2026 CVEs (page 42)
Page 42 of 662 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-76086 | High | 8.5 | 2026-09-23 | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsCon… |
CVE-2026-75131 | High | 7.8 | 2026-09-23 | NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connec… |
CVE-2026-71465 | Low | 3.1 | 2026-09-23 | RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like… |
CVE-2026-71464 | Low | 3.1 | 2026-09-23 | LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobTemplate/JobLaunch… |
CVE-2026-71463 | Low | 2.7 | 2026-09-23 | Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) and {% if job… |
CVE-2026-71462 | Medium | 4.1 | 2026-09-23 | StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existe… |
CVE-2026-71461 | Medium | 4.3 | 2026-09-23 | HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldEr… |
CVE-2026-71460 | Medium | 4.3 | 2026-09-23 | /api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, i… |
CVE-2026-71459 | Medium | 5.0 | 2026-09-23 | JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns Tr… |
CVE-2026-71458 | Medium | 5.0 | 2026-09-23 | URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 4… |
CVE-2026-63132 | | 2026-09-23 | OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly… | |
CVE-2026-63131 | | 2026-09-23 | OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant b… | |
CVE-2026-61814 | High | 7.5 | 2026-09-23 | Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunk… |
CVE-2026-61695 | High | 7.5 | 2026-09-23 | Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expe… |
CVE-2026-59990 | High | 7.5 | 2026-09-23 | Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a… |
CVE-2026-55632 | Medium | 4.3 | 2026-09-23 | GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, en… |
CVE-2026-52744 | | 2026-09-23 | GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstrea… | |
CVE-2026-91775 | | 2026-09-23 | LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulti… | |
CVE-2026-88840 | Medium | 5.3 | 2026-09-23 | BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message. |
CVE-2026-88839 | Medium | 6.7 | 2026-09-23 | BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers. |
CVE-2026-88837 | Medium | 6.5 | 2026-09-23 | BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check. |
CVE-2026-88835 | Medium | 6.1 | 2026-09-23 | BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read. |
CVE-2026-88831 | Medium | 5.3 | 2026-09-23 | BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. |
CVE-2026-86938 | High | 7.3 | 2026-09-23 | A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated administrator privileges… |
CVE-2026-86934 | Critical | 9.1 | 2026-09-23 | An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disa… |
CVE-2026-86930 | Critical | 9.1 | 2026-09-23 | An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose… |
CVE-2026-86926 | High | 7.8 | 2026-09-23 | A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 database file to cause… |
CVE-2026-86867 | Medium | 6.5 | 2026-09-23 | Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and i… |
CVE-2026-96808 | High | 7.4 | 2026-09-23 | In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by… |
CVE-2026-96807 | Medium | 4.0 | 2026-09-23 | In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbit… |
CVE-2026-96804 | High | 8.8 | 2026-09-23 | MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which all… |
CVE-2026-96775 | High | 8.8 | 2026-09-23 | MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which all… |
CVE-2026-96759 | Critical | 9.8 | 2026-09-23 | orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can in… |
CVE-2026-96758 | Critical | 9.8 | 2026-09-23 | orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated… |
CVE-2026-96757 | Critical | 9.8 | 2026-09-23 | orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can… |
CVE-2026-96756 | High | 8.1 | 2026-09-23 | orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date()… |
CVE-2026-96755 | Critical | 9.8 | 2026-09-23 | orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template… |
CVE-2026-96754 | Critical | 9.8 | 2026-09-23 | orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted rout… |
CVE-2026-96656 | High | 7.2 | 2026-09-23 | Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appen… |
CVE-2026-96655 | Medium | 4.3 | 2026-09-23 | Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' p… |
CVE-2026-96654 | Medium | 6.5 | 2026-09-23 | Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions a… |
CVE-2026-96652 | Medium | 4.3 | 2026-09-23 | Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' par… |
CVE-2026-96651 | Medium | 6.5 | 2026-09-23 | Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/age… |
CVE-2026-96514 | High | 7.3 | 2026-09-23 | A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the component Login Handler. T… |
CVE-2026-96513 | High | 7.3 | 2026-09-23 | A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation… |
CVE-2026-95848 | Critical | 9.1 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthentic… |
CVE-2026-95847 | High | 7.5 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metada… |
CVE-2026-95846 | High | 7.5 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite author… |
CVE-2026-95845 | High | 7.5 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast p… |
CVE-2026-95844 | High | 7.5 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through… |
CVE-2026-95843 | High | 7.5 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractSh… |
CVE-2026-95842 | High | 7.5 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart… |
CVE-2026-93349 | High | 8.8 | 2026-09-23 | Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Pa… |
CVE-2026-88832 | High | 7.3 | 2026-09-23 | BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images. |
CVE-2026-88830 | High | 7.5 | 2026-09-23 | A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExch… |
CVE-2026-85724 | Critical | 9.6 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes cl… |
CVE-2026-6669 | Medium | 5.9 | 2026-09-23 | Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicio… |
CVE-2026-6668 | High | 7.5 | 2026-09-23 | Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficie… |
CVE-2026-19888 | High | 7.5 | 2026-09-23 | Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to c… |
CVE-2026-96675 | Low | 3.3 | 2026-09-23 | alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access… |
CVE-2026-96674 | Medium | 4.4 | 2026-09-23 | alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds… |
CVE-2026-96673 | High | 7.5 | 2026-09-23 | Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating… |
CVE-2026-96672 | Medium | 6.4 | 2026-09-23 | Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing… |
CVE-2026-93769 | | 2026-09-23 | HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage User… | |
CVE-2026-79310 | High | 8.5 | 2026-09-23 | webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The template engine can be tricked into executing attacker-controlled template code t… |
CVE-2026-79306 | Medium | 6.5 | 2026-09-23 | CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote… |
CVE-2026-79304 | Medium | 6.5 | 2026-09-23 | CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attack… |
CVE-2026-6327 | Medium | 4.3 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when writt… |
CVE-2026-4921 | Low | 2.7 | 2026-09-23 | IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2026-3626 | Medium | 5.3 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2026-19267 | Medium | 6.2 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to missing authentication on the Business Rules Manager commands REST endpoint (`Com… |
CVE-2026-19179 | High | 8.2 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of spe… |
CVE-2026-19087 | Medium | 4.4 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to achieve privilege escalation within the container due to improper… |
CVE-2026-18875 | High | 7.3 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent ser… |
CVE-2026-18872 | Critical | 9.3 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React c… |
CVE-2026-18505 | Medium | 5.4 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter.java:151`). An una… |
CVE-2026-18490 | High | 8.8 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayD… |
CVE-2026-18185 | High | 7.3 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due… |
CVE-2026-18184 | High | 7.4 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE)… |
CVE-2026-18181 | High | 8.1 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a h… |
CVE-2026-18180 | Medium | 6.5 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection. |
CVE-2026-96611 | Medium | 6.9 | 2026-09-23 | FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored… |
CVE-2026-96609 | | 2026-09-23 | Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condi… | |
CVE-2026-96600 | Medium | 5.5 | 2026-09-23 | Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administ… |
CVE-2026-96599 | Medium | 5.9 | 2026-09-23 | Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to gu… |
CVE-2026-96276 | Medium | 6.5 | 2026-09-23 | If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extensi… |
CVE-2026-96275 | High | 8.8 | 2026-09-23 | A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On… |
CVE-2026-92419 | | 2026-09-23 | WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in the Gantt vacation c… | |
CVE-2026-92164 | Medium | 6.5 | 2026-09-23 | Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file… |
CVE-2026-88974 | Medium | 5.4 | 2026-09-23 | WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-… |
CVE-2026-73858 | Medium | 5.3 | 2026-09-23 | Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can… |
CVE-2026-73591 | High | 7.5 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Code vulnerability. An… |
CVE-2026-73589 | Medium | 6.3 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability. A… |
CVE-2026-73588 | High | 7.4 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unaut… |
CVE-2026-73587 | Medium | 6.8 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated a… |
CVE-2026-73586 | Medium | 6.4 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low privileged att… |
CVE-2026-71178 | Low | 3.7 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerab… |
CVE-2026-71177 | Medium | 5.4 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability… |
CVE-2026-63002 | Medium | 4.8 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the medi… |
CVE-2026-63001 | Medium | 4.8 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a… |