2026 CVEs (page 433)
Page 433 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0784 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0783 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0782 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0781 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0780 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0779 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-0778 | High | 8.8 | 2026-01-23 | Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute a… |
CVE-2026-0776 | High | 7.3 | 2026-01-23 | Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on a… |
CVE-2026-0775 | High | 7.0 | 2026-01-23 | npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2026-0774 | High | 8.8 | 2026-01-23 | WatchYourLAN Configuration Page Argument Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitra… |
CVE-2026-0773 | Critical | 9.8 | 2026-01-23 | Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2026-0772 | High | 7.5 | 2026-01-23 | Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2026-0771 | High | 7.1 | 2026-01-23 | Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2026-0770 | Critical | 9.8 | 2026-01-23 | Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers… |
CVE-2026-0769 | Critical | 9.8 | 2026-01-23 | Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-0768 | Critical | 9.8 | 2026-01-23 | Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installation… |
CVE-2026-0767 | Medium | 6.5 | 2026-01-23 | Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensiti… |
CVE-2026-0766 | High | 8.8 | 2026-01-23 | Open WebUI load_tool_module_by_id Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0765 | High | 8.8 | 2026-01-23 | Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2026-0764 | Critical | 9.8 | 2026-01-23 | GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2026-0763 | Critical | 9.8 | 2026-01-23 | GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers t… |
CVE-2026-0762 | High | 8.1 | 2026-01-23 | GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2026-0761 | Critical | 9.8 | 2026-01-23 | Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2026-0760 | Critical | 9.8 | 2026-01-23 | Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers… |
CVE-2026-0759 | Critical | 9.8 | 2026-01-23 | Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec… |
CVE-2026-0758 | High | 7.8 | 2026-01-23 | mcp-server-siri-shortcuts shortcutName Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges o… |
CVE-2026-0757 | High | 8.8 | 2026-01-23 | MCP Manager for Claude Desktop execute-command Command Injection Sandbox Escape Vulnerability. This vulnerability allows remote attackers to bypass the sandbox… |
CVE-2026-0756 | Critical | 9.8 | 2026-01-23 | github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2026-0755 | Critical | 9.8 | 2026-01-23 | gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affect… |
CVE-2026-0710 | High | 8.4 | 2026-01-23 | A flaw was found in SIPp. A remote attacker could exploit this by sending specially crafted Session Initiation Protocol (SIP) messages during an active call. T… |
CVE-2026-24304 | Critical | 9.9 | 2026-01-23 | Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network. |
CVE-2026-24138 | High | 7.5 | 2026-01-23 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticated SSRF vulnerabilit… |
CVE-2026-24137 | Medium | 5.8 | 2026-01-23 | sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go)… |
CVE-2026-24132 | Critical | 9.8 | 2026-01-23 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0… |
CVE-2026-20613 | High | 7.8 | 2026-01-23 | The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive memb… |
CVE-2026-24307 | Critical | 9.3 | 2026-01-22 | Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2026-24306 | Critical | 9.8 | 2026-01-22 | Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-24305 | Critical | 9.3 | 2026-01-22 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2026-24130 | Medium | 5.3 | 2026-01-22 | Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the "ldap" compon… |
CVE-2026-24129 | High | 8.0 | 2026-01-22 | Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versions 3.7.0 and above allow an authentica… |
CVE-2026-24124 | Critical | 9.8 | 2026-01-22 | Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) l… |
CVE-2026-21524 | High | 7.4 | 2026-01-22 | Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network. |
CVE-2026-21521 | High | 7.4 | 2026-01-22 | Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2026-21520 | High | 7.5 | 2026-01-22 | Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network at… |
CVE-2026-21264 | Critical | 9.3 | 2026-01-22 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing o… |
CVE-2026-21227 | High | 8.2 | 2026-01-22 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a… |
CVE-2026-24117 | Medium | 5.3 | 2026-01-22 | Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index… |
CVE-2026-24058 | Critical | 9.8 | 2026-01-22 | Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an att… |
CVE-2026-23988 | High | 7.3 | 2026-01-22 | Rufus is a utility that helps format and create bootable USB flash drives. Versions 4.11 and below contain a race condition (TOCTOU) in src/net.c during the cr… |
CVE-2026-23954 | High | 8.7 | 2026-01-22 | Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with a custom image (e.g… |
CVE-2026-23953 | High | 8.7 | 2026-01-22 | Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configu… |
CVE-2026-23831 | Medium | 5.3 | 2026-01-22 | Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicali… |
CVE-2026-20912 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be… |
CVE-2026-20904 | Medium | 6.5 | 2026-01-22 | Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other us… |
CVE-2026-20897 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks b… |
CVE-2026-20888 | Medium | 4.3 | 2026-01-22 | Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able t… |
CVE-2026-20883 | Medium | 6.5 | 2026-01-22 | Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue t… |
CVE-2026-20800 | Medium | 6.5 | 2026-01-22 | Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository… |
CVE-2026-20750 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modi… |
CVE-2026-20736 | High | 7.5 | 2026-01-22 | Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete… |
CVE-2026-1201 | | 2026-01-22 | An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a rem… | |
CVE-2026-0798 | Low | 3.5 | 2026-01-22 | Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private… |
CVE-2026-22281 | Low | 3.5 | 2026-01-22 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0… |
CVE-2026-22280 | Medium | 5.0 | 2026-01-22 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0… |
CVE-2026-22279 | Medium | 4.3 | 2026-01-22 | Dell PowerScale OneFS, versions prior 9.13.0.0, contains an insufficient logging vulnerability. An unauthenticated attacker with remote access could potentiall… |
CVE-2026-24390 | High | 7.5 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Kentha Elementor Widgets… |
CVE-2026-24389 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery all… |
CVE-2026-24388 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-24387 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator wp-quick-post-duplicator allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-24386 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Element Invader Element Invader – Template Kits for Elementor elementinvader allows Exploiting Incorrectly Configured Ac… |
CVE-2026-24384 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in launchinteractive Merge + Minify + Refresh merge-minify-refresh allows Cross Site Request Forgery.This issue… |
CVE-2026-24383 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows DOM-Based XSS.This issu… |
CVE-2026-24381 | Medium | 5.4 | 2026-01-22 | Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods PhotoMe photome allows Server Side Request Forgery.This issue affects PhotoMe: from n/a through… |
CVE-2026-24380 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-24379 | Medium | 6.5 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-24377 | Medium | 4.3 | 2026-01-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retr… |
CVE-2026-24374 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Cross Site Reque… |
CVE-2026-24371 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-24368 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in Theme-one The Grid the-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects T… |
CVE-2026-24367 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.T… |
CVE-2026-24366 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in YITHEMES YITH WooCommerce Request A Quote yith-woocommerce-request-a-quote allows Exploiting Incorrectly Configured Acce… |
CVE-2026-24365 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in storeapps Stock Manager for WooCommerce woocommerce-stock-manager allows Cross Site Request Forgery.This iss… |
CVE-2026-24361 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress – Course Review learnpress-course-re… |
CVE-2026-24360 | Medium | 4.4 | 2026-01-22 | Server-Side Request Forgery (SSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Server Side Request Forgery.Thi… |
CVE-2026-24358 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2026-24357 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-24356 | Medium | 4.9 | 2026-01-22 | Missing Authorization vulnerability in Roxnor GetGenie getgenie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetG… |
CVE-2026-24355 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-func… |
CVE-2026-24354 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Shortcodes & Performance penci-shortcod… |
CVE-2026-24353 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-23978 | High | 7.5 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Softwebmedia Gyan Elements gyan-elemen… |
CVE-2026-23976 | Medium | 5.9 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery al… |
CVE-2026-23975 | High | 7.5 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo golo allows PHP Local File… |
CVE-2026-23974 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in uxper Golo golo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Golo: from n/… |
CVE-2026-23764 | | 2026-01-22 | VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Au… | |
CVE-2026-23763 | | 2026-01-22 | VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a local privilege escalation vulnerability in th… | |
CVE-2026-23762 | | 2026-01-22 | VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Au… | |
CVE-2026-23761 | | 2026-01-22 | VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Au… | |
CVE-2026-22483 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in winkm89 teachPress teachpress allows Cross Site Request Forgery.This issue affects teachPress: from n/a thro… |
CVE-2026-22482 | Medium | 4.9 | 2026-01-22 | Server-Side Request Forgery (SSRF) vulnerability in wbolt.com IMGspider imgspider allows Server Side Request Forgery.This issue affects IMGspider: from n/a thr… |