2026 CVEs (page 419)
Page 419 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0398 | Medium | 5.3 | 2026-02-09 | Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor. |
CVE-2026-1960 | | 2026-02-09 | Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'Facebook' parameter in '/loggrodemo/jbrain/ConsultaTerceros' endpoint. | |
CVE-2026-1959 | | 2026-02-09 | Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'descripción' parameter in the '/loggrodemo/jbrain/MaestraCuentasBancarias' endpoin… | |
CVE-2026-0632 | Medium | 5.4 | 2026-02-09 | The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.12 via the 'saveDa… |
CVE-2026-25848 | Critical | 9.1 | 2026-02-09 | In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible |
CVE-2026-25847 | High | 8.2 | 2026-02-09 | In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible |
CVE-2026-25846 | Medium | 6.5 | 2026-02-09 | In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs |
CVE-2026-24098 | Medium | 6.5 | 2026-02-09 | Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors… |
CVE-2026-22922 | Medium | 6.5 | 2026-02-09 | Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access t… |
CVE-2026-2227 | Medium | 4.7 | 2026-02-09 | A vulnerability was found in D-Link DCS-931L up to 1.13.0. Impacted is the function doSystem of the file /setSystemAdmin. Performing a manipulation of the argu… |
CVE-2026-2226 | Medium | 4.7 | 2026-02-09 | A vulnerability has been found in DouPHP up to 1.9. This issue affects some unknown processing of the file /admin/file.php of the component ZIP File Handler. S… |
CVE-2026-23903 | Medium | 5.3 | 2026-02-09 | Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to ver… |
CVE-2026-2225 | High | 7.3 | 2026-02-09 | A flaw has been found in itsourcecode News Portal Project 1.0. This vulnerability affects unknown code of the file /admin/index.php of the component Administra… |
CVE-2026-2224 | Low | 3.5 | 2026-02-09 | A vulnerability was detected in code-projects Online Reviewer System 1.0. This affects an unknown part of the file /system/system/admins/manage/users/btn_funct… |
CVE-2026-25916 | Medium | 4.3 | 2026-02-09 | Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage. |
CVE-2026-25905 | Medium | 5.8 | 2026-02-09 | The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use the Pyodide APIs to… |
CVE-2026-25904 | Medium | 5.8 | 2026-02-09 | The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the lo… |
CVE-2026-2236 | High | 7.5 | 2026-02-09 | C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database cont… |
CVE-2026-2235 | Medium | 6.5 | 2026-02-09 | C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database content… |
CVE-2026-2234 | Critical | 9.1 | 2026-02-09 | C&Cm@il developed by HGiga has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read and modify any user's mail content. |
CVE-2026-2223 | High | 7.3 | 2026-02-09 | A security vulnerability has been detected in code-projects Online Reviewer System 1.0. Affected by this issue is some unknown functionality of the file /syste… |
CVE-2026-2222 | Low | 2.4 | 2026-02-09 | A weakness has been identified in code-projects Online Reviewer System 1.0. Affected by this vulnerability is an unknown functionality of the file /system/syst… |
CVE-2026-22906 | Critical | 9.8 | 2026-02-09 | User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and… |
CVE-2026-22905 | High | 7.5 | 2026-02-09 | An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (e.g., /js/../cgi-bin… |
CVE-2026-22904 | Critical | 9.8 | 2026-02-09 | Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and… |
CVE-2026-22903 | Critical | 9.8 | 2026-02-09 | An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the… |
CVE-2026-2221 | High | 7.3 | 2026-02-09 | A security flaw has been discovered in code-projects Online Reviewer System 1.0. Affected is an unknown function of the file /login/index.php of the component… |
CVE-2026-2220 | High | 7.3 | 2026-02-09 | A vulnerability was identified in code-projects Online Reviewer System 1.0. This impacts an unknown function of the file /system/system/admins/assessments/pret… |
CVE-2026-24466 | Medium | 6.7 | 2026-02-09 | Products provided by Oki Electric Industry Co., Ltd. and its OEM products (Ricoh Co., Ltd., Murata Machinery, Ltd.) register Windows services with unquoted fil… |
CVE-2026-1868 | Critical | 9.9 | 2026-02-09 | GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6… |
CVE-2026-0870 | High | 7.8 | 2026-02-09 | MacroHub developed by GIGABYTE has a Local Privilege Escalation vulnerability. Due to the MacroHub application launching external applications with improper pr… |
CVE-2026-2218 | Medium | 6.3 | 2026-02-09 | A vulnerability was determined in D-Link DCS-933L up to 1.14.11. This affects an unknown function of the file /setSystemAdmin of the component alphapd. This ma… |
CVE-2026-2217 | High | 7.3 | 2026-02-09 | A vulnerability was found in itsourcecode Event Management System 1.0. The impacted element is an unknown function of the file /admin/manage_user.php. The mani… |
CVE-2026-2216 | Medium | 4.3 | 2026-02-09 | A flaw has been found in rachelos WeRSS we-mp-rss up to 1.4.8. Impacted is the function download_export_file of the file apis/tools.py. Executing a manipulatio… |
CVE-2026-22613 | Medium | 5.7 | 2026-02-09 | The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Ma… |
CVE-2026-2215 | Low | 3.7 | 2026-02-09 | A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. This issue affects some unknown processing of the file core/auth.py of the component JWT… |
CVE-2026-2214 | Low | 2.4 | 2026-02-09 | A weakness has been identified in code-projects for Plugin 1.0. This affects an unknown part of the file /Administrator/PHP/AdminAddAlbum.php. This manipulatio… |
CVE-2026-2213 | Medium | 4.7 | 2026-02-09 | A security flaw has been discovered in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP… |
CVE-2026-1615 | Critical | 9.8 | 2026-02-09 | Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The libr… |
CVE-2026-2212 | High | 7.3 | 2026-02-09 | A vulnerability was identified in code-projects Online Music Site 1.0. Affected by this vulnerability is an unknown functionality of the file /Administrator/PH… |
CVE-2026-2211 | High | 7.3 | 2026-02-09 | A vulnerability was determined in code-projects Online Music Site 1.0. Affected is an unknown function of the file /Administrator/PHP/AdminDeleteCategory.php… |
CVE-2026-2210 | High | 7.2 | 2026-02-09 | A vulnerability has been found in D-Link DIR-823X 250416. This affects the function sub_4211C8 of the file /goform/set_filtering. Such manipulation leads to os… |
CVE-2026-2203 | High | 8.8 | 2026-02-09 | A flaw has been found in Tenda AC8 16.03.33.05. Affected by this vulnerability is an unknown functionality of the file /goform/fast_setting_wifi_set of the com… |
CVE-2026-2202 | High | 8.8 | 2026-02-09 | A vulnerability was detected in Tenda AC8 16.03.33.05. Affected is the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet of the component httpd… |
CVE-2026-2201 | Low | 2.4 | 2026-02-09 | A security vulnerability has been detected in ZeroWdd studentmanager up to 2151560fc0a50ec00426785ec1e01a3763b380d9. This impacts the function addLeave of the… |
CVE-2026-2200 | Low | 2.4 | 2026-02-09 | A weakness has been identified in heyewei JFinalCMS 5.0.0. This affects an unknown function of the file /admin/admin/save of the component API Endpoint. Execut… |
CVE-2026-2199 | High | 7.3 | 2026-02-09 | A security flaw has been discovered in code-projects Online Reviewer System 1.0. The impacted element is an unknown function of the file /reviewer/system/syste… |
CVE-2026-2198 | High | 7.3 | 2026-02-09 | A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /system/system/admins/asses… |
CVE-2026-2197 | High | 7.3 | 2026-02-09 | A vulnerability was determined in code-projects Online Reviewer System 1.0. Impacted is an unknown function of the file /system/system/admins/assessments/prete… |
CVE-2026-2196 | High | 7.3 | 2026-02-09 | A vulnerability was found in code-projects Online Reviewer System 1.0. This issue affects some unknown processing of the file /system/system/admins/assessments… |
CVE-2026-2195 | High | 7.3 | 2026-02-09 | A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /system/system/admins/assessmen… |
CVE-2026-2194 | Medium | 6.3 | 2026-02-09 | A flaw has been found in D-Link DI-7100G C1 24.04.18D1. This affects the function start_proxy_client_email. Executing a manipulation can lead to command inject… |
CVE-2026-2193 | Medium | 6.3 | 2026-02-08 | A vulnerability was detected in D-Link DI-7100G C1 24.04.18D1. Affected by this issue is the function set_jhttpd_info. Performing a manipulation of the argumen… |
CVE-2026-2192 | High | 7.2 | 2026-02-08 | A security vulnerability has been detected in Tenda AC9 15.03.06.42_multi. Affected by this vulnerability is the function formGetRebootTimer. Such manipulation… |
CVE-2026-2191 | High | 7.2 | 2026-02-08 | A weakness has been identified in Tenda AC9 15.03.06.42_multi. Affected is the function formGetDdosDefenceList. This manipulation of the argument security.ddos… |
CVE-2026-2190 | High | 7.3 | 2026-02-08 | A security flaw has been discovered in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/user/controller.php. T… |
CVE-2026-2189 | High | 7.3 | 2026-02-08 | A vulnerability was identified in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/report/index.php. The manip… |
CVE-2026-2188 | High | 7.2 | 2026-02-08 | A vulnerability was determined in UTT 进取 521G 3.1.1-190816. The impacted element is the function sub_446B18 of the file /goform/formPdbUpConfig. Executing a ma… |
CVE-2026-2187 | High | 8.8 | 2026-02-08 | A vulnerability was found in Tenda RX3 16.03.13.11. The affected element is the function set_qosMib_list of the file /goform/formSetQosBand. Performing a manip… |
CVE-2026-2186 | High | 8.8 | 2026-02-08 | A vulnerability has been found in Tenda RX3 16.03.13.11. Impacted is the function fromSetIpMacBind of the file /goform/SetIpMacBind. Such manipulation of the a… |
CVE-2026-2185 | High | 8.8 | 2026-02-08 | A flaw has been found in Tenda RX3 16.03.13.11. This issue affects the function set_device_name of the file /goform/setBlackRule of the component MAC Filtering… |
CVE-2026-2184 | High | 7.3 | 2026-02-08 | A vulnerability was detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This vulnerability affects unkno… |
CVE-2026-2183 | Medium | 6.3 | 2026-02-08 | A security vulnerability has been detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This affects an un… |
CVE-2026-2182 | High | 7.2 | 2026-02-08 | A weakness has been identified in UTT 进取 521G 3.1.1-190816. Affected by this issue is the function doSystem of the file /goform/setSysAdm. Executing a manipula… |
CVE-2026-2181 | High | 8.8 | 2026-02-08 | A security flaw has been discovered in Tenda RX3 16.03.13.11. Affected by this vulnerability is an unknown functionality of the file /goform/openSchedWifi. Per… |
CVE-2026-2180 | High | 8.8 | 2026-02-08 | A vulnerability was identified in Tenda RX3 16.03.13.11. Affected is an unknown function of the file /goform/fast_setting_wifi_set. Such manipulation of the ar… |
CVE-2026-2179 | Medium | 4.7 | 2026-02-08 | A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the file /admin/manage-users.php. This manipul… |
CVE-2026-2178 | Medium | 6.3 | 2026-02-08 | A vulnerability was found in r-huijts xcode-mcp-server up to f3419f00117aa9949e326f78cc940166c88f18cb. This affects the function registerXcodeTools of the file… |
CVE-2026-2177 | High | 7.3 | 2026-02-08 | A vulnerability has been found in SourceCodester Prison Management System 1.0. The impacted element is an unknown function of the component Login. The manipula… |
CVE-2026-2176 | Medium | 6.3 | 2026-02-08 | A security vulnerability has been detected in code-projects Contact Management System 1.0. This issue affects some unknown processing of the file index.py. Suc… |
CVE-2026-2175 | High | 7.2 | 2026-02-08 | A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420618 of the file /goform/set_upnp. This manipulation of… |
CVE-2026-2174 | High | 7.3 | 2026-02-08 | A security flaw has been discovered in code-projects Contact Management System 1.0. This affects an unknown part of the component CRUD Endpoint. The manipulati… |
CVE-2026-2173 | High | 7.3 | 2026-02-08 | A vulnerability was identified in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the file login.php. The… |
CVE-2026-2172 | High | 7.3 | 2026-02-08 | A vulnerability was determined in code-projects Online Application System for Admission 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2026-2171 | High | 7.3 | 2026-02-08 | A vulnerability was found in code-projects Online Student Management System 1.0. Affected is an unknown function of the file accounts.php of the component Logi… |
CVE-2026-2169 | Medium | 6.3 | 2026-02-08 | A vulnerability has been found in D-Link DWR-M921 1.1.50. This impacts an unknown function of the file /boafrm/formLtefotaUpgradeFibocom. Such manipulation of… |
CVE-2026-2168 | Medium | 6.3 | 2026-02-08 | A flaw has been found in D-Link DWR-M921 1.1.50. This affects the function sub_419920 of the file /boafrm/formLtefotaUpgradeQuectel. This manipulation of the a… |
CVE-2026-2167 | Medium | 6.3 | 2026-02-08 | A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setAPNetwork of the file /cgi-bin/cstecgi.cgi. The ma… |
CVE-2026-2166 | High | 7.3 | 2026-02-08 | A security vulnerability has been detected in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /login/index.ph… |
CVE-2026-2165 | High | 7.3 | 2026-02-08 | A weakness has been identified in detronetdip E-commerce 1.0.0. Impacted is an unknown function of the file /Admin/assets/backend/seller/add_seller.php of the… |
CVE-2026-2164 | High | 7.3 | 2026-02-08 | A security flaw has been discovered in detronetdip E-commerce 1.0.0. This issue affects some unknown processing of the file /seller/assets/backend/profile/adda… |
CVE-2026-2163 | Medium | 4.7 | 2026-02-08 | A vulnerability was identified in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ssdp.cgi. Such manipulation of the argume… |
CVE-2026-2162 | Medium | 4.7 | 2026-02-08 | A vulnerability was determined in itsourcecode News Portal Project 1.0. This affects an unknown part of the file /admin/aboutus.php. This manipulation of the a… |
CVE-2026-2161 | High | 7.3 | 2026-02-08 | A vulnerability was found in itsourcecode Directory Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/forget-passw… |
CVE-2026-2160 | Medium | 4.3 | 2026-02-08 | A vulnerability has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-2159 | Medium | 4.3 | 2026-02-08 | A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected is an unknown function of the file /tourism/classes/Master.php?f=regist… |
CVE-2026-2158 | High | 7.3 | 2026-02-08 | A vulnerability was detected in code-projects Student Web Portal 1.0. This impacts an unknown function of the file /check_user.php. Performing a manipulation o… |
CVE-2026-2157 | High | 7.2 | 2026-02-08 | A security vulnerability has been detected in D-Link DIR-823X 250416. This affects the function sub_4175CC of the file /goform/set_static_route_table. Such man… |
CVE-2026-2156 | Low | 2.4 | 2026-02-08 | A weakness has been identified in code-projects Online Student Management System 1.0. The impacted element is an unknown function of the file /admin/announceme… |
CVE-2026-2155 | High | 7.2 | 2026-02-08 | A security flaw has been discovered in D-Link DIR-823X 250416. The affected element is the function sub_4208A0 of the file /goform/set_dmz of the component Con… |
CVE-2026-2154 | Medium | 4.3 | 2026-02-08 | A vulnerability was identified in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Impacted is an unknown function of the file /… |
CVE-2026-2153 | Medium | 4.3 | 2026-02-08 | A vulnerability was determined in mwielgoszewski doorman up to 0.6. This issue affects the function is_safe_url of the file doorman/users/views.py. Executing a… |
CVE-2026-2152 | High | 7.2 | 2026-02-08 | A vulnerability was found in D-Link DIR-615 4.10. This vulnerability affects unknown code of the file adv_routing.php of the component Web Configuration Interf… |
CVE-2026-2151 | High | 7.2 | 2026-02-08 | A vulnerability has been found in D-Link DIR-615 4.10. This affects an unknown part of the file adv_firewall.php of the component DMZ Host Feature. Such manipu… |
CVE-2026-2150 | Medium | 4.3 | 2026-02-08 | A flaw has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this issue is some unknown functionality o… |
CVE-2026-2149 | Medium | 4.3 | 2026-02-08 | A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this vulnerability is an unknown fu… |
CVE-2026-2148 | Medium | 5.3 | 2026-02-08 | A security vulnerability has been detected in Tenda AC21 16.03.08.16. Affected is an unknown function of the file /cgi-bin/DownloadFlash of the component Web M… |
CVE-2026-2147 | Medium | 5.3 | 2026-02-08 | A weakness has been identified in Tenda AC21 16.03.08.16. This impacts an unknown function of the file /cgi-bin/DownloadLog of the component Web Management Int… |
CVE-2026-2146 | Medium | 6.3 | 2026-02-08 | A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1. This affects the function updateAvatar of the file /api/users/updateAvatar of the co… |
CVE-2026-2145 | Low | 3.5 | 2026-02-08 | A vulnerability was identified in cym1102 nginxWebUI up to 4.3.7. The impacted element is an unknown function of the file /adminPage/conf/check of the componen… |