2026 CVEs (page 445)
Page 445 of 681 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34181 | High | 7.4 | 2026-06-09 | Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1… |
CVE-2026-34180 | High | 7.5 | 2026-06-09 | Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-… |
CVE-2026-33828 | High | 7.8 | 2026-06-09 | Trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally. |
CVE-2026-33113 | Medium | 5.4 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform… |
CVE-2026-32193 | High | 8.8 | 2026-06-09 | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute c… |
CVE-2026-28301 | Medium | 4.8 | 2026-06-09 | A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website. |
CVE-2026-26142 | Critical | 9.8 | 2026-06-09 | Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network. |
CVE-2026-24181 | High | 7.3 | 2026-06-09 | NVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index validation. A successful exploit of this vulnerability migh… |
CVE-2026-24180 | High | 7.3 | 2026-06-09 | NVIDIA DALI contains a vulnerability in a component where an attacker could cause a heap-based buffer overflow. A successful exploit of this vulnerability migh… |
CVE-2026-22926 | High | 7.8 | 2026-06-09 | Omnissa Workspace ONE® Assist for macOS contains a Local Privilege Escalation Vulnerability. |
CVE-2026-0420 | Medium | 5.9 | 2026-06-09 | An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attacker to perform attack… |
CVE-2026-0419 | High | 8.0 | 2026-06-09 | Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networ… |
CVE-2026-0418 | Medium | 4.5 | 2026-06-09 | Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper with the system. |
CVE-2026-0417 | Medium | 4.5 | 2026-06-09 | Insufficient input validation vulnerability in the listed NETGEAR devices allows authenticated administrators connected to the local network to tamper with the… |
CVE-2026-0416 | Medium | 4.5 | 2026-06-09 | An insufficient input validation vulnerability in certain NETGEAR router models as listed allows an authenticated administrator with local network access to su… |
CVE-2026-0415 | Medium | 4.5 | 2026-06-09 | Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorize… |
CVE-2026-0414 | Medium | 4.5 | 2026-06-09 | Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorize… |
CVE-2026-0413 | Medium | 4.5 | 2026-06-09 | A buffer overflow vulnerability due to insufficient input validation in the listed NETGEAR models allows authenticated administrators connected to the local ne… |
CVE-2026-0412 | Medium | 4.5 | 2026-06-09 | Insufficient input validation vulnerability in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows administrators connected t… |
CVE-2026-0411 | High | 8.0 | 2026-06-09 | An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a user connected to your network to gain administrator… |
CVE-2026-0410 | Medium | 4.5 | 2026-06-09 | Authenticated administrators connected to the local network can gain elevated access to the router and make unauthorized changes to router software and funct… |
CVE-2026-0409 | Medium | 6.4 | 2026-06-09 | A NETGEAR security issue that could allow an attacker with ability to intercept and tamper with traffic between the router and the Internet to run commands on… |
CVE-2026-8045 | Medium | 6.5 | 2026-06-09 | CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side file contents when an… |
CVE-2026-8025 | Critical | 9.8 | 2026-06-09 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in MOSK Information Technologies Ltd. CBS Platform allows SQ… |
CVE-2026-49948 | High | 8.1 | 2026-06-09 | Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configu… |
CVE-2026-49938 | Medium | 6.5 | 2026-06-09 | A improper access control vulnerability in Fortinet FortiPortal 7.4.0 through 7.4.7, FortiPortal 7.2.0 through 7.2.8, FortiPortal 7.0 all versions may allow at… |
CVE-2026-25089 | Critical | 9.8 | 2026-06-09 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiS… |
CVE-2026-24065 | High | 8.1 | 2026-06-09 | Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. The helper validate… |
CVE-2026-24064 | High | 7.8 | 2026-06-09 | Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the pro… |
CVE-2026-10727 | High | 7.2 | 2026-06-09 | An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrar… |
CVE-2026-10523 | Critical | 9.9 | 2026-06-09 | An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to… |
CVE-2026-10520 | Critical | 10.0 | 2026-06-09 | An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-le… |
CVE-2026-9279 | | 2026-06-09 | Logseq exposes an IPC handler that allows the renderer process to execute shell commands. While an allowlist restricts the command name (e.g. `git`, `pandoc`… | |
CVE-2026-7486 | Critical | 9.8 | 2026-06-09 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Netcad Software Inc. E-İmar allows SQL Injection. This i… |
CVE-2026-52907 | High | 7.8 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: media: rockchip: rkcif: fix off by one bugs Change these comparisons from > vs >= to avoi… |
CVE-2026-52906 | High | 7.7 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: 9p: fix access mode flags being ORed instead of replaced Since commit 1f3e4142c0eb ("9p… |
CVE-2026-52905 | Medium | 5.5 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow non-power of two min_region_sz on damon_start() Commit d8f867fa08… |
CVE-2026-52904 | Medium | 5.5 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix nvkm_device leak on aperture removal failure When aperture_remove_confli… |
CVE-2026-49762 | | 2026-06-09 | Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a den… | |
CVE-2026-47901 | | 2026-06-09 | Logseq is vulnerable to a sandbox escape flaw where plugins running in sandboxed iframes can inject arbitrary HTML attributes, such as event handlers, into the… | |
CVE-2026-47900 | | 2026-06-09 | Logseq is vulnerable to a stored cross-site scripting (XSS). A malicious plugin can include a JavaScript payload in the "name" field of its "package.json" file… | |
CVE-2026-47899 | | 2026-06-09 | The Electron preload script in Logseq exposes an API method that allows the renderer process to invoke IPC handlers without proper path validation. An attacker… | |
CVE-2026-46332 | High | 8.0 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: greybus: gb-beagleplay: bound bootloader receive buffering cc1352_bootloader_rx() appends… |
CVE-2026-46330 | High | 7.8 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b853… |
CVE-2026-46329 | Medium | 5.5 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: erofs: handle end of filesystem properly for file-backed mounts I/O requests beyond the e… |
CVE-2026-46328 | High | 7.3 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix cpu timers Posix cpu timers requires an additional step be… |
CVE-2026-46327 | High | 7.8 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: dm: fix unlocked test for dm_suspended_md The function dm_blk_report_zones tests if the d… |
CVE-2026-46326 | High | 8.4 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mprls0025pa: fix spi_transfer struct initialisation Make sure that the spi… |
CVE-2026-46325 | Critical | 9.8 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementa… |
CVE-2026-11793 | Medium | 4.9 | 2026-06-09 | A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix() function in pw.c copies an attacker-controlled algorithm ID into a 256-byte s… |
CVE-2026-11792 | Low | 3.3 | 2026-06-09 | A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the create_masked_entry_string() function in auditlog.c copies a… |
CVE-2026-11790 | Medium | 4.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from store… |
CVE-2026-11789 | Medium | 4.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted passwo… |
CVE-2026-11788 | Medium | 5.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauth… |
CVE-2026-11787 | Medium | 5.0 | 2026-06-09 | A flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, causing a heap buffer… |
CVE-2026-11786 | Low | 1.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during d… |
CVE-2026-11785 | Medium | 4.3 | 2026-06-09 | A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed… |
CVE-2026-46324 | High | 7.8 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use list_del_rcu for netlink hooks nft_netdev_unregister_hooks and… |
CVE-2026-46323 | High | 7.8 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the s… |
CVE-2026-46322 | High | 7.1 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_on… |
CVE-2026-46321 | High | 7.1 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one() returns -EINVAL on… |
CVE-2026-46320 | High | 7.4 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame sh… |
CVE-2026-46319 | High | 7.8 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in… |
CVE-2026-46318 | Medium | 5.5 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare" This reverts commit ea52cb24c… |
CVE-2026-46317 | High | 8.8 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmus array behind mmu_lock kvm->arch.nested_mmus[] is walked… |
CVE-2026-46316 | Critical | 9.3 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic… |
CVE-2026-2638 | | 2026-06-09 | A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race conditio… | |
CVE-2026-11764 | | 2026-06-09 | When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not… | |
CVE-2026-49742 | | 2026-06-09 | Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Si… | |
CVE-2026-49741 | | 2026-06-09 | Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler… | |
CVE-2026-49740 | | 2026-06-09 | TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation or class restriction… | |
CVE-2026-49738 | | 2026-06-09 | The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, cau… | |
CVE-2026-47352 | | 2026-06-09 | Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outsi… | |
CVE-2026-47351 | | 2026-06-09 | Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather inf… | |
CVE-2026-47350 | | 2026-06-09 | Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13… | |
CVE-2026-47349 | | 2026-06-09 | Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. This issu… | |
CVE-2026-47348 | | 2026-06-09 | Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization… | |
CVE-2026-47347 | | 2026-06-09 | Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed… | |
CVE-2026-47346 | | 2026-06-09 | Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework'… | |
CVE-2026-47343 | | 2026-06-09 | Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active… | |
CVE-2026-11607 | | 2026-06-09 | Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the i… | |
CVE-2026-52902 | Medium | 4.7 | 2026-06-09 | A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to cra… |
CVE-2026-4058 | Medium | 4.3 | 2026-06-09 | The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modi… |
CVE-2026-46749 | High | 7.5 | 2026-06-09 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application uses a password hashing implementation with a sta… |
CVE-2026-46748 | High | 8.8 | 2026-06-09 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configured with the cap_dac_… |
CVE-2026-46747 | Medium | 4.3 | 2026-06-09 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application does not properly sanitize path input in the `GET… |
CVE-2026-46746 | High | 8.8 | 2026-06-09 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/upl… |
CVE-2026-41031 | High | 8.7 | 2026-06-09 | A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote attacker with low… |
CVE-2026-24349 | High | 7.1 | 2026-06-09 | A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC… |
CVE-2026-10731 | | 2026-06-09 | SQL injection in the ‘two_steps_auth_code’ parameter processed by the ‘twoStepsAuthVerification’ function within the ‘/user-login’ endpoint. The two-factor aut… | |
CVE-2026-8677 | Medium | 6.4 | 2026-06-09 | The Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Widget HTML T… |
CVE-2026-8599 | Medium | 6.4 | 2026-06-09 | The MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Camp… |
CVE-2026-8365 | High | 8.8 | 2026-06-09 | The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 datab… |
CVE-2026-7542 | Medium | 6.5 | 2026-06-09 | The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions 7.0 to 7.0.10. This is due to three compounding design… |
CVE-2026-6899 | Medium | 5.6 | 2026-06-09 | Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper o… |
CVE-2026-49818 | Medium | 6.5 | 2026-06-09 | The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named wi… |
CVE-2026-46315 | Medium | 5.5 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: clear waitid info before copying it to userspace IORING_OP_WAITID stores… |
CVE-2026-34905 | Medium | 6.5 | 2026-06-09 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The unlisted ques… |
CVE-2026-34033 | Medium | 5.4 | 2026-06-09 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0… |
CVE-2026-34031 | Medium | 6.5 | 2026-06-09 | Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The server did not sufficien… |