2026 CVEs (page 457)
Page 457 of 462 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22871 | Critical | 9.8 | 2026-01-13 | GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() functio… |
CVE-2026-22870 | High | 7.5 | 2026-01-13 | GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when e… |
CVE-2026-22869 | Critical | 9.8 | 2026-01-13 | Eigent is a multi-agent Workforce. A critical security vulnerability in the CI workflow (.github/workflows/ci.yml) allows arbitrary code execution from fork pu… |
CVE-2026-22868 | High | 7.5 | 2026-01-13 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially cra… |
CVE-2026-22862 | High | 7.5 | 2026-01-13 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially cra… |
CVE-2026-22861 | High | 8.8 | 2026-01-13 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21303 | Medium | 5.5 | 2026-01-13 | Substance3D - Modeler versions 1.22.4 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could lev… |
CVE-2026-21302 | Medium | 5.5 | 2026-01-13 | Substance3D - Modeler versions 1.22.4 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could lev… |
CVE-2026-21301 | Medium | 5.5 | 2026-01-13 | Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. Ex… |
CVE-2026-21300 | Medium | 5.5 | 2026-01-13 | Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. Ex… |
CVE-2026-21299 | High | 7.8 | 2026-01-13 | Substance3D - Modeler versions 1.22.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the con… |
CVE-2026-21298 | High | 7.8 | 2026-01-13 | Substance3D - Modeler versions 1.22.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the con… |
CVE-2026-0543 | Medium | 6.5 | 2026-01-13 | Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted e… |
CVE-2026-0531 | Medium | 6.5 | 2026-01-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrie… |
CVE-2026-0530 | Medium | 6.5 | 2026-01-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. Th… |
CVE-2026-0528 | Medium | 6.5 | 2026-01-13 | Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153… |
CVE-2026-22818 | High | 8.2 | 2026-01-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification midd… |
CVE-2026-22817 | High | 8.2 | 2026-01-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification midd… |
CVE-2026-22814 | | 2026-01-13 | @adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid… | |
CVE-2026-22809 | Medium | 4.4 | 2026-01-13 | tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in t… |
CVE-2026-21308 | Medium | 5.5 | 2026-01-13 | Substance3D - Designer versions 15.0.3 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could le… |
CVE-2026-21307 | High | 7.8 | 2026-01-13 | Substance3D - Designer versions 15.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-21306 | High | 7.8 | 2026-01-13 | Substance3D - Sampler versions 5.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2026-21305 | High | 7.8 | 2026-01-13 | Substance3D - Painter versions 11.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the con… |
CVE-2026-21287 | High | 7.8 | 2026-01-13 | Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-22791 | Medium | 6.6 | 2026-01-13 | openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP… |
CVE-2026-21304 | High | 7.8 | 2026-01-13 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in… |
CVE-2026-21288 | Medium | 5.5 | 2026-01-13 | Illustrator versions 29.8.3, 30.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An att… |
CVE-2026-21283 | High | 7.8 | 2026-01-13 | Bridge versions 15.1.2, 16.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contex… |
CVE-2026-21281 | High | 7.8 | 2026-01-13 | InCopy versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contex… |
CVE-2026-21280 | High | 8.6 | 2026-01-13 | Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-21278 | Medium | 5.5 | 2026-01-13 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could le… |
CVE-2026-21277 | High | 7.8 | 2026-01-13 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in… |
CVE-2026-21276 | High | 7.8 | 2026-01-13 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code executi… |
CVE-2026-21275 | High | 7.8 | 2026-01-13 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code executi… |
CVE-2026-21274 | High | 7.8 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the con… |
CVE-2026-21272 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An att… |
CVE-2026-21271 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the c… |
CVE-2026-21268 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the c… |
CVE-2026-21267 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul… |
CVE-2026-21226 | High | 7.5 | 2026-01-13 | Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network. |
CVE-2026-21265 | Medium | 6.4 | 2026-01-13 | Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affect… |
CVE-2026-21224 | High | 7.8 | 2026-01-13 | Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. |
CVE-2026-21221 | High | 7.0 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authoriz… |
CVE-2026-21219 | High | 7.0 | 2026-01-13 | Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. |
CVE-2026-20965 | High | 7.5 | 2026-01-13 | Improper verification of cryptographic signature in Windows Admin Center allows an authorized attacker to elevate privileges locally. |
CVE-2026-20963 | Critical | 9.8 | 2026-01-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. |
CVE-2026-20962 | Medium | 4.4 | 2026-01-13 | Use of uninitialized resource in Dynamic Root of Trust for Measurement (DRTM) allows an authorized attacker to disclose information locally. |
CVE-2026-20959 | Medium | 4.6 | 2026-01-13 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-20958 | Medium | 5.4 | 2026-01-13 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. |
CVE-2026-20957 | High | 7.8 | 2026-01-13 | Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-20956 | High | 7.8 | 2026-01-13 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-20955 | High | 7.8 | 2026-01-13 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-20953 | High | 8.4 | 2026-01-13 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-20952 | High | 8.4 | 2026-01-13 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-20951 | High | 7.8 | 2026-01-13 | Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. |
CVE-2026-20950 | High | 7.8 | 2026-01-13 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-20949 | High | 7.8 | 2026-01-13 | Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-20948 | High | 7.8 | 2026-01-13 | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-20947 | High | 8.8 | 2026-01-13 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute co… |
CVE-2026-20946 | High | 7.8 | 2026-01-13 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-20944 | High | 8.4 | 2026-01-13 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-20943 | High | 7.0 | 2026-01-13 | Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-20941 | High | 7.8 | 2026-01-13 | Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally. |
CVE-2026-20940 | High | 7.8 | 2026-01-13 | Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-20939 | Medium | 5.5 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-20938 | High | 7.8 | 2026-01-13 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
CVE-2026-20937 | Medium | 5.5 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-20936 | Medium | 4.3 | 2026-01-13 | Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack. |
CVE-2026-20935 | Medium | 6.2 | 2026-01-13 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an unauthorized attacker to disclose information locally. |
CVE-2026-20934 | High | 7.5 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate priv… |
CVE-2026-20932 | Medium | 5.5 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-20931 | High | 8.0 | 2026-01-13 | External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network. |
CVE-2026-20929 | High | 7.5 | 2026-01-13 | Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network. |
CVE-2026-20927 | Medium | 5.3 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to deny service… |
CVE-2026-20926 | High | 7.5 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate priv… |
CVE-2026-20925 | Medium | 6.5 | 2026-01-13 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-20924 | High | 7.8 | 2026-01-13 | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-20923 | High | 7.8 | 2026-01-13 | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-20922 | High | 7.8 | 2026-01-13 | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. |
CVE-2026-20921 | High | 7.5 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate priv… |
CVE-2026-20920 | High | 7.8 | 2026-01-13 | Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
CVE-2026-20919 | High | 7.5 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate priv… |
CVE-2026-20918 | High | 7.8 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to ele… |
CVE-2026-20877 | High | 7.8 | 2026-01-13 | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-20876 | Medium | 6.7 | 2026-01-13 | Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
CVE-2026-20875 | High | 7.5 | 2026-01-13 | Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network. |
CVE-2026-20874 | High | 7.8 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to ele… |
CVE-2026-20873 | High | 7.8 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to ele… |
CVE-2026-20872 | Medium | 6.5 | 2026-01-13 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-20871 | High | 7.8 | 2026-01-13 | Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-20870 | High | 7.8 | 2026-01-13 | Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
CVE-2026-20869 | High | 7.0 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Local Session Manager (LSM) allows an authorized attacke… |
CVE-2026-20868 | High | 8.8 | 2026-01-13 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2026-20867 | High | 7.8 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to ele… |
CVE-2026-20866 | High | 7.8 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to ele… |
CVE-2026-20865 | High | 7.8 | 2026-01-13 | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-20864 | High | 7.8 | 2026-01-13 | Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. |
CVE-2026-20863 | High | 7.0 | 2026-01-13 | Double free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
CVE-2026-20862 | Medium | 5.5 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Windows Management Services allows an authorized attacker to disclose information locally. |