2026 CVEs (page 429)
Page 429 of 682 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47749 | High | 7.8 | 2026-06-16 | stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior… |
CVE-2026-47748 | Medium | 5.5 | 2026-06-16 | stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior… |
CVE-2026-10748 | High | 7.2 | 2026-06-16 | An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the… |
CVE-2026-53776 | Critical | 9.1 | 2026-06-16 | Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting o… |
CVE-2026-44932 | High | 8.8 | 2026-06-16 | Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server… |
CVE-2026-42089 | High | 8.6 | 2026-06-16 | Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0… |
CVE-2026-24228 | High | 7.8 | 2026-06-16 | NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerabil… |
CVE-2026-24155 | High | 7.8 | 2026-06-16 | NVIDIA NeMo Framework for all platforms contains a code injection vulnerability. A successful exploit of this vulnerability might lead to code execution, escal… |
CVE-2026-12003 | | 2026-06-16 | To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to loca… | |
CVE-2026-10649 | High | 8.6 | 2026-06-16 | A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By… |
CVE-2026-9307 | | 2026-06-16 | A sensitive information disclosure security issue exists within the affected CompactLogix controllers. The controller's web server exposes CIP Connection IDs o… | |
CVE-2026-48780 | High | 8.2 | 2026-06-16 | Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain a… |
CVE-2026-47684 | High | 7.7 | 2026-06-16 | Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex… |
CVE-2026-12398 | High | 7.5 | 2026-06-16 | A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref na… |
CVE-2026-11317 | | 2026-06-16 | A denial of service security issue exists in the affected product. The security issue stems from a fault occurring when a crafted CIP message is sent. Devices… | |
CVE-2026-10831 | | 2026-06-16 | A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does not properly valid… | |
CVE-2026-10640 | Medium | 4.2 | 2026-06-16 | Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interface ICMP-s… |
CVE-2026-10639 | Medium | 4.8 | 2026-06-16 | In Zephyr's native IPv4 stack, icmpv4_handle_echo_request() in subsys/net/ip/icmpv4.c builds an echo-reply packet (reply), hands it to net_try_send_data(), and… |
CVE-2026-10638 | Medium | 5.9 | 2026-06-16 | subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try_send_data(). In icmpv6_handle_echo_request() and… |
CVE-2026-10637 | Medium | 5.9 | 2026-06-16 | subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully. Per the network stack's ow… |
CVE-2026-10636 | Low | 3.7 | 2026-06-16 | In Zephyr's IPv4 IGMP implementation, igmp_send() in subsys/net/ip/igmp.c read the network interface back out of the packet via net_pkt_iface(pkt) after the pa… |
CVE-2026-0647 | | 2026-06-16 | An improper authentication security issue exists within the 1794-AENTR adapter's embedded web server. The vulnerability allows an unauthenticated attacker to c… | |
CVE-2026-0646 | | 2026-06-16 | A denial-of-service security issue exists within the 1794-AENTR adapter due to improper memory handling of CIP protocol requests. This vulnerability can result… | |
CVE-2026-9507 | | 2026-06-16 | A session fixation vulnerability has been identified in osTicket v1.18.2. This security flaw allows an attacker to hijack a victim’s account by keeping the ini… | |
CVE-2026-53900 | Medium | 4.3 | 2026-06-16 | Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject a… |
CVE-2026-53899 | Medium | 6.5 | 2026-06-16 | Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging… |
CVE-2026-12330 | Medium | 5.4 | 2026-06-16 | Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 14… |
CVE-2026-12329 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12. |
CVE-2026-12328 | High | 8.1 | 2026-06-16 | Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed eviden… |
CVE-2026-12327 | High | 8.1 | 2026-06-16 | Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corrupt… |
CVE-2026-12326 | High | 8.1 | 2026-06-16 | Memory safety bugs present in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2026-12325 | Medium | 6.5 | 2026-06-16 | Denial-of-service in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, an… |
CVE-2026-12324 | High | 7.3 | 2026-06-16 | Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thu… |
CVE-2026-12323 | Medium | 5.4 | 2026-06-16 | Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12322 | Medium | 5.4 | 2026-06-16 | Clickjacking issue in the Widget: Gtk component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12321 | Medium | 5.4 | 2026-06-16 | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12320 | Medium | 4.3 | 2026-06-16 | Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12319 | Medium | 6.5 | 2026-06-16 | Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12318 | High | 7.3 | 2026-06-16 | Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12317 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12316 | Critical | 9.1 | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12315 | Critical | 9.1 | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12314 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12313 | Medium | 4.7 | 2026-06-16 | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderb… |
CVE-2026-12312 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12311 | Medium | 4.7 | 2026-06-16 | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderb… |
CVE-2026-12310 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12309 | Medium | 6.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12308 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12307 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12306 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12305 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12304 | Critical | 9.1 | 2026-06-16 | Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbi… |
CVE-2026-12303 | Medium | 4.3 | 2026-06-16 | Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12302 | Medium | 6.5 | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thu… |
CVE-2026-12301 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12300 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12299 | Medium | 5.4 | 2026-06-16 | JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and… |
CVE-2026-12298 | Medium | 5.4 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12297 | Critical | 9.6 | 2026-06-16 | Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 1… |
CVE-2026-12296 | Critical | 9.6 | 2026-06-16 | Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird… |
CVE-2026-12295 | Critical | 9.6 | 2026-06-16 | Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thun… |
CVE-2026-12294 | Critical | 9.6 | 2026-06-16 | Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunder… |
CVE-2026-12293 | Critical | 9.8 | 2026-06-16 | Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12292 | High | 8.1 | 2026-06-16 | Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140… |
CVE-2026-12291 | High | 8.8 | 2026-06-16 | Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thu… |
CVE-2026-12290 | High | 8.1 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 1… |
CVE-2026-12289 | High | 8.8 | 2026-06-16 | Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152… |
CVE-2026-8484 | | 2026-06-16 | A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl()" wrapper due to a lack of size verification for the argument array before the system call… | |
CVE-2026-40750 | Critical | 9.9 | 2026-06-16 | Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server. This issue affect… |
CVE-2026-12225 | | 2026-06-16 | syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vulnerability. An attacker with valid cre… | |
CVE-2026-10829 | | 2026-06-16 | A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier. This vulnerability stems from insuf… | |
CVE-2026-10828 | | 2026-06-16 | A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1… | |
CVE-2026-8442 | High | 8.1 | 2026-06-16 | The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authoriza… |
CVE-2026-8176 | High | 7.5 | 2026-06-16 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up… |
CVE-2026-5416 | High | 8.8 | 2026-06-16 | Due to the improper neutralization of special elements used in a name parameter a low privileged remote attacker can exploit a command injection vulnerability… |
CVE-2026-54198 | High | 7.1 | 2026-06-16 | Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions. |
CVE-2026-54197 | Medium | 6.5 | 2026-06-16 | Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions. |
CVE-2026-54191 | High | 7.1 | 2026-06-16 | Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions. |
CVE-2026-54190 | Medium | 6.5 | 2026-06-16 | Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions. |
CVE-2026-52715 | Critical | 9.3 | 2026-06-16 | Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. |
CVE-2026-52714 | Medium | 5.9 | 2026-06-16 | Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions. |
CVE-2026-52712 | High | 7.6 | 2026-06-16 | Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions. |
CVE-2026-52711 | High | 7.5 | 2026-06-16 | Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions. |
CVE-2026-49774 | Critical | 9.9 | 2026-06-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station… |
CVE-2026-49772 | Critical | 9.3 | 2026-06-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind S… |
CVE-2026-40809 | Medium | 6.5 | 2026-06-16 | Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2026-39581 | High | 8.5 | 2026-06-16 | Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions. |
CVE-2026-39574 | Critical | 9.3 | 2026-06-16 | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. |
CVE-2026-39490 | High | 7.5 | 2026-06-16 | Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions. |
CVE-2026-39437 | High | 7.1 | 2026-06-16 | Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions. |
CVE-2026-2381 | Medium | 6.5 | 2026-06-16 | The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_p… |
CVE-2026-10825 | | 2026-06-16 | A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticate… | |
CVE-2026-8444 | High | 8.8 | 2026-06-16 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions… |
CVE-2026-46331 | High | 7.8 | 2026-06-16 | In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() compute… |
CVE-2026-10093 | Medium | 6.4 | 2026-06-16 | The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldr_ttl' parameter in all… |
CVE-2026-9187 | Medium | 5.3 | 2026-06-16 | The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a… |
CVE-2026-8443 | High | 8.8 | 2026-06-16 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data A… |
CVE-2026-6933 | High | 8.8 | 2026-06-16 | The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due… |
CVE-2026-5149 | Medium | 6.5 | 2026-06-16 | The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 This is due to the get_submission_content… |