2026 CVEs (page 411)
Page 411 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2654 | Medium | 6.3 | 2026-02-18 | A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Exec… |
CVE-2026-2464 | | 2026-02-18 | Path traversal vulnerability in the AMR Printer Management 1.01 Beta web service, which allows remote attackers to read arbitrary files from the underlying Win… | |
CVE-2026-1441 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1440 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1439 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1438 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1437 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1436 | Medium | 6.5 | 2026-02-18 | Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other us… |
CVE-2026-1435 | Critical | 9.8 | 2026-02-18 | Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. T… |
CVE-2026-2386 | Medium | 4.3 | 2026-02-18 | The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Autho… |
CVE-2026-1582 | Low | 3.7 | 2026-02-18 | The WP All Export plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.14 via the export download end… |
CVE-2026-1317 | Medium | 6.5 | 2026-02-18 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 7.37. This is… |
CVE-2026-2653 | Medium | 5.3 | 2026-02-18 | A security flaw has been discovered in admesh up to 0.98.5. This issue affects the function stl_check_normal_vector of the file src/normals.c. Performing a man… |
CVE-2026-2426 | Medium | 6.5 | 2026-02-18 | The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'file' parameter in the file del… |
CVE-2026-1942 | Medium | 6.5 | 2026-02-18 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2026-2126 | Medium | 5.3 | 2026-02-18 | The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to… |
CVE-2026-2495 | High | 7.5 | 2026-02-18 | The WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin for WordPress is vulnerable to SQL Injection via the 'order' parame… |
CVE-2026-2127 | Medium | 5.4 | 2026-02-18 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to unauthorized arbitrary shortcode execution in all versions up to, and including, 1.70.4. Th… |
CVE-2026-1941 | Medium | 6.4 | 2026-02-18 | The WP Event Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_events' shortcode in all versions up to, and inc… |
CVE-2026-1656 | Medium | 5.3 | 2026-02-18 | The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6… |
CVE-2026-1649 | Medium | 4.4 | 2026-02-18 | The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ce_venue_name' parameter in all versions up to, and including… |
CVE-2026-2419 | Low | 2.7 | 2026-02-18 | The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'download_path' configuration pa… |
CVE-2026-2112 | Medium | 4.3 | 2026-02-18 | The Dam Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing nonce verific… |
CVE-2026-1943 | Medium | 4.4 | 2026-02-18 | The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including… |
CVE-2026-1938 | Medium | 5.3 | 2026-02-18 | The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized license key deletion due to a missing authorization check on the… |
CVE-2026-1860 | Medium | 4.3 | 2026-02-18 | The Kali Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.8. This is due to the `get_item… |
CVE-2026-1831 | Low | 2.7 | 2026-02-18 | The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized plugin installation and activation due to missing capability chec… |
CVE-2026-1655 | Medium | 4.3 | 2026-02-18 | The EventPrime plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization checks in all versions up to, and including, 4… |
CVE-2026-2644 | Low | 3.3 | 2026-02-18 | A weakness has been identified in niklasso minisat up to 2.2.0. This issue affects the function Solver::value in the library core/SolverTypes.h of the componen… |
CVE-2026-2642 | Low | 3.3 | 2026-02-18 | A security vulnerability has been detected in ggreer the_silver_searcher up to 2.2.0. The impacted element is the function search_stream of the file src/search… |
CVE-2026-2633 | Medium | 4.3 | 2026-02-18 | The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.1. This is due… |
CVE-2026-2296 | High | 7.2 | 2026-02-18 | The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Code Injection in all versions up to, and includi… |
CVE-2026-2281 | Medium | 4.4 | 2026-02-18 | The Private Comment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Label text' setting in all versions up to, and including, 0.0.4… |
CVE-2026-2019 | High | 7.2 | 2026-02-18 | The Cart All In One For WooCommerce plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.1.21. This is due to insuffici… |
CVE-2026-1937 | High | 7.2 | 2026-02-18 | The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to… |
CVE-2026-1857 | Medium | 4.3 | 2026-02-18 | The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.6.1. This… |
CVE-2026-1807 | Medium | 6.4 | 2026-02-18 | The InteractiveCalculator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'interactivecalculator' shortcode in… |
CVE-2026-1666 | Medium | 6.1 | 2026-02-18 | The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in all versions up to, and including… |
CVE-2026-1640 | Medium | 4.3 | 2026-02-18 | The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin… |
CVE-2026-2641 | Low | 3.3 | 2026-02-18 | A weakness has been identified in universal-ctags ctags up to 6.2.1. The affected element is the function parseExpression/parseExprList of the file parsers/v.c… |
CVE-2026-2023 | Medium | 4.3 | 2026-02-18 | The WP Plugin Info Card plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0. This is due to missing no… |
CVE-2026-1906 | Medium | 4.3 | 2026-02-18 | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5… |
CVE-2026-1639 | Medium | 6.5 | 2026-02-18 | The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' and 'sort… |
CVE-2026-1368 | High | 7.5 | 2026-02-18 | The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated… |
CVE-2026-1304 | Medium | 4.4 | 2026-02-18 | The Membership Plugin – Restrict Content for WordPress is vulnerable to Stored Cross-Site Scripting via multiple invoice settings fields in all versions up to… |
CVE-2026-1072 | Medium | 4.3 | 2026-02-18 | The Keybase.io Verification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.5. This is due to missin… |
CVE-2026-2576 | High | 7.5 | 2026-02-18 | The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'payment' paramet… |
CVE-2026-1931 | High | 7.2 | 2026-02-18 | The Rent Fetch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'keyword' parameter in all versions up to, and including, 0.32.4 due t… |
CVE-2026-1925 | Medium | 4.3 | 2026-02-18 | The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on… |
CVE-2026-1714 | High | 8.6 | 2026-02-18 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Email Relay Abuse in all… |
CVE-2026-1296 | Medium | 6.1 | 2026-02-18 | The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficien… |
CVE-2026-1277 | Medium | 4.7 | 2026-02-18 | The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redire… |
CVE-2026-27171 | Low | 2.9 | 2026-02-18 | zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination… |
CVE-2026-23599 | High | 7.8 | 2026-02-18 | A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking ClearPass OnGuard Software for Linux. Successful exploitation of thi… |
CVE-2026-22048 | High | 7.1 | 2026-02-18 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Microsoft Entra ID (form… |
CVE-2026-1344 | Medium | 6.5 | 2026-02-18 | Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal. |
CVE-2026-26119 | High | 8.8 | 2026-02-17 | Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network. |
CVE-2026-1670 | Critical | 9.8 | 2026-02-17 | The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery… |
CVE-2026-2629 | High | 7.3 | 2026-02-17 | A weakness has been identified in jishi node-sonos-http-api up to 3776f0ee2261c924c7b7204de121a38100a08ca7. Affected is the function Promise of the file lib/tt… |
CVE-2026-2627 | High | 7.8 | 2026-02-17 | A security flaw has been discovered in Softland FBackup up to 9.9. This impacts an unknown function in the library C:\Program Files\Common Files\microsoft shar… |
CVE-2026-2623 | Medium | 6.3 | 2026-02-17 | A flaw has been found in Blossom up to 1.17.1. This issue affects the function put of the file blossom-backend/common/common-iaas/src/main/java/com/blossom/com… |
CVE-2026-2622 | Low | 3.5 | 2026-02-17 | A vulnerability was detected in Blossom up to 1.17.1. This vulnerability affects the function content of the file blossom-backend/backend/src/main/java/com/blo… |
CVE-2026-2621 | High | 7.3 | 2026-02-17 | A security vulnerability has been detected in Sciyon Koyuan Thermoelectricity Heat Network Management System 3.0. This affects an unknown part of the file /SIS… |
CVE-2026-23598 | Medium | 6.5 | 2026-02-17 | Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive inf… |
CVE-2026-23597 | Medium | 6.5 | 2026-02-17 | Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive inf… |
CVE-2026-23596 | Medium | 6.5 | 2026-02-17 | A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitati… |
CVE-2026-23595 | High | 8.8 | 2026-02-17 | An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability… |
CVE-2026-2620 | High | 7.3 | 2026-02-17 | A weakness has been identified in Huace Monitoring and Early Warning System 2.2. Affected by this issue is some unknown functionality of the file /Web/SysManag… |
CVE-2026-26357 | Medium | 5.4 | 2026-02-17 | Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabili… |
CVE-2026-22769 | Critical | 10.0 | 2026-02-17 | Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthen… |
CVE-2026-22762 | Medium | 6.5 | 2026-02-17 | Dell Avamar Server and Avamar Virtual Edition, versions prior to 19.10 SP1 with CHF338912, contain an Improper Limitation of a Pathname to a Restricted Directo… |
CVE-2026-22284 | Medium | 6.6 | 2026-02-17 | Dell SmartFabric OS10 Software, versions prior to 10.5.6.12, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vu… |
CVE-2026-0102 | Low | 3.1 | 2026-02-17 | Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consen… |
CVE-2026-2630 | High | 8.8 | 2026-02-17 | A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server where Tenable Security C… |
CVE-2026-26736 | High | 8.8 | 2026-02-17 | TOTOLINK A3002RU_V3 V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the static_ipv6 parameter in the formIpv6Setup function. |
CVE-2026-26732 | High | 8.8 | 2026-02-17 | TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the vpnUser or vpnPassword` parameters in the formFilter fun… |
CVE-2026-26731 | High | 8.8 | 2026-02-17 | TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the routernamer`parameter in the formDnsv6 function. |
CVE-2026-24734 | High | 7.5 | 2026-02-17 | Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomc… |
CVE-2026-24733 | Low | 3.7 | 2026-02-17 | Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured… |
CVE-2026-2618 | Low | 3.7 | 2026-02-17 | A vulnerability was determined in Beetel 777VR1 up to 01.00.09. This impacts an unknown function of the component SSH Service. This manipulation causes risky c… |
CVE-2026-23648 | High | 7.8 | 2026-02-17 | Glory RBG-100 recycler systems using the ISPK-08 software component contain multiple system binaries with overly permissive file permissions. Several binaries… |
CVE-2026-23647 | Critical | 9.8 | 2026-02-17 | Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authentication to the und… |
CVE-2026-2617 | Medium | 6.3 | 2026-02-17 | A vulnerability was found in Beetel 777VR1 up to 01.00.09. This affects an unknown function of the component Telnet Service/SSH Service. The manipulation resul… |
CVE-2026-2616 | High | 8.8 | 2026-02-17 | A vulnerability has been found in Beetel 777VR1 up to 01.00.09. The impacted element is an unknown function of the component Web Management Interface. The mani… |
CVE-2026-22208 | Critical | 9.6 | 2026-02-17 | OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter… |
CVE-2026-25087 | High | 7.0 | 2026-02-17 | Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IP… |
CVE-2026-23861 | Medium | 5.4 | 2026-02-17 | Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulner… |
CVE-2026-2615 | High | 7.2 | 2026-02-17 | A flaw has been found in Wavlink WL-NU516U1 up to 20251208. The affected element is the function singlePortForwardDelete of the file /cgi-bin/firewall.cgi. Exe… |
CVE-2026-2608 | Medium | 4.3 | 2026-02-17 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a… |
CVE-2026-2247 | | 2026-02-17 | SQL injection vulnerability (SQLi) in Clicldeu SaaS, specifically in the generation of reports, which occurs when a previously authenticated remote attacker ex… | |
CVE-2026-25903 | Medium | 6.6 | 2026-02-17 | Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permission… |
CVE-2026-1216 | High | 7.2 | 2026-02-17 | The RSS Aggregator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'template' parameter in all versions up to, and including, 5.0… |
CVE-2026-0829 | Medium | 5.8 | 2026-02-17 | The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This l… |
CVE-2026-1657 | Medium | 5.3 | 2026-02-17 | The EventPrime plugin for WordPress is vulnerable to unauthorized image file upload in all versions up to, and including, 4.2.8.4. This is due to the plugin re… |
CVE-2026-2592 | High | 7.7 | 2026-02-17 | The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including… |
CVE-2026-2002 | Medium | 4.4 | 2026-02-17 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form_name par… |
CVE-2026-26220 | | 2026-02-17 | LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD (prefill-decode) disaggregation mode. The PD master node… | |
CVE-2026-2439 | Critical | 9.8 | 2026-02-16 | Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defa… |
CVE-2026-2474 | High | 7.5 | 2026-02-16 | Crypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom(). The function does… |
CVE-2026-2001 | High | 8.8 | 2026-02-16 | The WowRevenue plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'Notice::install_activate_plugin… |