2026 CVEs (page 421)
Page 421 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-25635 | High | 8.6 | 2026-02-06 | calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user… |
CVE-2026-25634 | High | 7.8 | 2026-02-06 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to 2.3.1.4… |
CVE-2026-25632 | Critical | 10.0 | 2026-02-06 | EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EP… |
CVE-2026-25631 | Medium | 6.5 | 2026-02-06 | n8n is an open source workflow automation platform. Prior to 1.121.0, there is a vulnerability in the HTTP Request node's credential domain validation allowed… |
CVE-2026-25628 | High | 8.5 | 2026-02-06 | Qdrant is a vector similarity search engine and vector database. From 1.9.3 to before 1.16.0, it is possible to append to arbitrary files via /logger endpoint… |
CVE-2026-25597 | Medium | 5.3 | 2026-02-06 | PrestaShop is an open source e-commerce web application. Prior to 8.2.4 and 9.0.3, there is a time-based user enumeration vulnerability in the user authenticat… |
CVE-2026-25593 | High | 8.4 | 2026-02-06 | OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply a… |
CVE-2026-25592 | Critical | 9.9 | 2026-02-06 | Semantic Kernel is an SDK used to build, orchestrate, and deploy AI agents and multi-agent systems. Prior to 1.71.0, an Arbitrary File Write vulnerability has… |
CVE-2026-25581 | Medium | 5.4 | 2026-02-06 | SCEditor is a lightweight WYSIWYG BBCode and XHTML editor. Prior to 3.2.1, if an attacker has the ability control configuration options passed to sceditor.crea… |
CVE-2026-25580 | High | 8.6 | 2026-02-06 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery… |
CVE-2026-2065 | Medium | 6.3 | 2026-02-06 | A security flaw has been discovered in Flycatcher Toys smART Pixelator 2.0. Affected by this issue is some unknown functionality of the component Bluetooth Low… |
CVE-2026-2064 | Low | 3.5 | 2026-02-06 | A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.ph… |
CVE-2026-25727 | Medium | 6.5 | 2026-02-06 | time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 forma… |
CVE-2026-25643 | Critical | 9.1 | 2026-02-06 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution (RCE) vulne… |
CVE-2026-25642 | Medium | 4.3 | 2026-02-06 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.6, files served below the /uploads/ endpoint did not use a more… |
CVE-2026-25641 | Critical | 10.0 | 2026-02-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, there is a sandbox escape vulnerability due to a mismatch between the key on which the validatio… |
CVE-2026-25640 | High | 7.1 | 2026-02-06 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerabili… |
CVE-2026-25587 | Critical | 10.0 | 2026-02-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, as Map is in SAFE_PROTOYPES, it's prototype can be obtained via Map.prototype. By overwriting Ma… |
CVE-2026-25586 | Critical | 10.0 | 2026-02-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty on a sandbox object, which disables pro… |
CVE-2026-25520 | Critical | 10.0 | 2026-02-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries can be used to get a… |
CVE-2026-22254 | Unrated | | 2026-02-06 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access… |
CVE-2026-1709 | Critical | 9.4 | 2026-02-06 | A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This auth… |
CVE-2026-2063 | Medium | 4.7 | 2026-02-06 | A security flaw has been discovered in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/set_ac_server of the component Web M… |
CVE-2026-2062 | Medium | 5.3 | 2026-02-06 | A vulnerability was identified in Open5GS up to 2.7.6. This affects the function sgwc_s5c_handle_modify_bearer_response/sgwc_sxa_handle_session_modification_re… |
CVE-2026-25753 | Critical | 9.8 | 2026-02-06 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application uses a hard-coded, static default password fo… |
CVE-2026-25752 | Critical | 9.1 | 2026-02-06 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attac… |
CVE-2026-25751 | High | 7.5 | 2026-02-06 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote att… |
CVE-2026-25651 | Medium | 6.1 | 2026-02-06 | client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certific… |
CVE-2026-25650 | High | 7.5 | 2026-02-06 | MCP Salesforce Connector is a Model Context Protocol (MCP) server implementation for Salesforce integration. Prior to 0.1.10, arbitrary attribute access leads… |
CVE-2026-25647 | Medium | 4.6 | 2026-02-06 | Lute is a structured Markdown engine supporting Go and JavaScript. Lute 1.7.6 and earlier (as used in SiYuan before) has a Stored Cross-Site Scripting (XSS) vu… |
CVE-2026-24418 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based S… |
CVE-2026-24417 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Bl… |
CVE-2026-24416 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Bl… |
CVE-2026-24050 | Medium | 5.4 | 2026-02-06 | Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in gro… |
CVE-2026-23989 | High | 8.2 | 2026-02-06 | REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a mali… |
CVE-2026-2061 | Medium | 4.7 | 2026-02-06 | A vulnerability was determined in D-Link DIR-823X 250416. Affected by this issue is the function sub_424D20 of the file /goform/set_ipv6. Executing a manipulat… |
CVE-2026-2060 | High | 7.3 | 2026-02-06 | A vulnerability was found in code-projects Simple Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /si… |
CVE-2026-25725 | Critical | 10.0 | 2026-02-06 | Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.js… |
CVE-2026-25724 | High | 7.5 | 2026-02-06 | Claude Code is an agentic coding tool. Prior to version 2.1.7, Claude Code failed to strictly enforce deny rules configured in settings.json when accessing fil… |
CVE-2026-25723 | Medium | 6.5 | 2026-02-06 | Claude Code is an agentic coding tool. Prior to version 2.0.55, Claude Code failed to properly validate commands using piped sed operations with the echo comma… |
CVE-2026-25722 | Critical | 9.1 | 2026-02-06 | Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations t… |
CVE-2026-24903 | Medium | 5.4 | 2026-02-06 | OrcaStatLLM Researcher is an LLM Based Research Paper Generator. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Log Message in the Se… |
CVE-2026-24851 | High | 8.8 | 2026-02-06 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.5 to v1.11.2 ( op… |
CVE-2026-24776 | Medium | 4.3 | 2026-02-06 | OpenProject is an open-source, web-based project management software. Prior to 17.0.2, the drag&drop handler moving an agenda item to a different section was n… |
CVE-2026-24419 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based S… |
CVE-2026-24135 | High | 8.1 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The… |
CVE-2026-23633 | Medium | 6.5 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, there is an arbitrary file read/write via path traversal in Git hook editing. This… |
CVE-2026-23632 | Medium | 6.5 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, the endpoint "PUT /repos/:owner/:repo/contents/*" does not require write permissio… |
CVE-2026-22592 | Medium | 6.5 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, an authenticated user can cause a DOS attack. If one of the repo files is deleted… |
CVE-2026-1769 | Medium | 5.3 | 2026-02-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xerox CentreWare on Windows allows Stored XSS.This… |
CVE-2026-2103 | High | 7.1 | 2026-02-06 | Infor SyteLine ERP uses hard-coded static cryptographic keys to encrypt stored credentials, including user passwords, database connection strings, and API keys… |
CVE-2026-2059 | High | 7.3 | 2026-02-06 | A vulnerability has been found in SourceCodester Medical Center Portal Management System 1.0. Affected is an unknown function of the file /emp_edit1.php. Such… |
CVE-2026-2058 | High | 7.3 | 2026-02-06 | A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file /… |
CVE-2026-25556 | High | 7.5 | 2026-02-06 | MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list ren… |
CVE-2026-23741 | Unrated | | 2026-02-06 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the asterisk/cont… |
CVE-2026-23740 | Unrated | | 2026-02-06 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when ast_coredump… |
CVE-2026-23739 | Low | 2.0 | 2026-02-06 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open(… |
CVE-2026-23738 | Low | 3.5 | 2026-02-06 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/con… |
CVE-2026-2057 | High | 7.3 | 2026-02-06 | A vulnerability was detected in SourceCodester Medical Center Portal Management System 1.0. This affects an unknown function of the file /login.php. The manipu… |
CVE-2026-2056 | Medium | 5.3 | 2026-02-06 | A security vulnerability has been detected in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. The impacted element is an unknown function of the file /wan_connec… |
CVE-2026-1337 | Medium | 5.4 | 2026-02-06 | Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs… |
CVE-2026-2055 | Medium | 5.3 | 2026-02-06 | A weakness has been identified in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. The affected element is an unknown function of the component DHCP Client Inform… |
CVE-2026-2054 | Medium | 5.3 | 2026-02-06 | A security flaw has been discovered in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. Impacted is an unknown function of the component Wifi Setting Handler. Per… |
CVE-2026-2018 | High | 7.3 | 2026-02-06 | A flaw has been found in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/settings/controller.php. This manipulati… |
CVE-2026-2017 | Critical | 9.8 | 2026-02-06 | A vulnerability was detected in IP-COM W30AP up to 1.0.0.11(1340). Affected by this issue is the function R7WebsSecurityHandler of the file /goform/wx3auth of… |
CVE-2026-2016 | Medium | 5.3 | 2026-02-06 | A security vulnerability has been detected in happyfish100 libfastcommon up to 1.0.84. Affected by this vulnerability is the function base64_decode of the file… |
CVE-2026-1293 | Medium | 6.4 | 2026-02-06 | The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `yoast-schem… |
CVE-2026-2015 | Medium | 6.3 | 2026-02-06 | A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Fin… |
CVE-2026-2014 | High | 7.3 | 2026-02-06 | A security flaw has been discovered in itsourcecode Student Management System 1.0. This impacts an unknown function of the file /ramonsys/billing/index.php. Pe… |
CVE-2026-2013 | High | 7.3 | 2026-02-06 | A vulnerability was identified in itsourcecode Student Management System 1.0. This affects an unknown function of the file /ramonsys/soa/index.php. Such manipu… |
CVE-2026-24928 | Medium | 5.8 | 2026-02-06 | Out-of-bounds write vulnerability in the file system module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-24927 | Medium | 5.5 | 2026-02-06 | Out-of-bounds access vulnerability in the frequency modulation module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24924 | Medium | 6.1 | 2026-02-06 | Vulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-24920 | Medium | 6.2 | 2026-02-06 | Permission control vulnerability in the AMS module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-2012 | High | 7.3 | 2026-02-06 | A vulnerability was determined in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /ramonsys/facultyloading/… |
CVE-2026-2011 | High | 7.3 | 2026-02-06 | A vulnerability was found in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /ramonsys/enrollment/controlle… |
CVE-2026-24931 | Medium | 5.9 | 2026-02-06 | Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-24930 | High | 8.4 | 2026-02-06 | UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24929 | Medium | 5.9 | 2026-02-06 | Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24926 | High | 8.4 | 2026-02-06 | Out-of-bounds write vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24925 | High | 7.3 | 2026-02-06 | Heap-based buffer overflow vulnerability in the image module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24923 | Medium | 6.3 | 2026-02-06 | Permission control vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-24922 | Medium | 6.9 | 2026-02-06 | Buffer overflow vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24921 | Medium | 4.8 | 2026-02-06 | Address read vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2026-24919 | Medium | 6.0 | 2026-02-06 | Out-of-bounds write vulnerability in the DFX module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24918 | Medium | 6.8 | 2026-02-06 | Address read vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24917 | Medium | 6.5 | 2026-02-06 | UAF vulnerability in the security module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24916 | Medium | 5.9 | 2026-02-06 | Identity authentication bypass vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-24915 | Medium | 6.2 | 2026-02-06 | Out-of-bounds read issue in the media subsystem. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2026-24914 | Medium | 4.0 | 2026-02-06 | Type confusion vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-21643 | Critical | 9.8 | 2026-02-06 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthentic… |
CVE-2026-1785 | Medium | 4.3 | 2026-02-06 | The Code Snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.4. This is due to missing nonce va… |
CVE-2026-1499 | High | 8.8 | 2026-02-06 | The WP Duplicate plugin for WordPress is vulnerable to Missing Authorization leading to Arbitrary File Upload in all versions up to and including 1.1.8. This i… |
CVE-2026-1252 | Medium | 6.4 | 2026-02-06 | The Events Listing Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Event URL' parameter in all versions up to, and including… |
CVE-2026-2010 | Medium | 4.2 | 2026-02-06 | A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/public… |
CVE-2026-2009 | Medium | 6.3 | 2026-02-06 | A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/php_action/createUser… |
CVE-2026-21626 | High | 7.5 | 2026-02-06 | Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure |
CVE-2026-1279 | Medium | 6.4 | 2026-02-06 | The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_title' parameter in the `search_employee_directory` shor… |
CVE-2026-2008 | Medium | 6.3 | 2026-02-06 | A vulnerability was detected in abhiphile fermat-mcp up to 47f11def1cd37e45dd060f30cdce346cbdbd6f0a. This vulnerability affects the function eqn_chart of the f… |
CVE-2026-2000 | Medium | 4.7 | 2026-02-06 | A vulnerability was found in DCN DCME-320 up to 20260121. Impacted is the function apply_config of the file /function/system/basic/bridge_cfg.php of the compon… |