2026 CVEs (page 437)
Page 437 of 444 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-1151 | Low | 2.4 | 2026-01-19 | A weakness has been identified in technical-laohu mpay up to 1.2.4. The affected element is an unknown function of the component User Center. This manipulation… |
CVE-2026-1150 | Medium | 6.3 | 2026-01-19 | A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. Impacted is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-1149 | Medium | 6.3 | 2026-01-19 | A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-1148 | Medium | 4.3 | 2026-01-19 | A vulnerability was determined in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This vulnerability affects unknown code. Exec… |
CVE-2026-1147 | Low | 3.5 | 2026-01-19 | A vulnerability was found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This affects an unknown part of the file /php/api_… |
CVE-2026-1146 | Low | 3.5 | 2026-01-19 | A vulnerability has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this issue is some unknown functi… |
CVE-2026-1145 | Medium | 6.3 | 2026-01-19 | A flaw has been found in quickjs-ng quickjs up to 0.11.0. Affected by this vulnerability is the function js_typed_array_constructor_ta of the file quickjs.c. T… |
CVE-2026-1144 | Medium | 6.3 | 2026-01-19 | A vulnerability was detected in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component Atomics Ops Handler. Th… |
CVE-2026-1143 | High | 8.8 | 2026-01-19 | A weakness has been identified in TOTOLINK A3700R 9.1.2u.5822_B20200513. This affects the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. Execut… |
CVE-2026-1142 | Medium | 4.3 | 2026-01-19 | A security flaw has been discovered in PHPGurukul News Portal 1.0. The impacted element is an unknown function. Performing a manipulation results in cross-site… |
CVE-2026-1141 | Medium | 6.3 | 2026-01-19 | A vulnerability was identified in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /admin/add-subadmins.php of the component… |
CVE-2026-1140 | High | 8.8 | 2026-01-19 | A vulnerability was found in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/ConfigExceptAli. The manipulation results in… |
CVE-2026-1139 | High | 8.8 | 2026-01-19 | A vulnerability has been found in UTT 进取 520W 1.7.7-180627. This vulnerability affects the function strcpy of the file /goform/ConfigExceptMSN. The manipulatio… |
CVE-2026-1138 | High | 8.8 | 2026-01-19 | A flaw has been found in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/ConfigExceptQQ. Executing a manipulation can lead to bu… |
CVE-2026-1137 | High | 8.8 | 2026-01-19 | A vulnerability was detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formWebAuthGlobalConfig. Performing… |
CVE-2026-1136 | Low | 3.5 | 2026-01-19 | A weakness has been identified in lcg0124 BootDo up to e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb. Affected is the function Save of the file /blog/bContent/save… |
CVE-2026-1135 | Medium | 4.3 | 2026-01-19 | A security flaw has been discovered in itsourcecode Society Management System 1.0. This impacts an unknown function of the file /admin/activity.php. The manipu… |
CVE-2026-1134 | Medium | 4.3 | 2026-01-19 | A vulnerability was identified in itsourcecode Society Management System 1.0. This affects an unknown function of the file /admin/expenses.php. The manipulatio… |
CVE-2026-0943 | High | 7.5 | 2026-01-19 | HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability. Versions before 0.032 contain HarfB… |
CVE-2026-1133 | High | 7.3 | 2026-01-19 | A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /kmf/folder.jsp of the component HTTP GET Parameter… |
CVE-2026-1132 | High | 7.3 | 2026-01-19 | A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /kmf/edit_folder.jsp of the component HTTP GET Parameter… |
CVE-2026-1131 | High | 7.3 | 2026-01-19 | A vulnerability has been found in Yonyou KSOA 9.0. Impacted is an unknown function of the file /kmc/save_catalog.jsp of the component HTTP GET Parameter Handle… |
CVE-2026-1130 | High | 7.3 | 2026-01-19 | A flaw has been found in Yonyou KSOA 9.0. This issue affects some unknown processing of the file /worksheet/worksadd_plan.jsp of the component HTTP GET Paramet… |
CVE-2026-1129 | High | 7.3 | 2026-01-19 | A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/worksadd.jsp of the component HTTP GET Paramete… |
CVE-2026-23829 | Medium | 5.3 | 2026-01-19 | Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficien… |
CVE-2026-23733 | Medium | 6.4 | 2026-01-18 | LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifac… |
CVE-2026-23644 | High | 7.5 | 2026-01-18 | esm.sh is a no-build content delivery network (CDN) for web development. Prior to Go pseeudoversion 0.0.0-20260116051925-c62ab83c589e, the software has a path… |
CVE-2026-23626 | Medium | 6.8 | 2026-01-18 | Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive… |
CVE-2026-23525 | Medium | 6.4 | 2026-01-18 | 1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting (XSS) vulnerability exists in the 1Panel App Store… |
CVE-2026-1126 | Medium | 6.3 | 2026-01-18 | A security vulnerability has been detected in lwj flow up to a3d2fe8133db9d3b50fda4f66f68634640344641. This affects the function uploadFile of the file \flow-m… |
CVE-2026-1125 | High | 7.3 | 2026-01-18 | A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_wifidog_settings. Executing… |
CVE-2026-1124 | High | 7.3 | 2026-01-18 | A security flaw has been discovered in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_report.jsp of th… |
CVE-2026-0863 | High | 8.5 | 2026-01-18 | Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python co… |
CVE-2026-1123 | High | 7.3 | 2026-01-18 | A vulnerability was identified in Yonyou KSOA 9.0. Affected is an unknown function of the file /worksheet/work_mod.jsp of the component HTTP GET Parameter Hand… |
CVE-2026-1122 | High | 7.3 | 2026-01-18 | A vulnerability was determined in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/work_info.jsp of the component HTTP GET Parameter Ha… |
CVE-2026-1121 | High | 7.3 | 2026-01-18 | A vulnerability was found in Yonyou KSOA 9.0. This affects an unknown function of the file /worksheet/del_workplan.jsp of the component HTTP GET Parameter Hand… |
CVE-2026-1120 | High | 7.3 | 2026-01-18 | A vulnerability has been found in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_work.jsp of the component HTTP GET Pa… |
CVE-2026-1119 | High | 7.3 | 2026-01-18 | A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/delete_activity.php. Execut… |
CVE-2026-1118 | Medium | 6.3 | 2026-01-18 | A vulnerability was detected in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/add_activity.php. Performing a m… |
CVE-2026-1112 | Medium | 5.4 | 2026-01-18 | A vulnerability was found in Sanluan PublicCMS up to 5.202506.d. Affected is the function delete of the file publiccms-trade/src/main/java/com/publiccms/contro… |
CVE-2026-1111 | Medium | 4.7 | 2026-01-18 | A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplat… |
CVE-2026-1110 | Medium | 5.3 | 2026-01-18 | A flaw has been found in cijliu librtsp up to 2ec1a81ad65280568a0c7c16420d7c10fde13b04. This affects the function rtsp_parse_method. This manipulation causes b… |
CVE-2026-1109 | Medium | 5.3 | 2026-01-18 | A vulnerability was detected in cijliu librtsp up to 2ec1a81ad65280568a0c7c16420d7c10fde13b04. The impacted element is the function rtsp_parse_request. The man… |
CVE-2026-1108 | Medium | 5.3 | 2026-01-18 | A security vulnerability has been detected in cijliu librtsp up to 2ec1a81ad65280568a0c7c16420d7c10fde13b04. The affected element is the function rtsp_rely_dum… |
CVE-2026-1107 | Medium | 6.3 | 2026-01-18 | A weakness has been identified in EyouCMS up to 1.7.1/5.0. Impacted is the function check_userinfo of the file Diyajax.php of the component Member Avatar Handl… |
CVE-2026-1106 | Medium | 5.4 | 2026-01-18 | A security flaw has been discovered in Chamilo LMS up to 2.0.0 Beta 1. This issue affects the function deleteLegal of the file src/CoreBundle/Controller/Social… |
CVE-2026-1105 | High | 7.3 | 2026-01-18 | A vulnerability was identified in EasyCMS up to 1.6. This vulnerability affects unknown code of the file /UserAction.class.php. Such manipulation of the argume… |
CVE-2026-1066 | Medium | 6.3 | 2026-01-17 | A vulnerability was detected in kalcaddle kodbox up to 1.61.10. This issue affects some unknown processing of the file /?explorer/index/zip of the component Co… |
CVE-2026-1064 | Medium | 4.7 | 2026-01-17 | A vulnerability was found in bastillion-io Bastillion up to 4.0.1. This issue affects some unknown processing of the file src/main/java/io/bastillion/manage/co… |
CVE-2026-1063 | Medium | 4.7 | 2026-01-17 | A vulnerability has been found in bastillion-io Bastillion up to 4.0.1. This vulnerability affects unknown code of the file src/main/java/io/bastillion/manage/… |
CVE-2026-1062 | Medium | 6.3 | 2026-01-17 | A flaw has been found in xiweicheng TMS up to 2.28.0. This affects the function Summary of the file src/main/java/com/lhjz/portal/util/HtmlUtil.java. This mani… |
CVE-2026-1061 | Medium | 6.3 | 2026-01-17 | A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhjz/portal/controller… |
CVE-2026-1059 | High | 7.3 | 2026-01-17 | A security vulnerability has been detected in FeMiner wms up to 9cad1f1b179a98b9547fd003c23b07c7594775fa. Affected by this vulnerability is an unknown function… |
CVE-2026-1050 | High | 7.3 | 2026-01-17 | A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7. This affects an unknown function of the file source-code/src/main/java/net/risesoft/ut… |
CVE-2026-1049 | Low | 3.5 | 2026-01-17 | A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulati… |
CVE-2026-1048 | Low | 3.5 | 2026-01-17 | A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketZoom. This manipulatio… |
CVE-2026-0725 | Medium | 4.4 | 2026-01-17 | The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1… |
CVE-2026-0833 | Medium | 6.4 | 2026-01-17 | The Team Section Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block in all versions up to, and including, 2.0.0 due… |
CVE-2026-0808 | Medium | 5.3 | 2026-01-17 | The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trus… |
CVE-2026-0691 | Medium | 4.4 | 2026-01-17 | The CM E-Mail Blacklist – Simple email filtering for safer registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'black_email'… |
CVE-2026-0820 | Medium | 4.3 | 2026-01-17 | The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing capabili… |
CVE-2026-0682 | Low | 2.2 | 2026-01-17 | The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.28 due to insufficient validation… |
CVE-2026-0519 | Low | 3.4 | 2026-01-17 | In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain configurations. Any party… |
CVE-2026-0518 | Medium | 4.8 | 2026-01-17 | CVE-2026-0518 is a cross-site scripting vulnerability in versions of Secure Access prior to 14.20. An attacker with administrative privileges can interfere w… |
CVE-2026-0517 | High | 7.5 | 2026-01-17 | CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure Access Server prior to 14.20. An attacker can send a specially crafted packet to a s… |
CVE-2026-22865 | High | 7.4 | 2026-01-16 | Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, s… |
CVE-2026-22816 | High | 7.4 | 2026-01-16 | Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, s… |
CVE-2026-23745 | Medium | 6.1 | 2026-01-16 | node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is… |
CVE-2026-21223 | High | 7.1 | 2026-01-16 | Improper privilege management in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally. |
CVE-2026-20960 | High | 8.0 | 2026-01-16 | Improper authorization in Microsoft Power Apps allows an authorized attacker to execute code over a network. |
CVE-2026-23800 | Critical | 10.0 | 2026-01-16 | Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from 2.5.2 before 2.6.0. |
CVE-2026-23643 | Medium | 5.4 | 2026-01-16 | CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string paramete… |
CVE-2026-23744 | Critical | 9.8 | 2026-01-16 | MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerabilit… |
CVE-2026-23742 | High | 8.8 | 2026-01-16 | Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem… |
CVE-2026-23735 | | 2026-01-16 | GraphQL Modules is a toolset of libraries and guidelines dedicated to create reusable, maintainable, testable and extendable modules out of your GraphQL server… | |
CVE-2026-23731 | Medium | 4.3 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, The web application is vulnerable to clickjacking attacks. The WeGIA application does not s… |
CVE-2026-23730 | Medium | 6.1 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint o… |
CVE-2026-23729 | Medium | 6.1 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint o… |
CVE-2026-23728 | Medium | 6.1 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint o… |
CVE-2026-23727 | Medium | 6.1 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint o… |
CVE-2026-23726 | Medium | 6.1 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, An Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint o… |
CVE-2026-23725 | Medium | 5.4 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the html/pet/adotantes/… |
CVE-2026-23724 | Medium | 4.3 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the html/atendido/cadas… |
CVE-2026-23723 | High | 7.2 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaContr… |
CVE-2026-23722 | Critical | 9.1 | 2026-01-16 | WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the WeGIA system, sp… |
CVE-2026-23645 | Medium | 6.1 | 2026-01-16 | SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerability exists in SiY… |
CVE-2026-23634 | Unrated | | 2026-01-16 | Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not explicitly force or enforce least-privile… |
CVE-2026-23535 | High | 8.0 | 2026-01-16 | wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instru… |
CVE-2026-23490 | High | 7.5 | 2026-01-16 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-… |
CVE-2026-0629 | | 2026-01-16 | Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the… | |
CVE-2026-23529 | High | 7.7 | 2026-01-16 | Kafka Connect BigQuery Connector is an implementation of a sink connector from Apache Kafka to Google BigQuery. Prior to 2.11.0, there is an arbitrary file rea… |
CVE-2026-23528 | Medium | 6.1 | 2026-01-16 | Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, and Dask distributed are all run together… |
CVE-2026-23523 | Critical | 9.6 | 2026-01-16 | Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink can install an attac… |
CVE-2026-22782 | High | 7.5 | 2026-01-16 | RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared… |
CVE-2026-0949 | Medium | 6.5 | 2026-01-16 | PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage Charts menu to inject… |
CVE-2026-21625 | High | 8.8 | 2026-01-16 | User provided uploads to the Easy Discuss component for Joomla aren't properly validated. Uploads are purely checked by file extensions, no mime type checks ar… |
CVE-2026-21624 | Medium | 5.4 | 2026-01-16 | Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla. |
CVE-2026-21623 | Medium | 5.4 | 2026-01-16 | Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla. |
CVE-2026-0696 | Medium | 6.5 | 2026-01-16 | In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-sid… |
CVE-2026-0695 | High | 8.7 | 2026-01-16 | In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certai… |