2026 CVEs (page 410)
Page 410 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-1055 | Medium | 4.4 | 2026-02-19 | The TalkJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.1.15 due to insufficien… |
CVE-2026-1047 | Medium | 4.4 | 2026-02-19 | The salavat counter Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'image_url' parameter in all versions up to, and including… |
CVE-2026-1044 | Medium | 4.4 | 2026-02-19 | The Tennis Court Bookings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due… |
CVE-2026-1043 | Medium | 4.4 | 2026-02-19 | The PostmarkApp Email Integrator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up to, and including, 2… |
CVE-2026-0974 | High | 8.8 | 2026-02-19 | The Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin plugin for WordPress is vulnerable to unauthorized plugin installation due… |
CVE-2026-0926 | Critical | 9.8 | 2026-02-19 | The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[template_name]'… |
CVE-2026-0912 | High | 8.8 | 2026-02-19 | The Toret Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability che… |
CVE-2026-0722 | Medium | 6.5 | 2026-02-19 | The Shield Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 21.0.8. This is due to the plugin al… |
CVE-2026-0561 | Medium | 6.1 | 2026-02-19 | The Shield Security plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 21.0… |
CVE-2026-0556 | Medium | 6.4 | 2026-02-19 | The XO Event Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xo_event_field' shortcode in all versions up to, and… |
CVE-2026-0549 | Medium | 6.4 | 2026-02-19 | The Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'groups_group_info' shortcode in all versions up to, and includin… |
CVE-2026-2686 | Critical | 9.8 | 2026-02-19 | A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/session_login.cgi. The manipu… |
CVE-2026-2684 | High | 7.3 | 2026-02-19 | A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The impacted element is an unknown function of the file… |
CVE-2026-25926 | High | 7.3 | 2026-02-19 | Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows… |
CVE-2026-24126 | Medium | 6.6 | 2026-02-19 | Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which co… |
CVE-2026-2683 | Medium | 4.3 | 2026-02-18 | A vulnerability was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). The affected element is an unknown function of the file /Using/Sub… |
CVE-2026-2682 | Medium | 6.3 | 2026-02-18 | A vulnerability has been found in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). Impacted is an unknown function of the file /mine/Publi… |
CVE-2026-2676 | Medium | 6.3 | 2026-02-18 | A weakness has been identified in GoogTech sms-ssm up to e8534c766fd13f5f94c01dab475d75f286918a8d. Affected by this issue is the function preHandle of the file… |
CVE-2026-26281 | Medium | 4.4 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Su… |
CVE-2026-26270 | Medium | 5.4 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in… |
CVE-2026-25596 | Medium | 4.8 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in… |
CVE-2026-25595 | Medium | 4.8 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in… |
CVE-2026-25594 | Medium | 4.8 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in… |
CVE-2026-25548 | Critical | 9.1 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists… |
CVE-2026-24745 | Medium | 5.7 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in… |
CVE-2026-2672 | Medium | 4.3 | 2026-02-18 | A security flaw has been discovered in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is the function Download… |
CVE-2026-2670 | High | 7.2 | 2026-02-18 | A vulnerability was identified in Advantech WISE-6610 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the comp… |
CVE-2026-2669 | Medium | 6.5 | 2026-02-18 | A vulnerability was determined in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This impacts an unknown function of the file /dm/… |
CVE-2026-2650 | High | 8.8 | 2026-02-18 | Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-2649 | High | 8.8 | 2026-02-18 | Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2026-2648 | High | 8.8 | 2026-02-18 | Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF fi… |
CVE-2026-27182 | High | 8.4 | 2026-02-18 | Saturn Remote Mouse Server contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending specially… |
CVE-2026-27181 | High | 7.5 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin() method read… |
CVE-2026-27180 | Critical | 9.8 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The save… |
CVE-2026-27179 | High | 8.2 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly… |
CVE-2026-27178 | High | 7.2 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method parameter injection into the shoutbox. The /obj… |
CVE-2026-27177 | High | 7.2 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability via the /objects/?op=set endpoint, which is intentionally unau… |
CVE-2026-27176 | Medium | 6.1 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly int… |
CVE-2026-27175 | Critical | 9.8 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolat… |
CVE-2026-27174 | Critical | 9.8 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/p… |
CVE-2026-24744 | Medium | 5.7 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in… |
CVE-2026-24743 | Medium | 5.7 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in… |
CVE-2026-2668 | High | 7.3 | 2026-02-18 | A vulnerability was found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This affects an unknown function of the file /dm/dispa… |
CVE-2026-2667 | Medium | 5.3 | 2026-02-18 | A vulnerability has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. The impacted element is an unknown function of th… |
CVE-2026-24746 | Medium | 5.7 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in… |
CVE-2026-1999 | Medium | 6.5 | 2026-02-18 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to merge their own pull request into a repository… |
CVE-2026-1355 | Medium | 6.5 | 2026-02-18 | A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user’s repo… |
CVE-2026-1200 | Medium | 6.3 | 2026-02-18 | A flaw was found in the rgaufman/live555 fork of live555. A remote attacker could exploit a segmentation fault, in the `increaseBufferTo` function. This vulner… |
CVE-2026-0665 | Medium | 6.5 | 2026-02-18 | An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process… |
CVE-2026-0573 | Critical | 9.0 | 2026-02-18 | An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens… |
CVE-2026-2666 | Medium | 4.7 | 2026-02-18 | A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the component Template Arch… |
CVE-2026-2665 | Medium | 6.3 | 2026-02-18 | A vulnerability was detected in huanzi-qch base-admin up to 57a8126bb3353a004f3c7722089e3b926ea83596. Impacted is the function Upload of the file SysFileContro… |
CVE-2026-2663 | Medium | 6.3 | 2026-02-18 | A security vulnerability has been detected in Alixhan xh-admin-backend up to 1.7.0. This issue affects some unknown processing of the file /frontend-api/system… |
CVE-2026-2662 | Low | 3.3 | 2026-02-18 | A weakness has been identified in FascinatedBox lily up to 2.3. This vulnerability affects the function count_transforms of the file src/lily_emitter.c. This m… |
CVE-2026-2661 | Low | 3.3 | 2026-02-18 | A security flaw has been discovered in Squirrel up to 3.2. This affects the function SQObjectPtr::operator in the library squirrel/sqobject.h. The manipulation… |
CVE-2026-25500 | Medium | 5.4 | 2026-02-18 | Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file e… |
CVE-2026-23491 | High | 7.5 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the `get_file` met… |
CVE-2026-0875 | High | 7.8 | 2026-02-18 | A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage… |
CVE-2026-0874 | High | 7.8 | 2026-02-18 | A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may levera… |
CVE-2026-2660 | Low | 3.3 | 2026-02-18 | A vulnerability was identified in FascinatedBox lily up to 2.3. Affected by this issue is the function shorthash_for_name of the file src/lily_symtab.c. The ma… |
CVE-2026-22860 | High | 7.5 | 2026-02-18 | Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expa… |
CVE-2026-2659 | Low | 3.3 | 2026-02-18 | A vulnerability was determined in Squirrel up to 3.2. Affected by this vulnerability is the function SQFuncState::PopTarget of the file src/squirrel/squirrel/s… |
CVE-2026-2658 | Medium | 4.3 | 2026-02-18 | A vulnerability was found in newbee-ltd newbee-mall up to a069069b07027613bf0e7f571736be86f431faee. Affected is an unknown function of the component Multiple E… |
CVE-2026-24708 | High | 8.2 | 2026-02-18 | An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk… |
CVE-2026-20144 | Medium | 6.8 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.8, and 9.2.11, and Splunk Cloud Platform versions below 10.2.2510.0, 10.1.2507.11, 10.0.2503.9… |
CVE-2026-20142 | Medium | 6.8 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with acc… |
CVE-2026-20141 | Medium | 4.3 | 2026-02-18 | In Splunk Enterprise versions below 10.0.2, 10.0.3, 9.4.8, and 9.3.9, a low-privileged user who does not hold the "admin" Splunk role could access the Splunk M… |
CVE-2026-20139 | Medium | 4.3 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12, and Splunk Cloud Platform versions below 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, a… |
CVE-2026-20138 | Medium | 6.8 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with acc… |
CVE-2026-20137 | Low | 3.5 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, a… |
CVE-2026-2657 | Low | 3.3 | 2026-02-18 | A vulnerability has been found in wren-lang wren up to 0.4.0. This impacts the function printError of the file src/vm/wren_compiler.c of the component Error Me… |
CVE-2026-2507 | High | 7.5 | 2026-02-18 | When BIG-IP AFM or BIG-IP DDoS is provisioned, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Sup… |
CVE-2026-2230 | Medium | 4.3 | 2026-02-18 | The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 via the handle_ajax_… |
CVE-2026-23230 | High | 8.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease… |
CVE-2026-23229 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - Add spinlock protection with virtqueue notification When VM boots with o… |
CVE-2026-23228 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() On kthread_run() f… |
CVE-2026-23227 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to… |
CVE-2026-23226 | High | 8.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock to protect ksmbd_chann_list xarray ksmbd_chann_list xarray lacks sy… |
CVE-2026-23225 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Don't assume CID is CPU owned on mode switch Shinichiro reported a KASAN UAF… |
CVE-2026-23224 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue for file-backed mounts w/ directio option [ 9.269940][ T3222] Cal… |
CVE-2026-23223 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in xchk_btree_check_block_owner We cannot dereference bs->cur when trying to… |
CVE-2026-23222 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly The existing alloca… |
CVE-2026-23221 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix use-after-free in driver_override_show() The driver_override_show() func… |
CVE-2026-23220 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths The problem… |
CVE-2026-2656 | Low | 2.5 | 2026-02-18 | A flaw has been found in ChaiScript up to 6.1.0. This affects the function chaiscript::Type_Info::bare_equal of the file include/chaiscript/dispatchkit/type_in… |
CVE-2026-2329 | Critical | 9.8 | 2026-02-18 | An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulne… |
CVE-2026-27100 | Medium | 4.3 | 2026-02-18 | Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, all… |
CVE-2026-27099 | High | 8.0 | 2026-02-18 | Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporari… |
CVE-2026-23219 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single When CONFIG_MEM_AL… |
CVE-2026-23218 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc() Fix incorrect NULL ch… |
CVE-2026-23217 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: riscv: trace: fix snapshot deadlock with sbi ecall If sbi_ecall.c's functions are traceab… |
CVE-2026-23216 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_co… |
CVE-2026-23215 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: x86/vmware: Fix hypercall clobbers Fedora QA reported the following panic: BUG: unable… |
CVE-2026-23214 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: btrfs: reject new transactions if the fs is fully read-only [BUG] There is a bug report w… |
CVE-2026-23213 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Disable MMIO access during SMU Mode 1 reset During Mode 1 reset, the ASIC und… |
CVE-2026-23212 | Medium | 4.7 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: bonding: annotate data-races around slave->last_rx slave->last_rx and slave->target_last_… |
CVE-2026-23211 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: mm, swap: restore swap_space attr aviod kernel panic commit 8b47299a411a ("mm, swap: mark… |
CVE-2026-1426 | High | 8.8 | 2026-02-18 | The Advanced AJAX Product Filters plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.9.6 via deserialization… |
CVE-2026-1404 | Medium | 6.1 | 2026-02-18 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Reflec… |
CVE-2026-2655 | Low | 2.5 | 2026-02-18 | A vulnerability was detected in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::str_less::operator of the file include/chaiscript/chai… |