2026 CVEs (page 415)
Page 415 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20676 | Medium | 5.3 | 2026-02-11 | This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A we… |
CVE-2026-20675 | Medium | 5.5 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS… |
CVE-2026-20674 | Medium | 4.6 | 2026-02-11 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.3 and iPadOS 26.3. An attacker with physical access to a locked device… |
CVE-2026-20673 | Medium | 5.3 | 2026-02-11 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 2… |
CVE-2026-20671 | Low | 3.1 | 2026-02-11 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS So… |
CVE-2026-20669 | Medium | 5.5 | 2026-02-11 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Tahoe 26.3. An app may be able to… |
CVE-2026-20667 | High | 8.8 | 2026-02-11 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3… |
CVE-2026-20666 | Medium | 5.5 | 2026-02-11 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.3. An app may be able to access sensitive user data. |
CVE-2026-20663 | Low | 3.3 | 2026-02-11 | The issue was resolved by sanitizing logging. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An app may be able to enumerate a… |
CVE-2026-20662 | Medium | 4.6 | 2026-02-11 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An attacker with physical a… |
CVE-2026-20661 | Medium | 4.6 | 2026-02-11 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An attacker… |
CVE-2026-20660 | High | 7.5 | 2026-02-11 | A path handling issue was addressed with improved logic. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequ… |
CVE-2026-20658 | High | 7.8 | 2026-02-11 | A package validation issue was addressed by blocking the vulnerable package. This issue is fixed in macOS Tahoe 26.3. An app may be able to gain root privilege… |
CVE-2026-20656 | Low | 3.3 | 2026-02-11 | A logic issue was addressed with improved validation. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, macOS Tahoe 26.3. An app may be able to… |
CVE-2026-20655 | Medium | 5.5 | 2026-02-11 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An attacker… |
CVE-2026-20654 | Medium | 5.5 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26… |
CVE-2026-20653 | Medium | 5.5 | 2026-02-11 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 a… |
CVE-2026-20652 | High | 7.5 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe… |
CVE-2026-20650 | High | 7.5 | 2026-02-11 | A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3… |
CVE-2026-20649 | High | 7.5 | 2026-02-11 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3. A user… |
CVE-2026-20648 | Medium | 5.5 | 2026-02-11 | A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Tahoe 26.3. A malicious app may be able to access… |
CVE-2026-20647 | Medium | 5.5 | 2026-02-11 | This issue was addressed with improved data protection. This issue is fixed in macOS Tahoe 26.3. An app may be able to access sensitive user data. |
CVE-2026-20646 | Low | 3.3 | 2026-02-11 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.3. A malicious app may be able to read sensitive location inf… |
CVE-2026-20645 | Medium | 4.6 | 2026-02-11 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26… |
CVE-2026-20644 | Medium | 6.5 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe… |
CVE-2026-20642 | Low | 2.4 | 2026-02-11 | An input validation issue was addressed. This issue is fixed in iOS 26.3 and iPadOS 26.3. A person with physical access to an iOS device may be able to access… |
CVE-2026-20641 | High | 7.1 | 2026-02-11 | A privacy issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS… |
CVE-2026-20640 | Medium | 4.6 | 2026-02-11 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3. An attacker with physical a… |
CVE-2026-20638 | Medium | 5.5 | 2026-02-11 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3. A user with Live Caller ID app extensions turned off could h… |
CVE-2026-20636 | Medium | 6.5 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. Processin… |
CVE-2026-20635 | Medium | 4.3 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe… |
CVE-2026-20634 | Medium | 5.5 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, mac… |
CVE-2026-20630 | Medium | 5.5 | 2026-02-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.3. An app may be able to access protected user data. |
CVE-2026-20629 | Medium | 5.5 | 2026-02-11 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to access user-sensitive d… |
CVE-2026-20628 | High | 7.1 | 2026-02-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15… |
CVE-2026-20627 | Medium | 5.5 | 2026-02-11 | An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3… |
CVE-2026-20626 | High | 7.8 | 2026-02-11 | This issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Tahoe 26.3, visionOS 26.3. A malici… |
CVE-2026-20625 | Medium | 5.5 | 2026-02-11 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8… |
CVE-2026-20624 | Medium | 5.5 | 2026-02-11 | An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be ab… |
CVE-2026-20623 | Medium | 5.5 | 2026-02-11 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26.3. An app may be able to access protected user data. |
CVE-2026-20621 | Medium | 5.5 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, mac… |
CVE-2026-20620 | High | 7.7 | 2026-02-11 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. A… |
CVE-2026-20619 | Medium | 5.5 | 2026-02-11 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may be able to access sensiti… |
CVE-2026-20618 | Medium | 5.5 | 2026-02-11 | An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to access user-sensitive data. |
CVE-2026-20617 | High | 7.0 | 2026-02-11 | A race condition was addressed with improved state handling. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3… |
CVE-2026-20616 | High | 8.8 | 2026-02-11 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sonoma 14.8.4, macOS Tahoe… |
CVE-2026-20615 | High | 7.8 | 2026-02-11 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS… |
CVE-2026-20614 | High | 7.8 | 2026-02-11 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be… |
CVE-2026-20612 | Medium | 5.5 | 2026-02-11 | A privacy issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be able to a… |
CVE-2026-20611 | High | 7.8 | 2026-02-11 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS… |
CVE-2026-20610 | High | 7.8 | 2026-02-11 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.3. An app may be able to gain root privileges. |
CVE-2026-20609 | Medium | 4.4 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, mac… |
CVE-2026-20608 | Medium | 5.5 | 2026-02-11 | This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS T… |
CVE-2026-20606 | High | 7.1 | 2026-02-11 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4… |
CVE-2026-20605 | Medium | 4.6 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Ta… |
CVE-2026-20603 | Medium | 4.4 | 2026-02-11 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Tahoe 26.3. An app with root privileges may be able to… |
CVE-2026-20602 | Medium | 5.5 | 2026-02-11 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be abl… |
CVE-2026-20601 | Low | 3.3 | 2026-02-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.3. An app may be able to monitor keystrokes without user… |
CVE-2026-1669 | High | 7.5 | 2026-02-11 | Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacke… |
CVE-2026-26031 | Medium | 5.3 | 2026-02-11 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe… |
CVE-2026-26029 | High | 7.5 | 2026-02-11 | sf-mcp-server is an implementation of Salesforce MCP server for Claude for Desktop. A command injection vulnerability exists in sf-mcp-server due to unsafe use… |
CVE-2026-26023 | Medium | 6.1 | 2026-02-11 | Dify is an open-source LLM app development platform. Prior to 1.13.0, a cross site scripting vulnerability has been found in the web application chat frontend… |
CVE-2026-26021 | Critical | 9.8 | 2026-02-11 | set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (>=… |
CVE-2026-26019 | Medium | 4.1 | 2026-02-11 | LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader class in @langchain/community is a web crawler that rec… |
CVE-2026-26012 | Medium | 6.5 | 2026-02-11 | vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can re… |
CVE-2026-26158 | High | 7.0 | 2026-02-11 | A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar arc… |
CVE-2026-26157 | High | 7.0 | 2026-02-11 | A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracte… |
CVE-2026-26014 | Medium | 5.9 | 2026-02-11 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES… |
CVE-2026-26010 | High | 7.6 | 2026-02-11 | OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for cer… |
CVE-2026-25999 | High | 7.1 | 2026-02-11 | Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to 2.10.2, there is an improper access control vulnerability that allows una… |
CVE-2026-25994 | Critical | 9.8 | 2026-02-11 | PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a buffer overflow vulnerability exists in PJNATH ICE Sessio… |
CVE-2026-25990 | High | 7.5 | 2026-02-11 | Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vuln… |
CVE-2026-25935 | Medium | 5.4 | 2026-02-11 | Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since t… |
CVE-2026-25924 | High | 8.4 | 2026-02-11 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authentic… |
CVE-2026-25759 | High | 8.7 | 2026-02-11 | Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authent… |
CVE-2026-25633 | Medium | 4.3 | 2026-02-11 | Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permission to view assets are able are able t… |
CVE-2026-25062 | Medium | 5.5 | 2026-02-11 | Outline is a service that allows for collaborative documentation. Prior to 1.4.0, during the JSON import process, the value of attachments[].key from the impor… |
CVE-2026-2323 | Medium | 4.3 | 2026-02-11 | Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-2322 | Medium | 5.4 | 2026-02-11 | Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-2321 | High | 8.8 | 2026-02-11 | Use after free in Ozone in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
CVE-2026-2320 | Medium | 6.5 | 2026-02-11 | Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-2319 | High | 7.5 | 2026-02-11 | Race in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures and install a malicio… |
CVE-2026-2318 | Medium | 6.5 | 2026-02-11 | Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific U… |
CVE-2026-2317 | Medium | 6.5 | 2026-02-11 | Inappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-2316 | Medium | 6.5 | 2026-02-11 | Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-2315 | High | 8.8 | 2026-02-11 | Inappropriate implementation in WebGPU in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially perform out of bounds memory access via… |
CVE-2026-2314 | High | 8.8 | 2026-02-11 | Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-2313 | High | 8.8 | 2026-02-11 | Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2026-2361 | High | 8.0 | 2026-02-11 | PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing mali… |
CVE-2026-2360 | High | 8.0 | 2026-02-11 | PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place mal… |
CVE-2026-0229 | | 2026-02-11 | A denial-of-service (DoS) vulnerability in the Advanced DNS Security (ADNS) feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker… | |
CVE-2026-0228 | | 2026-02-11 | An improper certificate validation vulnerability in PAN-OS allows users to connect Terminal Server Agents on Windows to PAN-OS using expired certificates even… | |
CVE-2026-25084 | Critical | 9.8 | 2026-02-11 | Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs. |
CVE-2026-24789 | Critical | 9.8 | 2026-02-11 | An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication. |
CVE-2026-25869 | High | 7.5 | 2026-02-11 | MiniGal Nano versions 0.3.5 and prior contain a path traversal vulnerability in index.php via the dir parameter. The application appends user-controlled input… |
CVE-2026-25868 | Medium | 6.1 | 2026-02-11 | MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter. The application construct… |
CVE-2026-1837 | High | 7.5 | 2026-02-11 | A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized un… |
CVE-2026-2345 | Low | 3.6 | 2026-02-11 | Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers… |
CVE-2026-2344 | | 2026-02-11 | A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessMa… | |
CVE-2026-2250 | High | 7.5 | 2026-02-11 | The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite datab… |