2026 CVEs (page 436)
Page 436 of 681 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48610 | High | 8.1 | 2026-06-12 | Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability found in certain devices… |
CVE-2026-47370 | Critical | 9.9 | 2026-06-12 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi… |
CVE-2026-47369 | Critical | 9.9 | 2026-06-12 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi… |
CVE-2026-47368 | High | 8.6 | 2026-06-12 | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtain data from such Un… |
CVE-2026-47367 | Critical | 9.9 | 2026-06-12 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execu… |
CVE-2026-47366 | High | 7.2 | 2026-06-12 | Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to… |
CVE-2026-47365 | Critical | 9.9 | 2026-06-12 | Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authoriza… |
CVE-2026-20746 | | 2026-06-12 | Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login histo… | |
CVE-2026-9125 | Medium | 6.4 | 2026-06-12 | The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_overlay] shortcode in ve… |
CVE-2026-45170 | High | 8.8 | 2026-06-12 | Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be… |
CVE-2026-11933 | High | 8.8 | 2026-06-12 | A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated u… |
CVE-2026-49482 | Medium | 4.3 | 2026-06-12 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard charac… |
CVE-2026-47238 | Medium | 6.5 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal authenticated user can edit another user's video subtitles beca… |
CVE-2026-45418 | High | 8.8 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authenticated user who can upload videos can add multiple subtitles… |
CVE-2026-45060 | Critical | 9.8 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injec… |
CVE-2026-42846 | Critical | 9.8 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a… |
CVE-2026-6250 | High | 8.1 | 2026-06-11 | An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input. Externally control… |
CVE-2026-49060 | Critical | 9.8 | 2026-06-11 | Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This issue affects Hippoo Mobile App for WooCom… |
CVE-2026-45174 | High | 7.8 | 2026-06-11 | Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5 allow a local attacker to potentially compromise the agent daemon initialization. CyberArk… |
CVE-2026-45173 | Medium | 6.5 | 2026-06-11 | Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw within its internal web-page ver… |
CVE-2026-45172 | High | 8.8 | 2026-06-11 | Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, l… |
CVE-2026-45171 | High | 8.8 | 2026-06-11 | Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14.6.3, 14.2.5… |
CVE-2026-44890 | High | 7.5 | 2026-06-11 | Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final… |
CVE-2026-44250 | High | 7.5 | 2026-06-11 | Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final… |
CVE-2026-44249 | High | 8.1 | 2026-06-11 | Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an… |
CVE-2026-42653 | High | 7.1 | 2026-06-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.Mihai SliceWP allows Stored XSS. This issue affects… |
CVE-2026-42647 | Critical | 9.3 | 2026-06-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection. This issue… |
CVE-2026-39494 | Critical | 9.3 | 2026-06-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Inject… |
CVE-2026-12035 | High | 8.8 | 2026-06-11 | Use after free in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2026-12034 | High | 8.3 | 2026-06-11 | Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 149.0.7827.115 allowed a remote attacker who had comprom… |
CVE-2026-12033 | Medium | 5.3 | 2026-06-11 | Out of bounds read in VideoCapture in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the GPU process to obtain potentially… |
CVE-2026-12032 | Low | 3.1 | 2026-06-11 | Inappropriate implementation in Passwords in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer proces… |
CVE-2026-12031 | High | 8.3 | 2026-06-11 | Inappropriate implementation in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-12030 | High | 8.3 | 2026-06-11 | Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentiall… |
CVE-2026-12029 | High | 8.3 | 2026-06-11 | Use after free in Video in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially p… |
CVE-2026-12028 | High | 8.3 | 2026-06-11 | Use after free in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially per… |
CVE-2026-12027 | Critical | 9.6 | 2026-06-11 | Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potenti… |
CVE-2026-12026 | Medium | 6.5 | 2026-06-11 | Out of bounds read in Video in Google Chrome on ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to obtain p… |
CVE-2026-12025 | Medium | 5.3 | 2026-06-11 | Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-12024 | Medium | 6.5 | 2026-06-11 | Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker to bypass same origin policy via a crafted HTML… |
CVE-2026-12023 | High | 8.3 | 2026-06-11 | Use after free in GPU in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-12022 | High | 8.3 | 2026-06-11 | Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-12020 | High | 8.8 | 2026-06-11 | Use after free in Autofill in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2026-12019 | High | 8.3 | 2026-06-11 | Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer proces… |
CVE-2026-12018 | High | 8.8 | 2026-06-11 | Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local attacker to perform OS-level privilege escalation via… |
CVE-2026-12017 | Low | 3.1 | 2026-06-11 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to bypas… |
CVE-2026-12016 | High | 8.3 | 2026-06-11 | Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potenti… |
CVE-2026-12015 | Medium | 5.3 | 2026-06-11 | Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to obtain potentially se… |
CVE-2026-12014 | High | 8.3 | 2026-06-11 | Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local network segment to potentially perform a sandbox escape via ma… |
CVE-2026-12012 | High | 8.1 | 2026-06-11 | Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileged network position to potentially exploit heap corruption… |
CVE-2026-12011 | High | 8.3 | 2026-06-11 | Use after free in WebMIDI in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-12010 | High | 8.3 | 2026-06-11 | Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2026-12009 | High | 8.3 | 2026-06-11 | Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the r… |
CVE-2026-12008 | High | 8.3 | 2026-06-11 | Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-12007 | High | 8.8 | 2026-06-11 | Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromi… |
CVE-2026-53819 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew execut… |
CVE-2026-53818 | Medium | 6.6 | 2026-06-11 | OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to skip owner-only tool poli… |
CVE-2026-53817 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality inform… |
CVE-2026-53816 | High | 7.2 | 2026-06-11 | OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle… |
CVE-2026-53815 | Medium | 6.5 | 2026-06-11 | OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can r… |
CVE-2026-53814 | High | 8.3 | 2026-06-11 | OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent runs incorrectly receive owner-scoped MCP loopback authority… |
CVE-2026-53813 | High | 7.8 | 2026-06-11 | OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state influences local package root resolutio… |
CVE-2026-53812 | High | 7.7 | 2026-06-11 | OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network nav… |
CVE-2026-53811 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.7 contains a privilege escalation vulnerability in the Matrix allowFrom feature that allows authenticated accounts to match policy entri… |
CVE-2026-53810 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading toward unscanned package pa… |
CVE-2026-53809 | Low | 3.8 | 2026-06-11 | OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against alias… |
CVE-2026-53808 | Medium | 6.5 | 2026-06-11 | OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows agent tool calls to set apply: true desp… |
CVE-2026-53807 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allo… |
CVE-2026-53806 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX shell flags to bypass exec revalidation checks. Attackers ca… |
CVE-2026-50245 | High | 7.7 | 2026-06-11 | Brickcom cameras allow unauthenticated access to live snapshot images via the /ONVIF endpoint and no authentication is required to retrieve still images from t… |
CVE-2026-50005 | High | 7.7 | 2026-06-11 | Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to silently access camera feeds. |
CVE-2026-41005 | Critical | 9.0 | 2026-06-11 | Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (a… |
CVE-2026-53782 | High | 7.4 | 2026-06-11 | Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch t… |
CVE-2026-53781 | Medium | 4.3 | 2026-06-11 | Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhaustion by serving media responses that bypa… |
CVE-2026-49973 | Critical | 9.4 | 2026-06-11 | Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by… |
CVE-2026-49949 | Medium | 5.3 | 2026-06-11 | CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercept sensitive credentials by issuing cros… |
CVE-2026-46622 | High | 8.1 | 2026-06-11 | SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strin… |
CVE-2026-46489 | High | 8.1 | 2026-06-11 | SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any file type without validation. An authen… |
CVE-2026-45802 | | 2026-06-11 | FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. Prior to version 2.6.7, an a… | |
CVE-2026-45175 | High | 7.8 | 2026-06-11 | Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within internal agent validation processes. A local attacker coul… |
CVE-2026-53702 | Medium | 6.5 | 2026-06-11 | A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser u… |
CVE-2026-53701 | Medium | 6.5 | 2026-06-11 | An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing… |
CVE-2026-52860 | High | 7.8 | 2026-06-11 | Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions… |
CVE-2026-52859 | High | 8.2 | 2026-06-11 | Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen… |
CVE-2026-52858 | High | 7.8 | 2026-06-11 | Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3… |
CVE-2026-48547 | High | 7.3 | 2026-06-11 | KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell met… |
CVE-2026-47250 | Medium | 6.1 | 2026-06-11 | mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.7.0, the kubectl_generic tool in mcp-server-kube… |
CVE-2026-47189 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the AutoMod remove flow looks up and deletes… | |
CVE-2026-47188 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the latest release suppresses mentions in se… | |
CVE-2026-47181 | | 2026-06-11 | PenguinMod-BackendApi is the backend api for penguinmod. Prior to version 1.0.0, a NoSQL injection vulnerability in the password reset endpoint allows any auth… | |
CVE-2026-47177 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, a user who can configure bot settings can se… | |
CVE-2026-47176 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, a user who can configure bot settings can en… | |
CVE-2026-47175 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, several moderation commands echo user-contro… | |
CVE-2026-47174 | | 2026-06-11 | In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes. The build workflow runs on pull requests… | |
CVE-2026-47173 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a ticket with a rea… | |
CVE-2026-47172 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, the repository has a privileged deploy workf… | |
CVE-2026-47171 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose me… | |
CVE-2026-47170 | High | 7.7 | 2026-06-11 | Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface. Prior to version 1.1, authenticated users c… |
CVE-2026-47169 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a user with Manage Server / ManageGuild, but… | |
CVE-2026-47167 | Medium | 5.3 | 2026-06-11 | Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plu… |