CVE-2026-26313 | High | 7.5 | 2026-02-19 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.17.0, an attacker can cause high memory usage by sen… |
CVE-2026-26312 | Medium | 6.5 | 2026-02-19 | Stalwart is a mail and collaboration server. A denial-of-service vulnerability exists in Stalwart Mail Server versions 0.13.0 through 0.15.4 where accessing a… |
CVE-2026-26286 | High | 8.5 | 2026-02-19 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2026-26282 | Medium | 6.6 | 2026-02-19 | NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, NanaZip has an out-of-bounds heap read in `.NET Single F… |
CVE-2026-27013 | High | 7.6 | 2026-02-19 | Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies `escapeXml()` to text content during SVG export (`src/shapes/Text/Tex… |
CVE-2026-26318 | High | 8.8 | 2026-02-19 | systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` out… |
CVE-2026-26280 | High | 8.4 | 2026-02-19 | systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` fu… |
CVE-2026-26278 | High | 7.5 | 2026-02-19 | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4… |
CVE-2026-26267 | High | 7.5 | 2026-02-19 | soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the `#[contractimpl]` macro contains a bug in how it wires up f… |
CVE-2026-26205 | | 2026-02-19 | opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is… | |
CVE-2026-26203 | Medium | 6.5 | 2026-02-19 | PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 p… |
CVE-2026-26202 | High | 7.5 | 2026-02-19 | Penpot is an open-source design tool for design and code collaboration. Prior to version 2.13.2, an authenticated user can read arbitrary files from the server… |