2026 CVEs (page 417)
Page 417 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-21339 | Medium | 5.5 | 2026-02-10 | Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could le… |
CVE-2026-21338 | Medium | 5.5 | 2026-02-10 | Substance3D - Designer versions 15.1.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. A… |
CVE-2026-21337 | Medium | 5.5 | 2026-02-10 | Substance3D - Designer versions 15.1.0 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could le… |
CVE-2026-21336 | Medium | 5.5 | 2026-02-10 | Substance3D - Designer versions 15.1.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. A… |
CVE-2026-21335 | High | 7.8 | 2026-02-10 | Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-21334 | High | 7.8 | 2026-02-10 | Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-21332 | Medium | 5.5 | 2026-02-10 | InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could le… |
CVE-2026-21330 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arb… |
CVE-2026-21329 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21328 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-21327 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-21326 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21325 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2026-21324 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2026-21323 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21322 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2026-21321 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-21320 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21319 | Medium | 5.5 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this… |
CVE-2026-21318 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-21317 | Medium | 5.5 | 2026-02-10 | Audition versions 25.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vuln… |
CVE-2026-21316 | Medium | 5.5 | 2026-02-10 | Audition versions 25.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to application denial-of-serv… |
CVE-2026-21315 | Medium | 5.5 | 2026-02-10 | Audition versions 25.3 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vuln… |
CVE-2026-21314 | Medium | 5.5 | 2026-02-10 | Audition versions 25.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vuln… |
CVE-2026-21313 | Medium | 5.5 | 2026-02-10 | Audition versions 25.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vuln… |
CVE-2026-21312 | High | 7.8 | 2026-02-10 | Audition versions 25.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cur… |
CVE-2026-21261 | Medium | 5.5 | 2026-02-10 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-21260 | High | 7.5 | 2026-02-10 | Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-21259 | High | 7.8 | 2026-02-10 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-21258 | Medium | 5.5 | 2026-02-10 | Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-21257 | High | 8.0 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an authorized attacker to elevat… |
CVE-2026-21256 | High | 8.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to exec… |
CVE-2026-21255 | High | 8.8 | 2026-02-10 | Improper access control in Windows Hyper-V allows an authorized attacker to bypass a security feature locally. |
CVE-2026-21253 | High | 7.0 | 2026-02-10 | Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-21251 | High | 7.8 | 2026-02-10 | Use after free in Windows Cluster Client Failover allows an authorized attacker to elevate privileges locally. |
CVE-2026-21250 | High | 7.8 | 2026-02-10 | Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. |
CVE-2026-21249 | Low | 3.3 | 2026-02-10 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing locally. |
CVE-2026-21248 | High | 7.3 | 2026-02-10 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-21247 | High | 7.3 | 2026-02-10 | Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-21246 | High | 7.8 | 2026-02-10 | Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
CVE-2026-21245 | High | 7.8 | 2026-02-10 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-21244 | High | 7.3 | 2026-02-10 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-21243 | High | 7.5 | 2026-02-10 | Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network. |
CVE-2026-21242 | High | 7.0 | 2026-02-10 | Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. |
CVE-2026-21241 | High | 7.0 | 2026-02-10 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-21240 | High | 7.8 | 2026-02-10 | Time-of-check time-of-use (toctou) race condition in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. |
CVE-2026-21239 | High | 7.8 | 2026-02-10 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-21238 | High | 7.8 | 2026-02-10 | Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-21237 | High | 7.0 | 2026-02-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Subsystem for Linux allows an authorized attacker to ele… |
CVE-2026-21236 | High | 7.8 | 2026-02-10 | Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-21235 | High | 7.3 | 2026-02-10 | Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
CVE-2026-21234 | High | 7.0 | 2026-02-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized… |
CVE-2026-21232 | High | 7.8 | 2026-02-10 | Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. |
CVE-2026-21231 | High | 7.8 | 2026-02-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileg… |
CVE-2026-21229 | High | 8.0 | 2026-02-10 | Improper input validation in Power BI allows an authorized attacker to execute code over a network. |
CVE-2026-21228 | High | 8.1 | 2026-02-10 | Improper certificate validation in Azure Local allows an unauthorized attacker to execute code over a network. |
CVE-2026-21222 | Medium | 5.5 | 2026-02-10 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-21218 | High | 7.5 | 2026-02-10 | Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-20846 | High | 7.5 | 2026-02-10 | Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network. |
CVE-2026-20841 | High | 7.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code loca… |
CVE-2026-1997 | Medium | 5.3 | 2026-02-10 | Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origin… |
CVE-2026-1996 | Medium | 5.3 | 2026-02-10 | Certain HP OfficeJet Pro printers may be vulnerable to potential denial of service when the IPP requests are mishandled, failing to establish a TCP connection. |
CVE-2026-0653 | Medium | 6.5 | 2026-02-10 | On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization… |
CVE-2026-0652 | High | 8.8 | 2026-02-10 | On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. A… |
CVE-2026-0651 | High | 7.8 | 2026-02-10 | A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The ser… |
CVE-2026-25530 | Medium | 4.3 | 2026-02-10 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing… |
CVE-2026-24885 | Medium | 5.7 | 2026-02-10 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Project… |
CVE-2026-22153 | High | 8.1 | 2026-02-10 | An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacke… |
CVE-2026-21743 | High | 7.2 | 2026-02-10 | A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versi… |
CVE-2026-1774 | Critical | 9.8 | 2026-02-10 | CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability. |
CVE-2026-1603 | High | 8.6 | 2026-02-10 | An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data. |
CVE-2026-1602 | Medium | 6.5 | 2026-02-10 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2026-2268 | High | 7.5 | 2026-02-10 | The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.0. This is due to the unsafe ap… |
CVE-2026-25656 | High | 7.8 | 2026-02-10 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3), User Management Component (UMC) (All versions < V2.15.2.1). The affected applicatio… |
CVE-2026-25655 | High | 7.8 | 2026-02-10 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP2). The affected application permits improper modification of a configuration file by a… |
CVE-2026-24343 | High | 8.8 | 2026-02-10 | Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7… |
CVE-2026-23906 | Critical | 9.8 | 2026-02-10 | Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic… |
CVE-2026-23901 | Low | 2.5 | 2026-02-10 | Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recommended to upgrade to… |
CVE-2026-23720 | High | 7.8 | 2026-02-10 | A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an… |
CVE-2026-23719 | High | 7.8 | 2026-02-10 | A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected application is vulnerable… |
CVE-2026-23718 | High | 7.8 | 2026-02-10 | A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an… |
CVE-2026-23717 | High | 7.8 | 2026-02-10 | A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an… |
CVE-2026-23716 | High | 7.8 | 2026-02-10 | A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an… |
CVE-2026-23715 | High | 7.8 | 2026-02-10 | A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an… |
CVE-2026-22923 | High | 7.8 | 2026-02-10 | A vulnerability has been identified in NX (All versions < V2512), NX (Managed Mode) (All versions < V2512). The affected application contains a data validation… |
CVE-2026-1922 | Medium | 6.4 | 2026-02-10 | The The Events Calendar Shortcode & Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ecs-list-events` shortcode `messa… |
CVE-2026-1866 | High | 7.2 | 2026-02-10 | The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via double HTML-entity encoding in all versions up to, and including, 1.32… |
CVE-2026-1722 | Medium | 5.3 | 2026-02-10 | The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, an… |
CVE-2026-2099 | Medium | 5.4 | 2026-02-10 | AgentFlow developed by Flowring has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript codes… |
CVE-2026-2098 | Medium | 6.1 | 2026-02-10 | AgentFlow developed by Flowring has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript c… |
CVE-2026-2097 | High | 8.8 | 2026-02-10 | Agentflow developed by Flowring has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors… |
CVE-2026-2096 | Critical | 9.8 | 2026-02-10 | Agentflow developed by Flowring has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database cont… |
CVE-2026-2095 | Critical | 9.8 | 2026-02-10 | Agentflow developed by Flowring has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to exploit a specific functionality to ob… |
CVE-2026-2094 | High | 8.8 | 2026-02-10 | Docpedia developed by Flowring has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and… |
CVE-2026-2093 | High | 7.5 | 2026-02-10 | Docpedia developed by Flowring has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database c… |
CVE-2026-0996 | Medium | 6.4 | 2026-02-10 | The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI Form Builder module in all versions up to, and including, 6.1.14… |
CVE-2026-2260 | High | 7.2 | 2026-02-10 | A vulnerability was found in D-Link DCS-931L up to 1.13.0. This affects an unknown part of the file /goform/setSysAdmin. The manipulation of the argument Admin… |
CVE-2026-2259 | Low | 3.3 | 2026-02-10 | A vulnerability has been found in aardappel lobster up to 2025.4. Affected by this issue is the function lobster::Parser::ParseStatements in the library dev/sr… |
CVE-2026-24328 | Medium | 6.1 | 2026-02-10 | SAP TAF_APPLAUNCHER within Business Server Pages allows unauthenticated attacker to craft malicious links that, when clicked by a victim, redirect them to atta… |
CVE-2026-24327 | Medium | 4.3 | 2026-02-10 | Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated attacker could access… |