2026 CVEs (page 425)
Page 425 of 682 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34895 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions. |
CVE-2026-34894 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions. |
CVE-2026-34893 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions. |
CVE-2026-34888 | High | 7.5 | 2026-06-17 | Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions. |
CVE-2026-32967 | Critical | 9.1 | 2026-06-17 | Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. U… |
CVE-2026-32966 | Critical | 9.8 | 2026-06-17 | DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache DolphinSch… |
CVE-2026-2604 | Medium | 5.6 | 2026-06-17 | A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craf… |
CVE-2026-28615 | High | 7.8 | 2026-06-17 | In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with… |
CVE-2026-28587 | Medium | 5.5 | 2026-06-17 | In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local… |
CVE-2026-28576 | Medium | 5.5 | 2026-06-17 | In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no add… |
CVE-2026-28575 | Medium | 5.5 | 2026-06-17 | In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a possible memory exhau… |
CVE-2026-27870 | | 2026-06-17 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who has the vulnerable s… | |
CVE-2026-27869 | | 2026-06-17 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerabl… | |
CVE-2026-27868 | | 2026-06-17 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerabl… | |
CVE-2026-27429 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions. |
CVE-2026-27410 | Medium | 6.5 | 2026-06-17 | Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions. |
CVE-2026-27400 | High | 8.6 | 2026-06-17 | Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions. |
CVE-2026-27395 | Critical | 9.8 | 2026-06-17 | Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions. |
CVE-2026-27041 | Critical | 9.9 | 2026-06-17 | Contributor Arbitrary File Upload in Unlimited Elements for Elementor (Premium) <= 2.0.6 versions. |
CVE-2026-25470 | Critical | 10.0 | 2026-06-17 | Unauthenticated Remote Code Execution (RCE) in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.47 versions. |
CVE-2026-25446 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in WishList Member X <= 3.29.0 versions. |
CVE-2026-25439 | High | 8.1 | 2026-06-17 | Unauthenticated Broken Authentication in Booknetic <= 4.8.5 versions. |
CVE-2026-24611 | Critical | 9.1 | 2026-06-17 | Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions. |
CVE-2026-24610 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in MetForm Pro <= 3.9.1 versions. |
CVE-2026-24575 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in WishList Member X <= 3.29.0 versions. |
CVE-2026-22343 | High | 8.6 | 2026-06-17 | Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions. |
CVE-2026-22342 | High | 8.8 | 2026-06-17 | Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions. |
CVE-2026-22340 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions. |
CVE-2026-22339 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions. |
CVE-2026-22338 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions. |
CVE-2026-22335 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions. |
CVE-2026-22334 | High | 7.5 | 2026-06-17 | Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions. |
CVE-2026-22332 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions. |
CVE-2026-22331 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions. |
CVE-2026-22330 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Right Way <= 4.0 versions. |
CVE-2026-22329 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions. |
CVE-2026-22328 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions. |
CVE-2026-22327 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions. |
CVE-2026-22326 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions. |
CVE-2026-22325 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions. |
CVE-2026-12491 | Medium | 4.8 | 2026-06-17 | A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specif… |
CVE-2026-12469 | Medium | 4.3 | 2026-06-17 | Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chro… |
CVE-2026-12468 | High | 8.3 | 2026-06-17 | Race in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
CVE-2026-12467 | High | 8.3 | 2026-06-17 | Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-12466 | High | 8.8 | 2026-06-17 | Heap buffer overflow in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page… |
CVE-2026-12465 | High | 8.3 | 2026-06-17 | Object lifecycle issue in Metrics in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-12464 | High | 8.3 | 2026-06-17 | Use after free in Browser in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-12463 | Medium | 4.7 | 2026-06-17 | Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to i… |
CVE-2026-12462 | High | 7.5 | 2026-06-17 | Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execute arbitrary code i… |
CVE-2026-12461 | Medium | 6.5 | 2026-06-17 | Out of bounds read in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive information from pro… |
CVE-2026-12460 | Medium | 4.2 | 2026-06-17 | Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-12459 | Medium | 6.1 | 2026-06-17 | Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a craf… |
CVE-2026-12458 | Low | 3.1 | 2026-06-17 | Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-12457 | Medium | 4.2 | 2026-06-17 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypas… |
CVE-2026-12456 | Medium | 4.2 | 2026-06-17 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-12455 | High | 7.5 | 2026-06-17 | Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gestures to potent… |
CVE-2026-12454 | High | 8.3 | 2026-06-17 | Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-12453 | Medium | 4.2 | 2026-06-17 | Insufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-12452 | High | 8.8 | 2026-06-17 | Use after free in Downloads in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2026-12451 | High | 8.3 | 2026-06-17 | Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-12450 | Medium | 6.5 | 2026-06-17 | Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive information from proce… |
CVE-2026-12449 | High | 7.8 | 2026-06-17 | Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to perform OS-level privilege escalation via a malici… |
CVE-2026-12448 | High | 8.8 | 2026-06-17 | Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to perform privilege escalation via a cra… |
CVE-2026-12447 | High | 8.8 | 2026-06-17 | Heap buffer overflow in WebRTC in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… |
CVE-2026-12446 | Medium | 4.3 | 2026-06-17 | Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-12445 | High | 7.5 | 2026-06-17 | Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2026-12444 | Medium | 5.5 | 2026-06-17 | Out of bounds read in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to obtain potentially sensitive information from… |
CVE-2026-12443 | High | 8.8 | 2026-06-17 | Use after free in Web Authentication in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chr… |
CVE-2026-12442 | High | 8.8 | 2026-06-17 | Use after free in Passwords in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (C… |
CVE-2026-12441 | High | 8.8 | 2026-06-17 | Use after free in File Input in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2026-12440 | Critical | 9.6 | 2026-06-17 | Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to potentially perform a sandbox escape via… |
CVE-2026-12439 | High | 8.8 | 2026-06-17 | Use after free in Digital Credentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2026-12438 | High | 8.3 | 2026-06-17 | Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-12437 | High | 8.3 | 2026-06-17 | Use after free in WebShare in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentiall… |
CVE-2026-12360 | High | 7.5 | 2026-06-17 | The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a fi… |
CVE-2026-12256 | High | 8.8 | 2026-06-17 | Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/… |
CVE-2026-12199 | High | 7.5 | 2026-06-17 | A vulnerability in `nltk.app.wordnet_app` up to version 3.9.3 allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when started in i… |
CVE-2026-12165 | High | 8.8 | 2026-06-17 | The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in all versions up to… |
CVE-2026-12115 | Medium | 6.6 | 2026-06-17 | The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and… |
CVE-2026-11975 | | 2026-06-17 | Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary… | |
CVE-2026-11858 | | 2026-06-17 | Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\SYSTEM… | |
CVE-2026-11857 | | 2026-06-17 | Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service due to insecure deserialization in the .NET Remo… | |
CVE-2026-11410 | High | 7.2 | 2026-06-17 | An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module in TL-WR940N v6 due to improper sanitization of… |
CVE-2026-11409 | High | 7.2 | 2026-06-17 | An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input… |
CVE-2026-10839 | | 2026-06-17 | Open redirection vulnerability in the authentication system allows an attacker to use manipulated values in the X-Forwarded-Host header to alter the URLs gener… | |
CVE-2026-10837 | | 2026-06-17 | Open redirection vulnerability due to insufficient validation of the X-Forwarded-Host HTTP header. An attacker could create manipulated links that, when opened… | |
CVE-2026-10836 | | 2026-06-17 | Improper handling of HTTP headers that allows a remote attacker to manipulate the value of the Host header using specially crafted requests. A successful explo… | |
CVE-2026-10094 | Critical | 9.8 | 2026-06-17 | A Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2024 through SOLIDWORKS Desktop Release 2026 could allow an attac… |
CVE-2026-0092 | High | 7.8 | 2026-06-17 | In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with… |
CVE-2026-0083 | High | 7.0 | 2026-06-17 | In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no addition… |
CVE-2026-0082 | High | 7.8 | 2026-06-17 | In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could… |
CVE-2026-0081 | High | 7.8 | 2026-06-17 | In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escalation of privilege with no additional ex… |
CVE-2026-0071 | High | 7.8 | 2026-06-17 | In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilege with no additio… |
CVE-2026-0068 | High | 7.8 | 2026-06-17 | In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync… |
CVE-2026-0064 | Medium | 5.5 | 2026-06-17 | In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional… |
CVE-2026-0063 | High | 7.8 | 2026-06-17 | In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the code. This could lead… |
CVE-2026-0057 | Low | 3.3 | 2026-06-17 | In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could l… |
CVE-2026-0019 | High | 7.8 | 2026-06-17 | In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no… |
CVE-2026-48776 | Medium | 4.2 | 2026-06-17 | LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14… |
CVE-2026-48294 | High | 7.4 | 2026-06-17 | Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could e… |