2026 CVEs (page 41)
Page 41 of 662 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-84706 | High | 7.6 | 2026-09-23 | A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names agai… |
CVE-2026-84691 | High | 8.7 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an adm… |
CVE-2026-84683 | High | 8.7 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update st… |
CVE-2026-82409 | | 2026-09-23 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-co… | |
CVE-2026-82407 | | 2026-09-23 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator up… | |
CVE-2026-82406 | | 2026-09-23 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not… | |
CVE-2026-82405 | | 2026-09-23 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a t… | |
CVE-2026-75884 | Critical | 9.1 | 2026-09-23 | A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing in… |
CVE-2026-68492 | | 2026-09-23 | An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitra… | |
CVE-2026-68490 | | 2026-09-23 | Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts. | |
CVE-2026-67238 | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded… | |
CVE-2026-66079 | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) return… | |
CVE-2026-66076 | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized… | |
CVE-2026-66070 | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allow… | |
CVE-2026-96872 | | 2026-09-23 | Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Win… | |
CVE-2026-96770 | | 2026-09-23 | All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when ski… | |
CVE-2026-96549 | Low | 3.3 | 2026-09-23 | A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability affects unknown code of the file ssm_p… |
CVE-2026-96548 | Medium | 5.6 | 2026-09-23 | A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resource… |
CVE-2026-96546 | Low | 2.5 | 2026-09-23 | A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in pe… |
CVE-2026-96545 | Medium | 4.4 | 2026-09-23 | An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the fi… |
CVE-2026-96541 | High | 7.5 | 2026-09-23 | A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and re… |
CVE-2026-95604 | High | 7.5 | 2026-09-23 | Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions. |
CVE-2026-95603 | High | 7.2 | 2026-09-23 | Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions. |
CVE-2026-95602 | Medium | 6.5 | 2026-09-23 | Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-95601 | Critical | 9.3 | 2026-09-23 | Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions. |
CVE-2026-95600 | Medium | 5.3 | 2026-09-23 | Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions. |
CVE-2026-95593 | High | 7.6 | 2026-09-23 | Editor SQL Injection in Ultimeter <= 3.0.8 versions. |
CVE-2026-95592 | Medium | 5.3 | 2026-09-23 | Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions. |
CVE-2026-95590 | High | 7.1 | 2026-09-23 | Subscriber SQL Injection in Tainacan <= 1.2.0 versions. |
CVE-2026-95586 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions. |
CVE-2026-95530 | Medium | 6.5 | 2026-09-23 | Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions. |
CVE-2026-95529 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions. |
CVE-2026-95528 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions. |
CVE-2026-95527 | Medium | 6.5 | 2026-09-23 | Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions. |
CVE-2026-95525 | Medium | 6.5 | 2026-09-23 | Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions. |
CVE-2026-95524 | Medium | 5.3 | 2026-09-23 | Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. |
CVE-2026-95523 | Medium | 6.5 | 2026-09-23 | Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. |
CVE-2026-95522 | High | 7.6 | 2026-09-23 | Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions. |
CVE-2026-95515 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. |
CVE-2026-95514 | Medium | 5.3 | 2026-09-23 | Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions. |
CVE-2026-95513 | High | 7.5 | 2026-09-23 | Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions. |
CVE-2026-94682 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions. |
CVE-2026-94680 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. |
CVE-2026-94679 | Medium | 5.4 | 2026-09-23 | Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions. |
CVE-2026-94671 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. |
CVE-2026-94500 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions. |
CVE-2026-94498 | Medium | 6.5 | 2026-09-23 | Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions. |
CVE-2026-94487 | High | 8.1 | 2026-09-23 | Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions. |
CVE-2026-94461 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions. |
CVE-2026-94457 | Medium | 4.8 | 2026-09-23 | Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions. |
CVE-2026-94391 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions. |
CVE-2026-94181 | High | 7.4 | 2026-09-23 | An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers request… |
CVE-2026-94179 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions. |
CVE-2026-94176 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions. |
CVE-2026-94174 | High | 7.6 | 2026-09-23 | Administrator SQL Injection in Email Log <= 2.63 versions. |
CVE-2026-94168 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions. |
CVE-2026-94124 | High | 8.5 | 2026-09-23 | Contributor SQL Injection in WP EasyCart <= 5.9.4 versions. |
CVE-2026-94118 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions. |
CVE-2026-94080 | Medium | 5.3 | 2026-09-23 | Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions. |
CVE-2026-94079 | Medium | 5.3 | 2026-09-23 | Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions. |
CVE-2026-93774 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions. |
CVE-2026-93773 | High | 8.5 | 2026-09-23 | Contributor SQL Injection in Mollie Forms <= 2.11.0 versions. |
CVE-2026-93772 | Medium | 6.5 | 2026-09-23 | Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions. |
CVE-2026-93623 | Medium | 5.3 | 2026-09-23 | Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions. |
CVE-2026-93622 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions. |
CVE-2026-93620 | Medium | 6.5 | 2026-09-23 | Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions. |
CVE-2026-93618 | Medium | 6.5 | 2026-09-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. T… |
CVE-2026-93529 | Medium | 6.5 | 2026-09-23 | Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions. |
CVE-2026-93527 | High | 8.5 | 2026-09-23 | Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions. |
CVE-2026-93526 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions. |
CVE-2026-93513 | Medium | 4.3 | 2026-09-23 | Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions. |
CVE-2026-93421 | | 2026-09-23 | Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-control… | |
CVE-2026-92730 | | 2026-09-23 | LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page. | |
CVE-2026-92700 | | 2026-09-23 | Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() us… | |
CVE-2026-92692 | | 2026-09-23 | Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines hav… | |
CVE-2026-92284 | | 2026-09-23 | Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body r… | |
CVE-2026-90905 | | 2026-09-23 | Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrat… | |
CVE-2026-90904 | | 2026-09-23 | Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() me… | |
CVE-2026-90903 | | 2026-09-23 | Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administr… | |
CVE-2026-90902 | | 2026-09-23 | Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update… | |
CVE-2026-90901 | | 2026-09-23 | Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion e… | |
CVE-2026-90900 | | 2026-09-23 | Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product r… | |
CVE-2026-90899 | | 2026-09-23 | Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser… | |
CVE-2026-84502 | Critical | 9.9 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a d… |
CVE-2026-84499 | High | 7.7 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displa… |
CVE-2026-84486 | High | 8.2 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow sch… |
CVE-2026-84474 | Critical | 9.9 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holdin… |
CVE-2026-82368 | | 2026-09-23 | Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly… | |
CVE-2026-82356 | High | 7.5 | 2026-09-23 | Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely f… |
CVE-2026-77602 | Critical | 9.9 | 2026-09-23 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated n… |
CVE-2026-77601 | High | 8.8 | 2026-09-23 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticat… |
CVE-2026-77423 | High | 7.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and displa… |
CVE-2026-77422 | High | 7.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/bui… |
CVE-2026-77421 | Medium | 6.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-contro… |
CVE-2026-77420 | Medium | 5.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/sr… |
CVE-2026-77394 | High | 7.6 | 2026-09-23 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticate… |
CVE-2026-77285 | | 2026-09-23 | OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template t… | |
CVE-2026-76648 | High | 8.5 | 2026-09-23 | CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler… |
CVE-2026-76089 | High | 7.7 | 2026-09-23 | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action i… |
CVE-2026-76087 | High | 8.2 | 2026-09-23 | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::acti… |