2026 CVEs (page 44)
Page 44 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48084 | High | 7.4 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passp… |
CVE-2026-48083 | Medium | 6.5 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `/api/log` endpoint acc… |
CVE-2026-48082 | Low | 3.7 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge end… |
CVE-2026-48081 | High | 8.1 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN can store `j… |
CVE-2026-48080 | High | 8.0 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `GET /api/tenants/{id}`… |
CVE-2026-48079 | High | 7.4 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to th… |
CVE-2026-48078 | Medium | 5.3 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated `/api/t… |
CVE-2026-48077 | Medium | 5.3 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at `/api/te… |
CVE-2026-48076 | Medium | 6.5 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and p… |
CVE-2026-48075 | Medium | 6.5 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the `add-to-tunnel` endpoin… |
CVE-2026-48074 | Low | 2.7 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANT_ADMIN deletes… |
CVE-2026-48071 | Medium | 5.8 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge thro… |
CVE-2026-48054 | High | 8.8 | 2026-08-06 | OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 gen… |
CVE-2026-47765 | | 2026-08-06 | Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document p… | |
CVE-2026-47194 | | 2026-08-06 | Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request H… | |
CVE-2026-47185 | | 2026-08-06 | Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated use… | |
CVE-2026-45573 | Medium | 6.4 | 2026-08-06 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, when VAPID delivery is enabled… |
CVE-2026-45572 | Medium | 4.8 | 2026-08-06 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-… |
CVE-2026-45415 | Medium | 6.0 | 2026-08-06 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csv_census/census_l… |
CVE-2026-45414 | High | 8.5 | 2026-08-06 | Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organiza… |
CVE-2026-45378 | High | 7.5 | 2026-08-06 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verifica… |
CVE-2026-43632 | High | 8.1 | 2026-08-06 | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detok… |
CVE-2026-43631 | High | 8.1 | 2026-08-06 | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feat… |
CVE-2026-43630 | Medium | 6.5 | 2026-08-06 | llama.cpp builds b5702 through b7653 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write ac… |
CVE-2026-43629 | High | 8.1 | 2026-08-06 | llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function compu… |
CVE-2026-43628 | High | 7.8 | 2026-08-06 | llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers… |
CVE-2026-43627 | High | 7.8 | 2026-08-06 | llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() c… |
CVE-2026-41861 | Medium | 4.2 | 2026-08-06 | Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to a… |
CVE-2026-3418 | Critical | 9.1 | 2026-08-06 | The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to… |
CVE-2026-3415 | High | 8.7 | 2026-08-06 | The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the… |
CVE-2026-1289 | High | 7.8 | 2026-08-06 | A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability… |
CVE-2026-19177 | High | 8.3 | 2026-08-06 | Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-19176 | High | 7.5 | 2026-08-06 | Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to execute arbitrary code in… |
CVE-2026-19175 | Critical | 9.6 | 2026-08-06 | Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page… |
CVE-2026-19174 | High | 8.8 | 2026-08-06 | Integer overflow in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-19173 | High | 8.3 | 2026-08-06 | Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-19172 | High | 8.3 | 2026-08-06 | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2026-19171 | Critical | 9.6 | 2026-08-06 | Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2026-19170 | Critical | 9.6 | 2026-08-06 | Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2026-19169 | High | 8.8 | 2026-08-06 | Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform privilege escalati… |
CVE-2026-19168 | High | 8.8 | 2026-08-06 | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-19167 | Low | 3.1 | 2026-08-06 | Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data v… |
CVE-2026-19166 | Critical | 9.6 | 2026-08-06 | Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
CVE-2026-19165 | High | 7.5 | 2026-08-06 | Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to execute arbi… |
CVE-2026-19164 | Critical | 9.6 | 2026-08-06 | Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape… |
CVE-2026-19163 | High | 8.3 | 2026-08-06 | Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially p… |
CVE-2026-19162 | High | 8.8 | 2026-08-06 | Out of bounds write in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-19161 | Low | 3.1 | 2026-08-06 | Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data… |
CVE-2026-19160 | Low | 3.1 | 2026-08-06 | Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data… |
CVE-2026-19159 | High | 7.5 | 2026-08-06 | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentiall… |
CVE-2026-19158 | High | 7.5 | 2026-08-06 | Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2026-19157 | Critical | 9.6 | 2026-08-06 | Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafte… |
CVE-2026-19156 | High | 7.5 | 2026-08-06 | Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2026-19155 | High | 8.3 | 2026-08-06 | Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-19154 | High | 8.3 | 2026-08-06 | Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-19153 | High | 8.1 | 2026-08-06 | Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-19152 | High | 8.3 | 2026-08-06 | Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to po… |
CVE-2026-19151 | High | 8.8 | 2026-08-06 | Use after free in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
CVE-2026-19150 | High | 8.8 | 2026-08-06 | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-19149 | Critical | 9.6 | 2026-08-06 | Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML p… |
CVE-2026-19148 | High | 8.3 | 2026-08-06 | Out of bounds write in GPU in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-19147 | High | 8.3 | 2026-08-06 | Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perf… |
CVE-2026-19146 | Medium | 5.3 | 2026-08-06 | Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain poten… |
CVE-2026-19145 | High | 8.8 | 2026-08-06 | Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2026-19144 | High | 8.8 | 2026-08-06 | Use after free in HTML in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2026-19143 | High | 8.6 | 2026-08-06 | Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potentially perform a san… |
CVE-2026-19142 | High | 7.5 | 2026-08-06 | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentiall… |
CVE-2026-19141 | High | 8.3 | 2026-08-06 | Use after free in Resources in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2026-19140 | High | 8.3 | 2026-08-06 | Use after free in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
CVE-2026-19139 | High | 7.4 | 2026-08-06 | Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a maliciou… |
CVE-2026-19138 | High | 8.3 | 2026-08-06 | Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2026-19137 | High | 8.3 | 2026-08-06 | Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially p… |
CVE-2026-19127 | Medium | 6.5 | 2026-08-06 | An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptogr… |
CVE-2026-19111 | High | 8.1 | 2026-08-06 | Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow rem… |
CVE-2026-19110 | Low | 2.4 | 2026-08-06 | A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWid… |
CVE-2026-19108 | Medium | 5.3 | 2026-08-06 | A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec618… |
CVE-2026-19071 | Medium | 6.3 | 2026-08-06 | A flaw has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewappointment.php. This manipulation of th… |
CVE-2026-19070 | Medium | 6.3 | 2026-08-06 | A vulnerability was detected in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewadmin.php. The manipulation of t… |
CVE-2026-19069 | Medium | 6.3 | 2026-08-06 | A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /treatmentrecord.php. T… |
CVE-2026-19068 | Medium | 6.3 | 2026-08-06 | A weakness has been identified in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /treatmentdetail.php. Ex… |
CVE-2026-19067 | Medium | 6.3 | 2026-08-06 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /treatment.php. Per… |
CVE-2026-19066 | Medium | 4.3 | 2026-08-06 | A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unknown function of the file view_students… |
CVE-2026-19065 | Medium | 6.3 | 2026-08-06 | A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file up… |
CVE-2026-19064 | Medium | 4.3 | 2026-08-06 | A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of the file /view.php… |
CVE-2026-19062 | High | 7.3 | 2026-08-06 | A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.ac… |
CVE-2026-19061 | Low | 3.7 | 2026-08-06 | A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmwa… |
CVE-2026-19060 | Medium | 5.3 | 2026-08-06 | A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2. This impacts an unknown function. Such manipulation leads to code injection. The attack… |
CVE-2026-19059 | Low | 3.3 | 2026-08-06 | A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulat… |
CVE-2026-19058 | Medium | 5.3 | 2026-08-06 | A vulnerability was found in FoundationAgents MetaGPT up to 0.8.2. The impacted element is the function DataInterpreter of the file metagpt/roles/di/data_inter… |
CVE-2026-19054 | Medium | 5.3 | 2026-08-06 | A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/wri… |
CVE-2026-18487 | Medium | 5.4 | 2026-08-06 | A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clic… |
CVE-2026-18367 | Critical | 9.3 | 2026-08-06 | A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos… |
CVE-2026-17032 | Critical | 9.8 | 2026-08-06 | Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deplo… |
CVE-2026-16620 | High | 7.5 | 2026-08-06 | The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" pric… |
CVE-2026-16619 | High | 7.5 | 2026-08-06 | The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-sup… |
CVE-2026-16067 | Medium | 5.3 | 2026-08-06 | The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommer… |
CVE-2026-15734 | Critical | 9.8 | 2026-08-06 | A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as roo… |
CVE-2026-15733 | Critical | 9.8 | 2026-08-06 | A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to exe… |
CVE-2026-15732 | Critical | 9.8 | 2026-08-06 | A Server-Side Request Forgery (SSFR) vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to… |
CVE-2026-15256 | Medium | 4.8 | 2026-08-06 | The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from bein… |