2026 CVEs (page 420)
Page 420 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2143 | High | 7.2 | 2026-02-08 | A security vulnerability has been detected in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/set_ddns of the component… |
CVE-2026-2142 | High | 7.2 | 2026-02-08 | A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420688 of the file /goform/set_qos. Executing a manipulat… |
CVE-2026-2141 | Medium | 6.3 | 2026-02-08 | A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gat… |
CVE-2026-2140 | High | 8.8 | 2026-02-08 | A vulnerability was identified in Tenda TX9 up to 22.03.02.10_multi. Affected by this issue is the function sub_4223E0 of the file /goform/setMacFilterCfg. Suc… |
CVE-2026-2139 | High | 8.8 | 2026-02-08 | A vulnerability was determined in Tenda TX9 up to 22.03.02.10_multi. Affected by this vulnerability is the function sub_432580 of the file /goform/fast_setting… |
CVE-2026-2138 | High | 8.8 | 2026-02-08 | A vulnerability was found in Tenda TX9 up to 22.03.02.10_multi. Affected is the function sub_42D03C of the file /goform/SetStaticRouteCfg. The manipulation of… |
CVE-2026-2137 | High | 8.8 | 2026-02-08 | A vulnerability has been found in Tenda TX3 up to 16.03.13.11_multi. This impacts an unknown function of the file /goform/SetIpMacBind. The manipulation of the… |
CVE-2026-2136 | High | 7.3 | 2026-02-08 | A flaw has been found in projectworlds Online Food Ordering System 1.0. This affects an unknown function of the file /view-ticket.php. Executing a manipulation… |
CVE-2026-2135 | Medium | 6.3 | 2026-02-08 | A vulnerability was detected in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_43F020 of the file /goform/formPdbUpConfig. Performing a m… |
CVE-2026-2134 | Medium | 4.7 | 2026-02-08 | A security vulnerability has been detected in PHPGurukul Hospital Management System 4.0. The affected element is an unknown function of the file /hms/admin/man… |
CVE-2026-2133 | High | 7.3 | 2026-02-08 | A weakness has been identified in code-projects Online Music Site 1.0. Impacted is an unknown function of the file /Administrator/PHP/AdminUpdateCategory.php… |
CVE-2026-2132 | High | 7.3 | 2026-02-08 | A security flaw has been discovered in code-projects Online Music Site 1.0. This issue affects some unknown processing of the file /Administrator/PHP/AdminUpda… |
CVE-2026-2131 | Medium | 6.3 | 2026-02-08 | A vulnerability was identified in XixianLiang HarmonyOS-mcp-server 0.1.0. This vulnerability affects the function input_text. The manipulation of the argument… |
CVE-2026-2130 | Medium | 6.3 | 2026-02-08 | A vulnerability was determined in BurtTheCoder mcp-maigret up to 1.0.12. This affects an unknown part of the file src/index.ts of the component search_username… |
CVE-2026-2209 | Medium | 6.3 | 2026-02-08 | A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/settings/translationB… |
CVE-2026-2208 | Medium | 4.3 | 2026-02-08 | A security vulnerability has been detected in WeKan up to 8.20. Impacted is an unknown function of the file server/publications/rules.js of the component Rules… |
CVE-2026-2207 | Medium | 5.3 | 2026-02-08 | A weakness has been identified in WeKan up to 8.20. This issue affects some unknown processing of the file server/publications/activities.js of the component A… |
CVE-2026-2206 | Medium | 6.3 | 2026-02-08 | A security flaw has been discovered in WeKan up to 8.20. This vulnerability affects unknown code of the file server/methods/fixDuplicateLists.js of the compone… |
CVE-2026-2205 | Medium | 4.3 | 2026-02-08 | A vulnerability was identified in WeKan up to 8.20. This affects an unknown part of the file server/publications/cards.js of the component Meteor Publication H… |
CVE-2026-2129 | High | 7.2 | 2026-02-08 | A vulnerability was found in D-Link DIR-823X 250416. Affected by this issue is some unknown functionality of the file /goform/set_ac_status. Performing a manip… |
CVE-2026-2122 | Medium | 6.3 | 2026-02-08 | A security flaw has been discovered in Xiaopi Panel up to 20260126. This impacts an unknown function of the file /demo.php of the component WAF Firewall. The m… |
CVE-2026-2120 | High | 7.2 | 2026-02-08 | A vulnerability was identified in D-Link DIR-823X 250416. This affects an unknown function of the file /goform/set_server_settings of the component Configurati… |
CVE-2026-2118 | High | 7.2 | 2026-02-08 | A vulnerability was determined in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_4407D4 of the file /goform/formReleaseConnect of the com… |
CVE-2026-2117 | High | 7.3 | 2026-02-08 | A vulnerability was found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/edit_activity.php. Perf… |
CVE-2026-2116 | High | 7.3 | 2026-02-08 | A vulnerability has been found in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/edit_expenses.php. Such manipu… |
CVE-2026-2115 | High | 7.3 | 2026-02-07 | A flaw has been found in itsourcecode Society Management System 1.0. This issue affects some unknown processing of the file /admin/delete_expenses.php. This ma… |
CVE-2026-2114 | High | 7.3 | 2026-02-07 | A vulnerability was detected in itsourcecode Society Management System 1.0. This vulnerability affects unknown code of the file /admin/edit_admin.php. The mani… |
CVE-2026-25859 | High | 8.8 | 2026-02-07 | Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in u… |
CVE-2026-25858 | Critical | 9.1 | 2026-02-07 | macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated atta… |
CVE-2026-25857 | High | 8.8 | 2026-02-07 | Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality (formSetWanDiag). T… |
CVE-2026-25568 | Medium | 4.3 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforce… |
CVE-2026-25567 | Medium | 4.3 | 2026-02-07 | WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an authorId from the req… |
CVE-2026-25566 | Medium | 5.4 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic. A user can specify a destination board/list/swimlane without adequate a… |
CVE-2026-25565 | Medium | 6.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring w… |
CVE-2026-25564 | High | 7.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not… |
CVE-2026-25563 | High | 7.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not… |
CVE-2026-25562 | Medium | 4.3 | 2026-02-07 | WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication. Attachment metadata can be returned without proper… |
CVE-2026-25561 | High | 7.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided identifiers (such as… |
CVE-2026-25560 | Critical | 9.8 | 2026-02-07 | WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP sear… |
CVE-2026-2113 | High | 7.3 | 2026-02-07 | A security vulnerability has been detected in yuan1994 tpadmin up to 1.3.12. This affects an unknown part in the library /public/static/admin/lib/webuploader/0… |
CVE-2026-2111 | Medium | 4.3 | 2026-02-07 | A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this issue is some unknown functionality of the file /airag/knowledge/doc/edit of the comp… |
CVE-2026-2110 | Low | 3.7 | 2026-02-07 | A security flaw has been discovered in Tasin1025 SwiftBuy up to 0f5011372e8d1d7edfd642d57d721c9fadc54ec7. Affected by this vulnerability is an unknown function… |
CVE-2026-2109 | Medium | 5.4 | 2026-02-07 | A vulnerability was identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file /api/undo/ of the component Delete Category… |
CVE-2026-2108 | Medium | 5.3 | 2026-02-07 | A vulnerability was determined in jsbroks COCO Annotator up to 0.11.1. This impacts an unknown function of the file /api/info/long_task of the component Endpoi… |
CVE-2026-2107 | Medium | 6.3 | 2026-02-07 | A vulnerability was found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function loadAllLoginfo/deleteLoginfo/batchDelet… |
CVE-2026-2106 | Medium | 6.3 | 2026-02-07 | A vulnerability has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. The impacted element is the function addNotice/updateNotice/… |
CVE-2026-2105 | Medium | 6.3 | 2026-02-07 | A flaw has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. The affected element is the function addDept/updateDept/deleteDept of… |
CVE-2026-2090 | High | 7.3 | 2026-02-07 | A vulnerability was determined in SourceCodester Online Class Record System 1.0. This issue affects some unknown processing of the file /admin/message/search.p… |
CVE-2026-2089 | High | 7.3 | 2026-02-07 | A vulnerability was found in SourceCodester Online Class Record System 1.0. This vulnerability affects unknown code of the file /admin/subject/controller.php… |
CVE-2026-2088 | High | 7.3 | 2026-02-07 | A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/accepted-appointment.php. Su… |
CVE-2026-2087 | High | 7.3 | 2026-02-07 | A flaw has been found in SourceCodester Online Class Record System 1.0. Affected by this issue is some unknown functionality of the file /admin/login.php. This… |
CVE-2026-2086 | High | 8.8 | 2026-02-07 | A vulnerability was detected in UTT HiPER 810G up to 1.7.7-171114. Affected by this vulnerability is the function strcpy of the file /goform/formFireWall of th… |
CVE-2026-2085 | High | 7.2 | 2026-02-07 | A security vulnerability has been detected in D-Link DWR-M921 1.1.50. Affected is the function sub_419F20 of the file /boafrm/formUSSDSetup of the component US… |
CVE-2026-2084 | High | 7.2 | 2026-02-07 | A weakness has been identified in D-Link DIR-823X 250416. This impacts an unknown function of the file /goform/set_language. Executing a manipulation of the ar… |
CVE-2026-2083 | High | 7.3 | 2026-02-07 | A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file /delete_post.php. Performing a ma… |
CVE-2026-2082 | Medium | 4.7 | 2026-02-07 | A vulnerability was identified in D-Link DIR-823X 250416. The impacted element is an unknown function of the file /goform/set_mac_clone. Such manipulation of t… |
CVE-2026-2081 | Medium | 4.7 | 2026-02-07 | A vulnerability was determined in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_password. This manipulation of th… |
CVE-2026-2080 | High | 7.2 | 2026-02-07 | A vulnerability has been found in UTT HiPER 810 1.7.4-141218. This issue affects the function setSysAdm of the file /goform/formUser. The manipulation of the a… |
CVE-2026-2079 | Medium | 6.3 | 2026-02-07 | A flaw has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This vulnerability affects the function addMenu/updateMenu/deleteMenu… |
CVE-2026-1675 | Medium | 5.3 | 2026-02-07 | The Advanced Country Blocker plugin for WordPress is vulnerable to Authorization Bypass in all versions up to, and including, 2.3.1 due to the use of a predict… |
CVE-2026-1643 | Medium | 6.1 | 2026-02-07 | The MP-Ukagaka plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.5.2 due to insufficient input sanit… |
CVE-2026-1634 | Medium | 6.1 | 2026-02-07 | The Subitem AL Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and… |
CVE-2026-1613 | Medium | 6.4 | 2026-02-07 | The Wonka Slide plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `list_class` shortcode in all versions up to, and including… |
CVE-2026-1611 | Medium | 6.4 | 2026-02-07 | The Wikiloops Track Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wikiloops` shortcode in all versions up to, and… |
CVE-2026-1608 | Medium | 6.4 | 2026-02-07 | The Video Onclick plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `youtube` shortcode in all versions up to, and including… |
CVE-2026-1573 | Medium | 6.4 | 2026-02-07 | The OMIGO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `omigo_donate_button` shortcode in all versions up to, and includi… |
CVE-2026-1570 | Medium | 6.4 | 2026-02-07 | The Simple Bible Verse via Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `verse` shortcode in all versions up to… |
CVE-2026-1082 | Medium | 4.3 | 2026-02-07 | The TITLE ANIMATOR plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce val… |
CVE-2026-0555 | Medium | 6.4 | 2026-02-07 | The Premmerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premmerce_wizard_actions' AJAX endpoint in all versions up to, and inc… |
CVE-2026-2078 | Medium | 6.3 | 2026-02-07 | A vulnerability was detected in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function addPermission/updatePermission/delet… |
CVE-2026-2077 | Medium | 6.3 | 2026-02-07 | A security vulnerability has been detected in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this issue is the function addRole/u… |
CVE-2026-2076 | Medium | 6.3 | 2026-02-07 | A weakness has been identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this vulnerability is the function addUser/updat… |
CVE-2026-2075 | Medium | 6.3 | 2026-02-07 | A security flaw has been discovered in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected is the function saveRolePermission of the file… |
CVE-2026-2074 | Medium | 6.3 | 2026-02-07 | A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of the component HTTP P… |
CVE-2026-2073 | High | 7.3 | 2026-02-07 | A vulnerability was determined in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/user/index.php. Executing a… |
CVE-2026-2071 | High | 8.8 | 2026-02-07 | A vulnerability was found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formP2PLimitConfig. Performing a manipul… |
CVE-2026-2070 | High | 8.8 | 2026-02-06 | A vulnerability has been found in UTT 进取 520W 1.7.7-180627. The affected element is the function strcpy of the file /goform/formPolicyRouteConf. Such manipulat… |
CVE-2026-25804 | Critical | 9.1 | 2026-02-06 | Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment sys… |
CVE-2026-25803 | Critical | 9.8 | 2026-02-06 | 3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default c… |
CVE-2026-25793 | High | 8.1 | 2026-02-06 | Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is not the default configuration), it is po… |
CVE-2026-25762 | High | 7.5 | 2026-02-06 | AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file… |
CVE-2026-25757 | Medium | 5.3 | 2026-02-06 | Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view complet… |
CVE-2026-25754 | High | 7.2 | 2026-02-06 | AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data p… |
CVE-2026-25749 | Medium | 6.6 | 2026-02-06 | Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when… |
CVE-2026-25644 | High | 7.5 | 2026-02-06 | DataHub is an open-source metadata platform. Prior to version 1.3.1.8, the LDAP ingestion source is vulnerable to MITM attack through TLS downgrade. This issue… |
CVE-2026-2069 | Low | 3.3 | 2026-02-06 | A flaw has been found in ggml-org llama.cpp up to 55abc39. Impacted is the function llama_grammar_advance_stack of the file llama.cpp/src/llama-grammar.cpp of… |
CVE-2026-2068 | High | 8.8 | 2026-02-06 | A vulnerability was detected in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/formSyslogConf. The manipulation of the ar… |
CVE-2026-25764 | Low | 3.5 | 2026-02-06 | OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injection vulnerability occurs in the time t… |
CVE-2026-25763 | Critical | 9.9 | 2026-02-06 | OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an arbitrary file write vulnerability exists in Open… |
CVE-2026-25760 | Medium | 6.5 | 2026-02-06 | Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.6.11, a path traversal in the website content subsystem lets an aut… |
CVE-2026-25758 | High | 7.5 | 2026-02-06 | Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows… |
CVE-2026-25732 | High | 7.5 | 2026-02-06 | NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enab… |
CVE-2026-25574 | Medium | 5.4 | 2026-02-06 | Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability… |
CVE-2026-25544 | Critical | 9.8 | 2026-02-06 | Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded… |
CVE-2026-25533 | High | 8.8 | 2026-02-06 | Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.10.1, the existing layers of security in enclave-vm are insufficie… |
CVE-2026-25516 | Medium | 6.1 | 2026-02-06 | NiceGUI is a Python-based UI framework. The ui.markdown() component uses the markdown2 library to convert markdown content to HTML, which is then rendered via… |
CVE-2026-25123 | Medium | 5.3 | 2026-02-06 | Homarr is an open-source dashboard. Prior to 1.52.0, a public (unauthenticated) tRPC endpoint widget.app.ping accepts an arbitrary url and performs a server-si… |
CVE-2026-1731 | Critical | 9.8 | 2026-02-06 | BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulner… |
CVE-2026-1727 | | 2026-02-06 | The Agentspace service was affected by a vulnerability that exposed sensitive information due to the use of predictable Google Cloud Storage bucket names. Thes… | |
CVE-2026-2067 | High | 8.8 | 2026-02-06 | A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. This vulnerability affects the function strcpy of the file /goform/formTimeGroupConfig… |