2026 CVEs (page 422)
Page 422 of 682 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12527 | | 2026-06-18 | A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmware AppFHE1_V1.0.6.02… | |
CVE-2026-12039 | | 2026-06-18 | Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network embedded DNS server forwards any queri… | |
CVE-2026-11958 | | 2026-06-18 | Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to t… | |
CVE-2026-11719 | High | 8.1 | 2026-06-18 | An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers. While… |
CVE-2026-11718 | Critical | 9.1 | 2026-06-18 | An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When the toolbox va… |
CVE-2026-11717 | Critical | 9.1 | 2026-06-18 | An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When verifying an u… |
CVE-2026-8811 | | 2026-06-18 | SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new fil… | |
CVE-2026-8039 | Medium | 6.4 | 2026-06-18 | The Fancy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' shortcode attribute in the 'testimonial' shortcode in… |
CVE-2026-50643 | | 2026-06-18 | 8cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers. The compiler accepts attacker-controlled filename… | |
CVE-2026-2021 | Medium | 6.4 | 2026-06-18 | The Slideshow Gallery LITE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alwaysauto' shortcode attribute in all versions up to, an… |
CVE-2026-9815 | Medium | 6.5 | 2026-06-18 | The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-fie… |
CVE-2026-55746 | High | 7.6 | 2026-06-18 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_titl… |
CVE-2026-55745 | Medium | 5.4 | 2026-06-18 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.ed… |
CVE-2026-55744 | High | 8.1 | 2026-06-18 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.ma… |
CVE-2026-55742 | Critical | 9.6 | 2026-06-18 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.p… |
CVE-2026-55741 | High | 8.8 | 2026-06-18 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.c… |
CVE-2026-28573 | Medium | 5.5 | 2026-06-18 | In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no… |
CVE-2026-12137 | Medium | 6.1 | 2026-06-18 | The SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scr… |
CVE-2026-12136 | Medium | 6.4 | 2026-06-18 | The Customize My Account For Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sysbasics_user_avatar' shortcode in version… |
CVE-2026-12111 | Medium | 4.3 | 2026-06-18 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.4.01. This is due to… |
CVE-2026-12102 | Low | 2.7 | 2026-06-18 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Obj… |
CVE-2026-12098 | Medium | 6.4 | 2026-06-18 | The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed' Episode Meta Field in all versions up… |
CVE-2026-11395 | High | 7.2 | 2026-06-18 | The CF7 to Webhook plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.0 via the pull_the_trigger. This… |
CVE-2026-9860 | High | 8.8 | 2026-06-18 | The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.10.2 via… |
CVE-2026-9199 | Medium | 4.3 | 2026-06-18 | The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to authorization bypass in all versio… |
CVE-2026-55740 | Critical | 9.8 | 2026-06-18 | Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in… |
CVE-2026-12120 | Medium | 5.3 | 2026-06-18 | The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in… |
CVE-2026-12093 | Medium | 5.3 | 2026-06-18 | The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to the plugin not pro… |
CVE-2026-11784 | Medium | 4.3 | 2026-06-18 | The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in… |
CVE-2026-11777 | Medium | 4.9 | 2026-06-18 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'name' parameter… |
CVE-2026-11776 | Medium | 4.9 | 2026-06-18 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'groupids' param… |
CVE-2026-11402 | Medium | 6.4 | 2026-06-18 | The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'link' Block Att… |
CVE-2026-11360 | Medium | 4.9 | 2026-06-18 | The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_direction' parameter in all versions up to… |
CVE-2026-11358 | Medium | 4.4 | 2026-06-18 | The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi… |
CVE-2026-11357 | Medium | 4.3 | 2026-06-18 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… |
CVE-2026-10736 | Medium | 4.9 | 2026-06-18 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to… |
CVE-2026-10623 | Medium | 4.3 | 2026-06-18 | The PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versio… |
CVE-2026-10029 | Medium | 5.3 | 2026-06-18 | The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions… |
CVE-2026-12505 | High | 7.8 | 2026-06-18 | A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a… |
CVE-2026-12407 | High | 8.8 | 2026-06-18 | The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to… |
CVE-2026-10023 | Medium | 4.3 | 2026-06-18 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Ob… |
CVE-2026-12569 | Critical | 9.8 | 2026-06-18 | A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the… |
CVE-2026-48768 | Critical | 9.3 | 2026-06-18 | TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized f… |
CVE-2026-48764 | High | 8.2 | 2026-06-18 | TypeBot is a chatbot builder tool. In versions prior to 3.17.2, SSRF validation is implemented by resolving a hostname once and checking whether the resolved I… |
CVE-2026-54533 | | 2026-06-17 | vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, malicious algorithms can potentially access other algorithms… | |
CVE-2026-54445 | | 2026-06-17 | vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `r… | |
CVE-2026-53676 | High | 7.2 | 2026-06-17 | ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the… |
CVE-2026-50268 | Low | 1.9 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encrypti… |
CVE-2026-50267 | Medium | 4.7 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstract… |
CVE-2026-50202 | Medium | 5.9 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Security.Authenticatio… |
CVE-2026-50201 | Medium | 6.5 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint pr… |
CVE-2026-48759 | High | 7.1 | 2026-06-17 | TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modi… |
CVE-2026-45617 | High | 7.5 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in strip_html filter uses a… |
CVE-2026-45357 | High | 7.5 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementat… |
CVE-2026-44646 | Medium | 5.3 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, Context.spawn() creates a child Contex… |
CVE-2026-44645 | Medium | 6.5 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the renderLimit option can be fully by… |
CVE-2026-44644 | Medium | 6.1 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Versions 10.25.7 and below are vulnerable to XSS through a flaw in th… |
CVE-2026-12568 | Medium | 6.5 | 2026-06-17 | The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious works… |
CVE-2026-12567 | Low | 2.2 | 2026-06-17 | The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing th… |
CVE-2026-12566 | Low | 3.1 | 2026-06-17 | The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An… |
CVE-2026-12565 | Medium | 5.3 | 2026-06-17 | The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of exter… |
CVE-2026-8050 | High | 7.5 | 2026-06-17 | In SignalRGB versions prior to 1.3.7.0, seven of the thirteen IOCTL handlers dereference the SystemBuffer pointer without first verifying that it is non-NULL… |
CVE-2026-8049 | Medium | 5.3 | 2026-06-17 | In SignalRGB versions prior to 1.3.7.0, the \\.\SignalIo device object is created without an explicit SDDL security descriptor and without FILE_DEVICE_SECURE_O… |
CVE-2026-54386 | Medium | 6.1 | 2026-06-17 | marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary Jav… |
CVE-2026-50200 | High | 7.5 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint pr… |
CVE-2026-50196 | High | 7.5 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior… |
CVE-2026-50194 | High | 8.2 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. When Steeltoe management endpoints… |
CVE-2026-48997 | High | 7.1 | 2026-06-17 | e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In… |
CVE-2026-48991 | Medium | 5.5 | 2026-06-17 | XianYuLauncher is a Minecraft Java Edition launcher. In versions prior to 1.5.5, sensitive authentication artifacts could be exposed during a user-initiated lo… |
CVE-2026-48990 | Medium | 5.3 | 2026-06-17 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, jo… |
CVE-2026-48989 | | 2026-06-17 | Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane with… | |
CVE-2026-48820 | | 2026-06-17 | CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 thr… | |
CVE-2026-12530 | High | 7.3 | 2026-06-17 | Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK versions >= 1.1.3 and < 1.6.1 might allow a… |
CVE-2026-49133 | Medium | 6.5 | 2026-06-17 | Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside… |
CVE-2026-48988 | Medium | 5.3 | 2026-06-17 | markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^… |
CVE-2026-48979 | High | 7.5 | 2026-06-17 | PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the… |
CVE-2026-48821 | Medium | 5.8 | 2026-06-17 | Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a DOM-based Cross-Site Scripting (XSS) vulnerability in the Thumbnail Synchronizer… |
CVE-2026-55202 | High | 8.2 | 2026-06-17 | Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to… |
CVE-2026-55201 | Medium | 6.8 | 2026-06-17 | Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the download_dir() function that allows a rogue or compromised remo… |
CVE-2026-55200 | High | 8.1 | 2026-06-17 | libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on pa… |
CVE-2026-55199 | Medium | 5.9 | 2026-06-17 | libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c… |
CVE-2026-54388 | Critical | 9.1 | 2026-06-17 | Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all du… |
CVE-2026-54387 | Critical | 9.1 | 2026-06-17 | Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbat… |
CVE-2026-50107 | High | 8.1 | 2026-06-17 | When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration gen… |
CVE-2026-48823 | Medium | 4.8 | 2026-06-17 | Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the tag filtering functionali… |
CVE-2026-48822 | Medium | 5.8 | 2026-06-17 | Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the Markdown-to-HTML conversi… |
CVE-2026-48817 | Medium | 5.3 | 2026-06-17 | Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the… |
CVE-2026-48814 | Critical | 9.1 | 2026-06-17 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier, the MCP SSE server allows unauthenticated cross-origin MCP tool inv… |
CVE-2026-32682 | Medium | 6.5 | 2026-06-17 | When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause t… |
CVE-2026-12529 | High | 7.3 | 2026-06-17 | A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. Affected is an unknown function of… |
CVE-2026-11407 | High | 7.2 | 2026-06-17 | Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP o… |
CVE-2026-10741 | Medium | 4.9 | 2026-06-17 | Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configuration that allows a delegated repositor… |
CVE-2026-10696 | High | 7.5 | 2026-06-17 | Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contrib… |
CVE-2026-55198 | Medium | 6.5 | 2026-06-17 | Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions f… |
CVE-2026-55197 | Medium | 6.5 | 2026-06-17 | Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-prof… |
CVE-2026-55196 | Critical | 9.1 | 2026-06-17 | Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to… |
CVE-2026-53871 | High | 8.1 | 2026-06-17 | Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names fro… |
CVE-2026-53870 | Medium | 5.5 | 2026-06-17 | Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history… |
CVE-2026-53869 | High | 7.5 | 2026-06-17 | Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. Fas… |
CVE-2026-48818 | High | 7.5 | 2026-06-17 | Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker… |