2026 CVEs (page 434)
Page 434 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22481 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Rasedul Haque Rumi BD Courier Order Ratio Checker bd-courier-order-ratio-checker allows Exploiting Incorrectly Configure… |
CVE-2026-22472 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-22470 | High | 7.6 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FireStorm Plugins FireStorm Professional Real Estate fs-r… |
CVE-2026-22469 | Medium | 5.3 | 2026-01-22 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in mwtemplates DeepDigital deepdigital allows Code Injection.This i… |
CVE-2026-22468 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in AbsolutePlugins Absolute Addons For Elementor absolute-addons allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2026-22466 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Chandni Patel WP MapIt wp-mapit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2026-22464 | High | 7.5 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wphocus My auctions allegro my-auction… |
CVE-2026-22463 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Micro.company Form to Chat App form-to-chat allows Stored… |
CVE-2026-22462 | Medium | 4.3 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in richardevcom Add Polylang support for Customizer add-polylang-support-for-customizer allows Cross Site Reque… |
CVE-2026-22461 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in WebAppick CTX Feed webappick-product-feed-for-woocommerce allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-22458 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Mikado-Themes Wanderland wanderland allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-22450 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in Select-Themes Don Peppe donpeppe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2026-22447 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in Select-Themes Prowess prowess allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-22445 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in Proptech Plugin Apimo Connector apimo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-22430 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Verdure verdure allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-22426 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Elated-Themes Sweet Jane sweetjane allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2026-22411 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Dolcino dolcino allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-22409 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Justicia justicia allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2026-22407 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Roam roam allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-22406 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-22404 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Innovio innovio allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-22402 | High | 7.5 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pavothemes Triply triply allows PHP Lo… |
CVE-2026-22401 | High | 7.5 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pavothemes Freshio freshio allows PHP… |
CVE-2026-22400 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Holmes holmes allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-22398 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fleur fleur allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-22396 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2026-22393 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Curly curly allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-22391 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Cocco cocco allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-22388 | Medium | 5.9 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Owl Carousel WP owl-carousel-wp allows Stored X… |
CVE-2026-22382 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Cross Site Request Forg… |
CVE-2026-22360 | Medium | 4.3 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in AA-Team SearchAzon searchazon allows Cross Site Request Forgery.This issue affects SearchAzon: from n/a thro… |
CVE-2026-22359 | Medium | 4.3 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in AA-Team Wordpress Movies Bulk Importer movies importer allows Cross Site Request Forgery.This issue affects… |
CVE-2026-22358 | Medium | 5.4 | 2026-01-22 | Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Electrician - Electrical Service WordPress electrician allows Server Side Request Forgery.Thi… |
CVE-2026-22355 | High | 7.1 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in gregmolnar Simple XML Sitemap simple-xml-sitemap allows Stored XSS.This issue affects Simple XML Sitemap: fr… |
CVE-2026-22353 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in winkm89 teachPress teachpress allows Stored XSS.This issu… |
CVE-2026-22349 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in linux4me2 Menu In Post menu-in-post allows DOM-Based XSS… |
CVE-2026-22348 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in Tasos Fel Civic Cookie Control civic-cookie-control-8 allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-22347 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in subhansanjaya Carousel Horizontal Posts Content Slider ca… |
CVE-2026-22278 | High | 8.1 | 2026-01-22 | Dell PowerScale OneFS versions prior to 9.13.0.0 contains an improper restriction of excessive authentication attempts vulnerability. An unauthenticated attack… |
CVE-2026-1260 | High | 7.8 | 2026-01-22 | Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure. |
CVE-2026-0535 | High | 8.1 | 2026-01-22 | A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in… |
CVE-2026-0534 | High | 8.1 | 2026-01-22 | A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Au… |
CVE-2026-0533 | High | 8.1 | 2026-01-22 | A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-sit… |
CVE-2026-24009 | High | 8.1 | 2026-01-22 | Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related R… |
CVE-2026-23760 | Critical | 9.8 | 2026-01-22 | SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoi… |
CVE-2026-1329 | High | 8.8 | 2026-01-22 | A flaw has been found in Tenda AX1803 1.0.0.1. The affected element is the function fromGetWifiGuestBasic of the file /goform/WifiGuestSet. Executing a manipul… |
CVE-2026-1328 | High | 8.8 | 2026-01-22 | A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. Impacted is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component… |
CVE-2026-1327 | Medium | 6.3 | 2026-01-22 | A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file /cgi-bin/cst… |
CVE-2026-1326 | Medium | 6.3 | 2026-01-22 | A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. This vulnerability affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-1325 | Medium | 5.3 | 2026-01-22 | A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function edit_pwd_mall of th… |
CVE-2026-1324 | High | 8.8 | 2026-01-22 | A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.12. Affected by this issue is the function SessionController of… |
CVE-2026-1102 | Medium | 5.3 | 2026-01-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allow… |
CVE-2026-0723 | High | 7.4 | 2026-01-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allow… |
CVE-2026-1332 | Medium | 5.3 | 2026-01-22 | MeetingHub developed by HAMASTAR Technology has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific API functi… |
CVE-2026-1225 | | 2026-01-22 | ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to insta… | |
CVE-2026-1331 | Critical | 9.8 | 2026-01-22 | MeetingHub developed by HAMASTAR Technology has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web she… |
CVE-2026-1330 | High | 7.5 | 2026-01-22 | MeetingHub developed by HAMASTAR Technology has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traver… |
CVE-2026-24332 | Medium | 4.3 | 2026-01-22 | Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a W… |
CVE-2026-0920 | Critical | 9.8 | 2026-01-22 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This… |
CVE-2026-24049 | High | 7.1 | 2026-01-22 | wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable t… |
CVE-2026-24055 | Medium | 5.3 | 2026-01-22 | Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAu… |
CVE-2026-24042 | Critical | 9.4 | 2026-01-22 | Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users… |
CVE-2026-24039 | Medium | 4.3 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). Version 1.4.0 has Improper Access Control, allowing low-privileged employees to self… |
CVE-2026-24038 | High | 8.1 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be byp… |
CVE-2026-24037 | Medium | 4.8 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the has_xss() function attempts to block XSS by matching input aga… |
CVE-2026-24036 | Medium | 5.3 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/re… |
CVE-2026-24035 | Medium | 4.3 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exists in Horilla HR Software starting in v… |
CVE-2026-24034 | Medium | 5.4 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). In versions prior to 1.5.0, a cross-site scripting vulnerability can be triggered be… |
CVE-2026-24010 | High | 8.0 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload vulnerability in versions prior to 1.5.0, with Social Enginee… |
CVE-2026-24006 | High | 7.5 | 2026-01-22 | Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of ob… |
CVE-2026-24002 | Critical | 9.0 | 2026-01-22 | Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the u… |
CVE-2026-24001 | High | 7.5 | 2026-01-22 | jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers c… |
CVE-2026-23992 | Medium | 5.9 | 2026-01-22 | go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repositor… |
CVE-2026-23991 | Medium | 5.9 | 2026-01-22 | go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors… |
CVE-2026-23967 | High | 7.5 | 2026-01-22 | sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature malleability vulnerability exists in the S… |
CVE-2026-23966 | Critical | 9.1 | 2026-01-22 | sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2… |
CVE-2026-23965 | High | 7.5 | 2026-01-22 | sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature forgery vulnerability exists in the SM2 si… |
CVE-2026-23964 | Medium | 6.5 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, an insecure direct object reference in… |
CVE-2026-23963 | Medium | 4.3 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum… |
CVE-2026-23962 | High | 7.5 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not have a limit on the ma… |
CVE-2026-23959 | Medium | 4.9 | 2026-01-22 | CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions prior to 4.1.9 in the `CustomerTransfo… |
CVE-2026-23961 | Medium | 5.3 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactio… |
CVE-2026-23958 | Critical | 9.8 | 2026-01-22 | Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing sec… |
CVE-2026-23957 | High | 7.5 | 2026-01-22 | seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded… |
CVE-2026-23956 | High | 7.5 | 2026-01-22 | seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegE… |
CVE-2026-23699 | High | 7.2 | 2026-01-22 | AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary… |
CVE-2026-23952 | Medium | 6.5 | 2026-01-22 | ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulne… |
CVE-2026-23951 | Medium | 5.5 | 2026-01-22 | SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exactly 2 records, cau… |
CVE-2026-23946 | Medium | 6.8 | 2026-01-22 | Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical d… |
CVE-2026-23893 | Medium | 6.8 | 2026-01-22 | openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileg… |
CVE-2026-23887 | Medium | 5.4 | 2026-01-22 | Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application s… |
CVE-2026-23873 | Critical | 9.0 | 2026-01-22 | hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Inject… |
CVE-2026-1036 | Medium | 5.3 | 2026-01-22 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability… |
CVE-2026-24048 | Low | 3.5 | 2026-01-21 | Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Ba… |
CVE-2026-24047 | Medium | 6.3 | 2026-01-21 | Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command… |
CVE-2026-24046 | High | 7.1 | 2026-01-21 | Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based pa… |
CVE-2026-23996 | Low | 3.7 | 2026-01-21 | FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verify_key(). The… |
CVE-2026-23990 | Medium | 5.3 | 2026-01-21 | The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0… |
CVE-2026-23986 | High | 7.1 | 2026-01-21 | Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe temp… |
CVE-2026-23968 | Medium | 5.5 | 2026-01-21 | Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe temp… |