2026 CVEs (page 438)
Page 438 of 446 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-23732 | High | 7.5 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validate… |
CVE-2026-23721 | Medium | 4.3 | 2026-01-19 | OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visibl… |
CVE-2026-23646 | Medium | 6.5 | 2026-01-19 | OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end… |
CVE-2026-23625 | High | 8.7 | 2026-01-19 | OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerabilit… |
CVE-2026-23534 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands dec… |
CVE-2026-23533 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec de… |
CVE-2026-22797 | Critical | 9.9 | 2026-01-19 | An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. T… |
CVE-2026-1170 | Medium | 5.3 | 2026-01-19 | A vulnerability was detected in birkir prime up to 0.4.0.beta.0. This issue affects some unknown processing of the file /graphql of the component GraphQL API… |
CVE-2026-1169 | Medium | 4.3 | 2026-01-19 | A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code. Such manipulation leads to cross-site r… |
CVE-2026-23532 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `g… |
CVE-2026-23531 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls… |
CVE-2026-23530 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrc… |
CVE-2026-23522 | Low | 3.7 | 2026-01-19 | LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, `knowledgeBase.removeFilesFromKnowledgeBase` tRPC ep allows authenticate… |
CVE-2026-22850 | High | 8.3 | 2026-01-19 | Koko Analytics is an open-source analytics plugin for WordPress. Versions prior to 2.1.3 are vulnerable to arbitrary SQL execution through unescaped analytics… |
CVE-2026-22037 | High | 8.4 | 2026-01-19 | The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middle… |
CVE-2026-1162 | Critical | 9.8 | 2026-01-19 | A flaw has been found in UTT HiPER 810 1.7.4-141218. The impacted element is the function strcpy of the file /goform/setSysAdm. This manipulation of the argume… |
CVE-2026-22031 | High | 8.4 | 2026-01-19 | @fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 wh… |
CVE-2026-1161 | Low | 3.5 | 2026-01-19 | A vulnerability was detected in pbrong hrms 1.0.1. The affected element is the function UpdateRecruitmentById of the file /handler/recruitment.go. The manipula… |
CVE-2026-1160 | High | 7.3 | 2026-01-19 | A security vulnerability has been detected in PHPGurukul Directory Management System 1.0. Impacted is an unknown function of the file /index.php of the compone… |
CVE-2026-21618 | Medium | 6.1 | 2026-01-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthoriz… |
CVE-2026-1159 | High | 7.3 | 2026-01-19 | A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This issue affects some unknown processing of the file /order_online.ph… |
CVE-2026-1158 | High | 8.8 | 2026-01-19 | A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWizardCfg of the file /cgi-bin/cstecgi… |
CVE-2026-1007 | High | 7.6 | 2026-01-19 | Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: fr… |
CVE-2026-0610 | Critical | 9.8 | 2026-01-19 | SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12 |
CVE-2026-1157 | High | 8.8 | 2026-01-19 | A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This affects the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi. Such manipul… |
CVE-2026-1156 | High | 8.8 | 2026-01-19 | A vulnerability was determined in Totolink LR350 9.3.5u.6369_B20220309. Affected by this issue is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-1181 | Critical | 9.0 | 2026-01-19 | Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin req… |
CVE-2026-1155 | High | 8.8 | 2026-01-19 | A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. Affected by this vulnerability is the function setWiFiEasyGuestCfg of the file /cgi-bin/cste… |
CVE-2026-1154 | Medium | 4.3 | 2026-01-19 | A flaw has been found in SourceCodester E-Learning System 1.0. This impacts an unknown function of the file /admin/modules/lesson/index.php of the component Le… |
CVE-2026-1153 | Medium | 4.3 | 2026-01-19 | A vulnerability was detected in technical-laohu mpay up to 1.2.4. This affects an unknown function. Performing a manipulation results in cross-site request for… |
CVE-2026-1152 | Medium | 4.7 | 2026-01-19 | A security vulnerability has been detected in technical-laohu mpay up to 1.2.4. The impacted element is an unknown function of the component QR Code Image Hand… |
CVE-2026-1151 | Low | 2.4 | 2026-01-19 | A weakness has been identified in technical-laohu mpay up to 1.2.4. The affected element is an unknown function of the component User Center. This manipulation… |
CVE-2026-1150 | Medium | 6.3 | 2026-01-19 | A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. Impacted is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-1149 | Medium | 6.3 | 2026-01-19 | A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-1148 | Medium | 4.3 | 2026-01-19 | A vulnerability was determined in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This vulnerability affects unknown code. Exec… |
CVE-2026-1147 | Low | 3.5 | 2026-01-19 | A vulnerability was found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This affects an unknown part of the file /php/api_… |
CVE-2026-1146 | Low | 3.5 | 2026-01-19 | A vulnerability has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this issue is some unknown functi… |
CVE-2026-1145 | Medium | 6.3 | 2026-01-19 | A flaw has been found in quickjs-ng quickjs up to 0.11.0. Affected by this vulnerability is the function js_typed_array_constructor_ta of the file quickjs.c. T… |
CVE-2026-1144 | Medium | 6.3 | 2026-01-19 | A vulnerability was detected in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component Atomics Ops Handler. Th… |
CVE-2026-1143 | High | 8.8 | 2026-01-19 | A weakness has been identified in TOTOLINK A3700R 9.1.2u.5822_B20200513. This affects the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. Execut… |
CVE-2026-1142 | Medium | 4.3 | 2026-01-19 | A security flaw has been discovered in PHPGurukul News Portal 1.0. The impacted element is an unknown function. Performing a manipulation results in cross-site… |
CVE-2026-1141 | Medium | 6.3 | 2026-01-19 | A vulnerability was identified in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /admin/add-subadmins.php of the component… |
CVE-2026-1140 | High | 8.8 | 2026-01-19 | A vulnerability was found in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/ConfigExceptAli. The manipulation results in… |
CVE-2026-1139 | High | 8.8 | 2026-01-19 | A vulnerability has been found in UTT 进取 520W 1.7.7-180627. This vulnerability affects the function strcpy of the file /goform/ConfigExceptMSN. The manipulatio… |
CVE-2026-1138 | High | 8.8 | 2026-01-19 | A flaw has been found in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/ConfigExceptQQ. Executing a manipulation can lead to bu… |
CVE-2026-1137 | High | 8.8 | 2026-01-19 | A vulnerability was detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formWebAuthGlobalConfig. Performing… |
CVE-2026-1136 | Low | 3.5 | 2026-01-19 | A weakness has been identified in lcg0124 BootDo up to e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb. Affected is the function Save of the file /blog/bContent/save… |
CVE-2026-1135 | Medium | 4.3 | 2026-01-19 | A security flaw has been discovered in itsourcecode Society Management System 1.0. This impacts an unknown function of the file /admin/activity.php. The manipu… |
CVE-2026-1134 | Medium | 4.3 | 2026-01-19 | A vulnerability was identified in itsourcecode Society Management System 1.0. This affects an unknown function of the file /admin/expenses.php. The manipulatio… |
CVE-2026-0943 | High | 7.5 | 2026-01-19 | HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability. Versions before 0.032 contain HarfB… |
CVE-2026-1133 | High | 7.3 | 2026-01-19 | A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /kmf/folder.jsp of the component HTTP GET Parameter… |
CVE-2026-1132 | High | 7.3 | 2026-01-19 | A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /kmf/edit_folder.jsp of the component HTTP GET Parameter… |
CVE-2026-1131 | High | 7.3 | 2026-01-19 | A vulnerability has been found in Yonyou KSOA 9.0. Impacted is an unknown function of the file /kmc/save_catalog.jsp of the component HTTP GET Parameter Handle… |
CVE-2026-1130 | High | 7.3 | 2026-01-19 | A flaw has been found in Yonyou KSOA 9.0. This issue affects some unknown processing of the file /worksheet/worksadd_plan.jsp of the component HTTP GET Paramet… |
CVE-2026-1129 | High | 7.3 | 2026-01-19 | A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/worksadd.jsp of the component HTTP GET Paramete… |
CVE-2026-23829 | Medium | 5.3 | 2026-01-19 | Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficien… |
CVE-2026-23733 | Medium | 6.4 | 2026-01-18 | LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifac… |
CVE-2026-23644 | High | 7.5 | 2026-01-18 | esm.sh is a no-build content delivery network (CDN) for web development. Prior to Go pseeudoversion 0.0.0-20260116051925-c62ab83c589e, the software has a path… |
CVE-2026-23626 | Medium | 6.8 | 2026-01-18 | Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive… |
CVE-2026-23525 | Medium | 6.4 | 2026-01-18 | 1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting (XSS) vulnerability exists in the 1Panel App Store… |
CVE-2026-1126 | Medium | 6.3 | 2026-01-18 | A security vulnerability has been detected in lwj flow up to a3d2fe8133db9d3b50fda4f66f68634640344641. This affects the function uploadFile of the file \flow-m… |
CVE-2026-1125 | High | 7.3 | 2026-01-18 | A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_wifidog_settings. Executing… |
CVE-2026-1124 | High | 7.3 | 2026-01-18 | A security flaw has been discovered in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_report.jsp of th… |
CVE-2026-0863 | High | 8.5 | 2026-01-18 | Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python co… |
CVE-2026-1123 | High | 7.3 | 2026-01-18 | A vulnerability was identified in Yonyou KSOA 9.0. Affected is an unknown function of the file /worksheet/work_mod.jsp of the component HTTP GET Parameter Hand… |
CVE-2026-1122 | High | 7.3 | 2026-01-18 | A vulnerability was determined in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/work_info.jsp of the component HTTP GET Parameter Ha… |
CVE-2026-1121 | High | 7.3 | 2026-01-18 | A vulnerability was found in Yonyou KSOA 9.0. This affects an unknown function of the file /worksheet/del_workplan.jsp of the component HTTP GET Parameter Hand… |
CVE-2026-1120 | High | 7.3 | 2026-01-18 | A vulnerability has been found in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_work.jsp of the component HTTP GET Pa… |
CVE-2026-1119 | High | 7.3 | 2026-01-18 | A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/delete_activity.php. Execut… |
CVE-2026-1118 | Medium | 6.3 | 2026-01-18 | A vulnerability was detected in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/add_activity.php. Performing a m… |
CVE-2026-1112 | Medium | 5.4 | 2026-01-18 | A vulnerability was found in Sanluan PublicCMS up to 5.202506.d. Affected is the function delete of the file publiccms-trade/src/main/java/com/publiccms/contro… |
CVE-2026-1111 | Medium | 4.7 | 2026-01-18 | A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplat… |
CVE-2026-1110 | Medium | 5.3 | 2026-01-18 | A flaw has been found in cijliu librtsp up to 2ec1a81ad65280568a0c7c16420d7c10fde13b04. This affects the function rtsp_parse_method. This manipulation causes b… |
CVE-2026-1109 | Medium | 5.3 | 2026-01-18 | A vulnerability was detected in cijliu librtsp up to 2ec1a81ad65280568a0c7c16420d7c10fde13b04. The impacted element is the function rtsp_parse_request. The man… |
CVE-2026-1108 | Medium | 5.3 | 2026-01-18 | A security vulnerability has been detected in cijliu librtsp up to 2ec1a81ad65280568a0c7c16420d7c10fde13b04. The affected element is the function rtsp_rely_dum… |
CVE-2026-1107 | Medium | 6.3 | 2026-01-18 | A weakness has been identified in EyouCMS up to 1.7.1/5.0. Impacted is the function check_userinfo of the file Diyajax.php of the component Member Avatar Handl… |
CVE-2026-1106 | Medium | 5.4 | 2026-01-18 | A security flaw has been discovered in Chamilo LMS up to 2.0.0 Beta 1. This issue affects the function deleteLegal of the file src/CoreBundle/Controller/Social… |
CVE-2026-1105 | High | 7.3 | 2026-01-18 | A vulnerability was identified in EasyCMS up to 1.6. This vulnerability affects unknown code of the file /UserAction.class.php. Such manipulation of the argume… |
CVE-2026-1066 | Medium | 6.3 | 2026-01-17 | A vulnerability was detected in kalcaddle kodbox up to 1.61.10. This issue affects some unknown processing of the file /?explorer/index/zip of the component Co… |
CVE-2026-1064 | Medium | 4.7 | 2026-01-17 | A vulnerability was found in bastillion-io Bastillion up to 4.0.1. This issue affects some unknown processing of the file src/main/java/io/bastillion/manage/co… |
CVE-2026-1063 | Medium | 4.7 | 2026-01-17 | A vulnerability has been found in bastillion-io Bastillion up to 4.0.1. This vulnerability affects unknown code of the file src/main/java/io/bastillion/manage/… |
CVE-2026-1062 | Medium | 6.3 | 2026-01-17 | A flaw has been found in xiweicheng TMS up to 2.28.0. This affects the function Summary of the file src/main/java/com/lhjz/portal/util/HtmlUtil.java. This mani… |
CVE-2026-1061 | Medium | 6.3 | 2026-01-17 | A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhjz/portal/controller… |
CVE-2026-1059 | High | 7.3 | 2026-01-17 | A security vulnerability has been detected in FeMiner wms up to 9cad1f1b179a98b9547fd003c23b07c7594775fa. Affected by this vulnerability is an unknown function… |
CVE-2026-1050 | High | 7.3 | 2026-01-17 | A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7. This affects an unknown function of the file source-code/src/main/java/net/risesoft/ut… |
CVE-2026-1049 | Low | 3.5 | 2026-01-17 | A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulati… |
CVE-2026-1048 | Low | 3.5 | 2026-01-17 | A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketZoom. This manipulatio… |
CVE-2026-0725 | Medium | 4.4 | 2026-01-17 | The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1… |
CVE-2026-0833 | Medium | 6.4 | 2026-01-17 | The Team Section Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block in all versions up to, and including, 2.0.0 due… |
CVE-2026-0808 | Medium | 5.3 | 2026-01-17 | The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trus… |
CVE-2026-0691 | Medium | 4.4 | 2026-01-17 | The CM E-Mail Blacklist – Simple email filtering for safer registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'black_email'… |
CVE-2026-0820 | Medium | 4.3 | 2026-01-17 | The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing capabili… |
CVE-2026-0682 | Low | 2.2 | 2026-01-17 | The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.28 due to insufficient validation… |
CVE-2026-0519 | Low | 3.4 | 2026-01-17 | In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain configurations. Any party… |
CVE-2026-0518 | Medium | 4.8 | 2026-01-17 | CVE-2026-0518 is a cross-site scripting vulnerability in versions of Secure Access prior to 14.20. An attacker with administrative privileges can interfere w… |
CVE-2026-0517 | High | 7.5 | 2026-01-17 | CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure Access Server prior to 14.20. An attacker can send a specially crafted packet to a s… |
CVE-2026-22865 | High | 7.4 | 2026-01-16 | Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, s… |
CVE-2026-22816 | High | 7.4 | 2026-01-16 | Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, s… |
CVE-2026-23745 | Medium | 6.1 | 2026-01-16 | node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is… |
CVE-2026-21223 | High | 7.1 | 2026-01-16 | Improper privilege management in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally. |