2026 CVEs (page 416)
Page 416 of 682 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44792 | Critical | 9.0 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an attacker with write access to the git repository connected to an… |
CVE-2026-44791 | Critical | 9.9 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows… |
CVE-2026-44790 | High | 8.8 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows… |
CVE-2026-44789 | Critical | 9.9 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows… |
CVE-2026-42867 | Medium | 6.5 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases… |
CVE-2026-34917 | Medium | 4.3 | 2026-06-23 | Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restricted to admin users… |
CVE-2026-34916 | High | 8.8 | 2026-06-23 | A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical p… |
CVE-2026-34915 | Medium | 6.1 | 2026-06-23 | A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to exploit the clien… |
CVE-2026-34914 | High | 8.3 | 2026-06-23 | A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid para… |
CVE-2026-34913 | Medium | 4.3 | 2026-06-23 | A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earlier could allow a l… |
CVE-2026-34912 | Medium | 4.3 | 2026-06-23 | A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and earlier, or via its… |
CVE-2026-33760 | High | 8.8 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router exposes 7 endpoints that perfo… |
CVE-2026-13007 | High | 7.5 | 2026-06-23 | Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including clearte… |
CVE-2026-12958 | High | 7.8 | 2026-06-23 | Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local u… |
CVE-2026-12957 | High | 7.8 | 2026-06-23 | Improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all supported platforms may allow a for arbitrary code execution. If a… |
CVE-2026-11940 | | 2026-06-23 | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name tha… | |
CVE-2026-56696 | Medium | 5.4 | 2026-06-23 | OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing remote channel senders to write attacker-controlled Markdow… |
CVE-2026-56695 | Medium | 6.5 | 2026-06-23 | OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to True, allowing admitted remote senders to enumerate and load arbitrary… |
CVE-2026-56694 | Medium | 5.4 | 2026-06-23 | NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to vali… |
CVE-2026-56693 | Medium | 5.5 | 2026-06-23 | NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-action handler that performs privileged central-database writ… |
CVE-2026-56692 | Medium | 5.5 | 2026-06-23 | NanoClaw before 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allows container-controlled agents to exfiltrate host-readable f… |
CVE-2026-56402 | Medium | 6.5 | 2026-06-23 | NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization… |
CVE-2026-55767 | Medium | 5.8 | 2026-06-23 | Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants… |
CVE-2026-55766 | Medium | 4.8 | 2026-06-23 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party… |
CVE-2026-55568 | Medium | 5.9 | 2026-06-23 | Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to the proxy is transmi… |
CVE-2026-54314 | High | 7.5 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompress operation expanded attacker-controlled archives into mem… |
CVE-2026-54313 | High | 7.7 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in t… |
CVE-2026-54312 | High | 8.5 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global p… |
CVE-2026-54311 | High | 7.7 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could pollu… |
CVE-2026-54310 | Critical | 9.9 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could suppl… |
CVE-2026-54309 | Critical | 10.0 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts s… |
CVE-2026-54303 | Medium | 5.4 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into… |
CVE-2026-52673 | Medium | 6.5 | 2026-06-23 | SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getDimensionsValues component |
CVE-2026-56815 | High | 7.4 | 2026-06-23 | pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in Components/Pages/Home.razor. |
CVE-2026-35019 | High | 8.1 | 2026-06-23 | NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain admin… |
CVE-2026-35018 | High | 8.8 | 2026-06-23 | NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code execution vulnerability that allows authenticated attackers t… |
CVE-2026-28496 | | 2026-06-23 | FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Template Injection (SSTI) vulnerability in… | |
CVE-2026-27604 | | 2026-06-23 | FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the A… | |
CVE-2026-12969 | Medium | 5.3 | 2026-06-23 | An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with ex… |
CVE-2026-11772 | | 2026-06-23 | DRIMO CMS is vulnerable to Reflected XSS via q parameter in searching functionality. An attacker can prepare an URL that, when opened, results in arbitrary Jav… | |
CVE-2026-10609 | Medium | 6.8 | 2026-06-23 | A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destination… |
CVE-2026-56784 | High | 8.1 | 2026-06-23 | OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users… |
CVE-2026-56762 | Medium | 5.3 | 2026-06-23 | Hono before 4.12.12 does not validate cookie names on the write path in the setCookie(), serialize(), and serializeSigned() functions, allowing invalid charact… |
CVE-2026-56701 | Medium | 6.5 | 2026-06-23 | Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbi… |
CVE-2026-56379 | High | 8.1 | 2026-06-23 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing c… |
CVE-2026-56376 | Low | 3.7 | 2026-06-23 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale p… |
CVE-2026-56371 | Medium | 5.3 | 2026-06-23 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocate… |
CVE-2026-56322 | High | 7.5 | 2026-06-23 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updates endpoint that resolves the defaultChannel parameter befo… |
CVE-2026-56315 | Critical | 9.8 | 2026-06-23 | picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib)… |
CVE-2026-56301 | Medium | 5.5 | 2026-06-23 | Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namesp… |
CVE-2026-56275 | High | 7.1 | 2026-06-23 | Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by provi… |
CVE-2026-56274 | Critical | 9.9 | 2026-06-23 | Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a re… |
CVE-2026-56263 | Medium | 6.1 | 2026-06-23 | Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor dashboard that renders crawl URLs and error messages via innerHTML wi… |
CVE-2026-56258 | High | 8.1 | 2026-06-23 | Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files o… |
CVE-2026-56248 | High | 7.5 | 2026-06-23 | Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Securit… |
CVE-2026-56243 | High | 8.1 | 2026-06-23 | Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header desp… |
CVE-2026-56234 | Medium | 5.3 | 2026-06-23 | Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validate_password_compliance endpoint that is callable u… |
CVE-2026-56225 | High | 8.3 | 2026-06-23 | Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers (get/put/delete/post). API keys created with mod… |
CVE-2026-56222 | High | 7.2 | 2026-06-23 | Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings that fails to verify app_id ownership during app-scoped rol… |
CVE-2026-54892 | | 2026-06-23 | Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.dec… | |
CVE-2026-4610 | Medium | 6.4 | 2026-06-23 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_author_message' parameter… |
CVE-2026-44089 | | 2026-06-23 | Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi-bin/cstecgi.cgi endpoint. This vulnerability could be exploited to c… | |
CVE-2026-10857 | Medium | 6.1 | 2026-06-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in AKIN Software Computer Import Export Industry and Trade L… |
CVE-2026-10711 | High | 8.8 | 2026-06-23 | Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus allows Accessing Functional… |
CVE-2026-4983 | Medium | 4.1 | 2026-06-23 | Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security h… |
CVE-2026-11374 | Critical | 9.0 | 2026-06-23 | In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be… |
CVE-2026-9733 | Critical | 9.1 | 2026-06-23 | Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the co… |
CVE-2026-10521 | High | 7.2 | 2026-06-23 | An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters… |
CVE-2026-8379 | High | 7.5 | 2026-06-23 | The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated… |
CVE-2026-8378 | Medium | 5.4 | 2026-06-23 | The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before st… |
CVE-2026-8172 | High | 7.1 | 2026-06-23 | The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on valida… |
CVE-2026-8163 | High | 8.8 | 2026-06-23 | The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL… |
CVE-2026-7842 | Medium | 6.8 | 2026-06-23 | The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameters in the import_… |
CVE-2026-12866 | Critical | 9.8 | 2026-06-23 | All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying cr… |
CVE-2026-55655 | Medium | 5.0 | 2026-06-23 | A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-bi… |
CVE-2026-55654 | Low | 3.7 | 2026-06-23 | A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programmi… |
CVE-2026-55653 | Medium | 4.3 | 2026-06-23 | A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occ… |
CVE-2026-11833 | | 2026-06-23 | Overview: A vulnerability has been found in FAST/TOOLS and CI Server. The web server may return a response containing the CI Server setting information. This… | |
CVE-2026-10658 | High | 7.1 | 2026-06-23 | bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from… |
CVE-2026-10651 | High | 7.1 | 2026-06-23 | bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute I… |
CVE-2026-10645 | Medium | 4.9 | 2026-06-23 | The Zephyr ext2 filesystem driver (subsys/fs/ext2) trusted the on-disk directory entry fields de_rec_len and de_name_len when walking a directory block. ext2_f… |
CVE-2026-54236 | Medium | 5.3 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message h… |
CVE-2026-54235 | Medium | 6.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (<, >)… |
CVE-2026-54233 | Medium | 6.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, vLLM's /v1/audio/transcriptions endpoint limits compressed upload… |
CVE-2026-54232 | High | 8.8 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack t… |
CVE-2026-53923 | High | 7.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0, integer truncation of tensor dimensions in vLLM's GGUF de… |
CVE-2026-48746 | Critical | 9.1 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on… |
CVE-2026-47155 | Medium | 6.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM's revision pinning controls do not consistently apply to all ar… |
CVE-2026-41523 | High | 7.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading… |
CVE-2026-56698 | Medium | 6.1 | 2026-06-22 | Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script executio… |
CVE-2026-56697 | Medium | 6.1 | 2026-06-22 | Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-p… |
CVE-2026-56357 | Medium | 4.0 | 2026-06-22 | n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verific… |
CVE-2026-56348 | Critical | 9.1 | 2026-06-22 | n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users t… |
CVE-2026-56326 | Medium | 6.1 | 2026-06-22 | Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-nor… |
CVE-2026-56324 | High | 8.2 | 2026-06-22 | Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attackers to circumvent rate limiting by rotating the… |
CVE-2026-56323 | High | 7.5 | 2026-06-22 | Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channel_self endpoint that allows unauthenticated attackers to enum… |
CVE-2026-56321 | Medium | 5.3 | 2026-06-22 | Capgo (backend Supabase edge functions) before 12.128.2 does not apply the global authentication middleware to the GET /private/role_bindings/:org_id endpoint… |
CVE-2026-56314 | High | 7.1 | 2026-06-22 | Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable. At… |
CVE-2026-56311 | Medium | 5.3 | 2026-06-22 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.get_current_plan_max_org RPC function that allows unauthenticated attackers… |
CVE-2026-56306 | Medium | 6.4 | 2026-06-22 | Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting mal… |