2026 CVEs (page 433)
Page 433 of 681 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8386 | Medium | 5.3 | 2026-06-15 | The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticat… |
CVE-2026-8385 | Medium | 5.3 | 2026-06-15 | The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allow… |
CVE-2026-12223 | Medium | 5.5 | 2026-06-15 | A vulnerability was identified in Yealink SIP-T46U 108.86.0.118. Affected by this vulnerability is the function mod_webd.TFTPUploadIperf of the file /api/inner… |
CVE-2026-12222 | High | 8.0 | 2026-06-15 | A vulnerability was determined in Yealink SIP-T46U 108.86.0.118. Affected is the function mod_webd.BlueToothTest of the file /api/inner/bttest of the component… |
CVE-2026-12221 | High | 8.0 | 2026-06-15 | A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of the file /api/upgrade/upgrade of the component Firmware Chunk… |
CVE-2026-12220 | High | 8.0 | 2026-06-15 | A vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects the function mod_upgrade.SparePartsUpload of the file /api/upgrade/accupgradebych… |
CVE-2026-12219 | Medium | 6.3 | 2026-06-15 | A flaw has been found in Yealink SIP-T46U 108.86.0.118. The impacted element is the function mod_diagnose.CommandShellByType of the file /api/diagnosis/start o… |
CVE-2026-12218 | High | 8.0 | 2026-06-15 | A vulnerability was detected in Yealink SIP-T46U 108.87.50.1. The affected element is the function StartReportInformation of the file /api/inner/beforewifitest… |
CVE-2026-12217 | High | 7.8 | 2026-06-15 | A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impacted is an unknown function in the library dvdfabio.sys of the component Signed… |
CVE-2026-12216 | Medium | 5.3 | 2026-06-15 | A weakness has been identified in svaarala duktape up to 2.99.99. This issue affects some unknown processing of the file duk_api_bytecode.c. Executing a manipu… |
CVE-2026-12214 | High | 7.8 | 2026-06-15 | A security flaw has been discovered in Qihoo 360 Total Security 6.0. This vulnerability affects the function RpcStringBindingComposeW of the component Nucleus… |
CVE-2026-12213 | Medium | 4.3 | 2026-06-15 | A vulnerability was found in hcengineering Huly Platform up to 0.7.0. Affected by this vulnerability is the function getAccountInfo of the file server/account/… |
CVE-2026-12212 | Medium | 4.3 | 2026-06-15 | A vulnerability has been found in hcengineering Huly Platform up to 0.7.0. Affected is the function getMailboxSecret of the file server/account/src/operations… |
CVE-2026-12211 | Low | 2.7 | 2026-06-15 | A flaw has been found in Intelbras iNVU 7016 FT 3.004.00IB000.0.T Build 2025-09-26. This impacts an unknown function of the file /RPC2_Loadfile/syslog/ of the… |
CVE-2026-12210 | Medium | 6.3 | 2026-06-15 | A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. P… |
CVE-2026-12209 | Medium | 5.3 | 2026-06-15 | A security vulnerability has been detected in RubyLouvre avalon up to 2.2.10. The impacted element is an unknown function of the file src/filters/index.js of t… |
CVE-2026-12208 | Medium | 5.3 | 2026-06-15 | A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component… |
CVE-2026-12207 | Medium | 4.3 | 2026-06-15 | A security flaw has been discovered in medkey-org medkey up to fc09b7ba9441ff590b72d428d5380834216b09ed. Impacted is the function actionGetPatientById of the f… |
CVE-2026-12206 | Medium | 6.3 | 2026-06-15 | A vulnerability was identified in Grit42 Grit up to 0.11.0. This issue affects the function Grit::Assays::DataTableEntity of the file modules/assays/backend/ap… |
CVE-2026-12204 | High | 7.3 | 2026-06-15 | A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderClose/OrderSuccess/PayLogOrderClose/GoodsGiveIntegral of the… |
CVE-2026-12203 | Medium | 5.3 | 2026-06-15 | A vulnerability was found in HKUDS AI-Trader up to 74caf996f78dcc0c657df8365c8544678a16e215. This affects an unknown part of the file /api/research/agents.csv… |
CVE-2026-12202 | Low | 2.4 | 2026-06-15 | A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3. Affected by this issue is some unknown functionality of the component Blocks Endpoint. S… |
CVE-2026-12201 | Medium | 5.3 | 2026-06-15 | A flaw has been found in IObit Malware Fighter up to 13.2.0. Affected by this vulnerability is an unknown functionality of the component DLL Handler. This mani… |
CVE-2026-12200 | High | 7.3 | 2026-06-15 | A security vulnerability has been detected in Ritlabs TinyWeb Server up to 1.94 on Win32. This impacts an unknown function in the library libeay32.dll.html of… |
CVE-2026-12198 | High | 7.3 | 2026-06-15 | A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component A… |
CVE-2026-12197 | High | 7.2 | 2026-06-15 | A security flaw has been discovered in Ruijie EG105G-P 2.340. The impacted element is the function nslookup of the file /cgi-bin/luci/api/diagnose of the compo… |
CVE-2026-12193 | High | 7.8 | 2026-06-15 | A vulnerability was identified in VS Revo RevoUninstaller 2.5.x/2.6.x. The affected element is the function IOCtl_Handler in the library RevoDetector.sys of th… |
CVE-2026-12192 | High | 8.8 | 2026-06-15 | A vulnerability was determined in GALAYOU Y4 1.0.0. Impacted is an unknown function of the component Web Server. This manipulation causes buffer overflow. The… |
CVE-2026-12191 | High | 7.8 | 2026-06-14 | A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdrive/modeld/modeld.py of the co… |
CVE-2026-12190 | Medium | 5.3 | 2026-06-14 | A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. This vulnerability affects unknown code of the component ai.mainfunc.genspark. Th… |
CVE-2026-12189 | Medium | 5.3 | 2026-06-14 | A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. This affects an unknown part of the component com.tranzmate. Executing a manipulation… |
CVE-2026-12188 | Medium | 6.3 | 2026-06-14 | A vulnerability was detected in Grit42 Grit up to 0.11.0. Affected by this issue is some unknown functionality of the file modules/core/backend/app/controllers… |
CVE-2026-12187 | High | 8.8 | 2026-06-14 | A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknown functionality of the file /usr/bin/on… |
CVE-2026-12186 | High | 8.8 | 2026-06-14 | A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_country in the library /usr/lib/oui-httpd/rpc/tor of the comp… |
CVE-2026-54413 | High | 8.2 | 2026-06-14 | driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess function in iso14229.c tha… |
CVE-2026-54412 | High | 8.2 | 2026-06-14 | LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response function in src/mqtt… |
CVE-2026-54411 | Medium | 5.9 | 2026-06-14 | Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb… |
CVE-2026-54410 | High | 8.6 | 2026-06-14 | nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated a… |
CVE-2026-11527 | High | 8.6 | 2026-06-14 | Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle. … |
CVE-2026-11526 | Critical | 9.8 | 2026-06-14 | GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle. GD::Image::_make_… |
CVE-2026-54421 | Medium | 6.8 | 2026-06-14 | In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensiti… |
CVE-2026-54420 | High | 8.5 | 2026-06-14 | LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell acces… |
CVE-2026-12176 | Medium | 4.3 | 2026-06-14 | A vulnerability has been found in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The impacted element is an unknown function of… |
CVE-2026-12175 | Medium | 4.7 | 2026-06-13 | A vulnerability was detected in CodeAstro Student Attendance Management System 1.0. Impacted is an unknown function of the file /attendance-php/Admin/createStu… |
CVE-2026-12174 | High | 8.8 | 2026-06-13 | A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greece/rhea of the com… |
CVE-2026-12183 | Critical | 9.8 | 2026-06-13 | Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability (CWE-287) in the sy… |
CVE-2026-6428 | High | 7.6 | 2026-06-13 | SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05… |
CVE-2026-5513 | High | 7.2 | 2026-06-13 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-n… |
CVE-2026-1291 | Medium | 4.3 | 2026-06-13 | The Meow Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the REST API endpoint /wp-json/me… |
CVE-2026-11624 | | 2026-06-13 | The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks… | |
CVE-2026-9629 | Medium | 6.4 | 2026-06-13 | The Canvas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 2.5.2 due to insuffi… |
CVE-2026-3297 | Medium | 6.4 | 2026-06-13 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anchor block in versions… |
CVE-2026-2470 | Medium | 4.3 | 2026-06-13 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including… |
CVE-2026-9134 | Medium | 6.4 | 2026-06-13 | The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attribute_key' shortcode parameter in versions up to, and incl… |
CVE-2026-9109 | High | 7.2 | 2026-06-13 | The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-9062 | Low | 3.4 | 2026-06-13 | The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administra… |
CVE-2026-9061 | Low | 3.5 | 2026-06-13 | The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordP… |
CVE-2026-11769 | High | 8.8 | 2026-06-13 | We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerabi… |
CVE-2026-9848 | High | 7.5 | 2026-06-13 | The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The pl… |
CVE-2026-54231 | Medium | 5.5 | 2026-06-13 | A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log en… |
CVE-2026-54230 | High | 7.0 | 2026-06-13 | A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirectio… |
CVE-2026-54229 | High | 7.0 | 2026-06-13 | A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd… |
CVE-2026-54228 | High | 7.8 | 2026-06-13 | A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-crea… |
CVE-2026-12089 | Medium | 4.9 | 2026-06-13 | The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 3.3.19. T… |
CVE-2026-11443 | Medium | 4.6 | 2026-06-13 | Allegra downloadAttachment Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to execute arbitrary script on… |
CVE-2026-11442 | Medium | 6.5 | 2026-06-13 | Allegra exportReport Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on… |
CVE-2026-6676 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed POSIX tar archive may allow Local Execution of Code or Denial… |
CVE-2026-12068 | High | 7.4 | 2026-06-12 | Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to ob… |
CVE-2026-54398 | | 2026-06-12 | An authorization flaw in MISP’s object add/edit handling allowed an authenticated user with object editing permissions to assign a MISP object, or attributes c… | |
CVE-2026-53868 | High | 7.5 | 2026-06-12 | Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification… |
CVE-2026-53867 | Medium | 4.3 | 2026-06-12 | Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned… |
CVE-2026-53839 | Medium | 6.5 | 2026-06-12 | OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostname… |
CVE-2026-53838 | Critical | 9.8 | 2026-06-12 | OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approval scope decisions. At… |
CVE-2026-53837 | Low | 3.7 | 2026-06-12 | OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers… |
CVE-2026-53836 | High | 8.8 | 2026-06-12 | OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute encoded commands u… |
CVE-2026-53835 | Medium | 4.3 | 2026-06-12 | OpenClaw before 2026.5.6 contains a configuration enforcement bypass vulnerability in Feishu dynamic-agent bindings that allows authenticated senders to create… |
CVE-2026-53834 | High | 7.5 | 2026-06-12 | OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated senders to skip allowFr… |
CVE-2026-53833 | High | 7.7 | 2026-06-12 | OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configurati… |
CVE-2026-53832 | High | 7.7 | 2026-06-12 | OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge trusted-proxy identity headers. Attack… |
CVE-2026-53831 | High | 8.3 | 2026-06-12 | OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command… |
CVE-2026-53830 | Medium | 6.5 | 2026-06-12 | OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and Zalo webhook secrets to remain active a… |
CVE-2026-53829 | High | 8.0 | 2026-06-12 | OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers… |
CVE-2026-53828 | High | 8.8 | 2026-06-12 | OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authenticated senders to execute owner-only comm… |
CVE-2026-53827 | Medium | 6.5 | 2026-06-12 | OpenClaw before 2026.5.2 contains a credential exposure vulnerability in message.action forwarding that allows model-controlled metadata to forward action payl… |
CVE-2026-53826 | Medium | 4.3 | 2026-06-12 | OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes the real workspace path to child prompts… |
CVE-2026-53825 | Medium | 6.5 | 2026-06-12 | OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with opera… |
CVE-2026-53824 | Medium | 6.5 | 2026-06-12 | OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor re… |
CVE-2026-53823 | High | 8.1 | 2026-06-12 | OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack… |
CVE-2026-53822 | High | 8.8 | 2026-06-12 | OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution. Attackers can rebuil… |
CVE-2026-53821 | High | 8.8 | 2026-06-12 | OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline… |
CVE-2026-53820 | Medium | 6.6 | 2026-06-12 | OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path that allows authenticated callers to byp… |
CVE-2026-53609 | Critical | 9.1 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths witho… |
CVE-2026-53608 | High | 8.7 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google An… |
CVE-2026-53523 | Medium | 6.8 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL… |
CVE-2026-53522 | Medium | 6.5 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the Nezha dashboard… |
CVE-2026-53521 | Medium | 6.4 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/{id}… |
CVE-2026-53520 | Medium | 6.5 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, authenticated user… |
CVE-2026-53519 | Critical | 9.1 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's… |
CVE-2026-49397 | Medium | 5.3 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to before version 2.0.14, private services (… |
CVE-2026-49396 | High | 7.1 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET req… |