2026 CVEs (page 46)
Page 46 of 662 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-75432 | | 2026-09-22 | An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and Scanner::PushIndentTo()… | |
CVE-2026-65829 | Medium | 5.3 | 2026-09-22 | MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafte… |
CVE-2026-63628 | | 2026-09-22 | mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-s… | |
CVE-2026-63627 | | 2026-09-22 | mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to vali… | |
CVE-2026-63104 | High | 8.1 | 2026-09-22 | Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to de… |
CVE-2026-62985 | High | 7.5 | 2026-09-22 | request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and… |
CVE-2026-61570 | High | 7.5 | 2026-09-22 | MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a Do… |
CVE-2026-59991 | High | 7.5 | 2026-09-22 | psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers f… |
CVE-2026-58268 | High | 7.5 | 2026-09-22 | SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer fr… |
CVE-2026-47116 | Critical | 9.8 | 2026-09-22 | LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recove… |
CVE-2026-28325 | High | 8.8 | 2026-09-22 | SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrus… |
CVE-2026-28324 | Critical | 9.8 | 2026-09-22 | SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity check… |
CVE-2026-95862 | High | 7.5 | 2026-09-22 | A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of S… |
CVE-2026-95861 | High | 7.5 | 2026-09-22 | A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial o… |
CVE-2026-95831 | High | 7.8 | 2026-09-22 | Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate r… |
CVE-2026-94462 | High | 7.1 | 2026-09-22 | Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api… |
CVE-2026-91130 | | 2026-09-22 | Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/cha… | |
CVE-2026-91129 | Medium | 5.4 | 2026-09-22 | Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed una… |
CVE-2026-89277 | Medium | 5.5 | 2026-09-22 | CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could… |
CVE-2026-88415 | High | 8.7 | 2026-09-22 | MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails` is excluded from the global XSS filter. |
CVE-2026-88414 | Critical | 9.8 | 2026-09-22 | MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do). |
CVE-2026-84396 | Medium | 5.5 | 2026-09-22 | InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this… |
CVE-2026-84395 | High | 7.1 | 2026-09-22 | Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation potentially resulting in unauthorized… |
CVE-2026-83964 | Medium | 6.2 | 2026-09-22 | Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage thi… |
CVE-2026-83963 | High | 7.8 | 2026-09-22 | Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-83962 | High | 7.8 | 2026-09-22 | Substance3D - Modeler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2026-82000 | Critical | 9.6 | 2026-09-22 | Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privilege… |
CVE-2026-81999 | High | 8.7 | 2026-09-22 | Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker wit… |
CVE-2026-81998 | High | 7.8 | 2026-09-22 | Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-81995 | Critical | 9.1 | 2026-09-22 | Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-79906 | High | 7.8 | 2026-09-22 | Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-77558 | High | 7.5 | 2026-09-22 | A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Se… |
CVE-2026-77556 | High | 7.5 | 2026-09-22 | A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Se… |
CVE-2026-77555 | High | 7.5 | 2026-09-22 | A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of S… |
CVE-2026-77544 | High | 7.5 | 2026-09-22 | A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of S… |
CVE-2026-77399 | Medium | 6.5 | 2026-09-22 | icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical accepts an attacker-controlled V… |
CVE-2026-77272 | Medium | 5.4 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth error query parameter is passed… |
CVE-2026-77269 | Medium | 6.5 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the remediation for CVE-2026-27825 protec… |
CVE-2026-77268 | Medium | 5.5 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth fallback token directory and JS… |
CVE-2026-77266 | Medium | 6.5 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment accepts absolute paths… |
CVE-2026-77262 | High | 8.6 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment accepts an a… |
CVE-2026-77259 | High | 7.7 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment opens a call… |
CVE-2026-77257 | Medium | 6.5 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, HTTP-exposed Jira and Confluence upload t… |
CVE-2026-77256 | Medium | 6.5 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the plaintext OAuth fallback file contain… |
CVE-2026-77255 | High | 8.6 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Jira update_issue attachments argumen… |
CVE-2026-77254 | Critical | 9.1 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, requests to the HTTP MCP endpoint without… |
CVE-2026-77253 | High | 7.1 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload too… |
CVE-2026-77249 | Medium | 5.3 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, JiraUserMixin._lookup_user_by_permissions… |
CVE-2026-77248 | High | 8.6 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the streamable HTTP transport accepts req… |
CVE-2026-77247 | Medium | 6.5 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpre… |
CVE-2026-77246 | High | 7.4 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, an HTTP transport deployment with READ_ON… |
CVE-2026-76194 | Medium | 4.3 | 2026-09-22 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-76192 | Medium | 5.5 | 2026-09-22 | InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this… |
CVE-2026-75745 | Critical | 10.0 | 2026-09-22 | Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the… |
CVE-2026-75744 | High | 8.1 | 2026-09-22 | Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to injec… |
CVE-2026-75743 | High | 7.1 | 2026-09-22 | Adobe Experience Manager Forms JEE is affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker… |
CVE-2026-75698 | Critical | 9.3 | 2026-09-22 | Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts int… |
CVE-2026-75697 | Critical | 9.3 | 2026-09-22 | Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable… |
CVE-2026-75689 | Critical | 9.3 | 2026-09-22 | Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable… |
CVE-2026-75686 | Critical | 9.3 | 2026-09-22 | Adobe Connect is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An at… |
CVE-2026-75684 | Critical | 9.3 | 2026-09-22 | Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable… |
CVE-2026-75682 | Critical | 9.9 | 2026-09-22 | Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitra… |
CVE-2026-75676 | High | 7.8 | 2026-09-22 | Bridge is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio… |
CVE-2026-75665 | High | 7.8 | 2026-09-22 | Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-75663 | High | 7.8 | 2026-09-22 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-75658 | High | 7.8 | 2026-09-22 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-75656 | Medium | 5.5 | 2026-09-22 | Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to d… |
CVE-2026-75655 | High | 7.8 | 2026-09-22 | Bridge is affected by an Uncontrolled Recursion vulnerability that could result in arbitrary code execution in the context of the current user. An attacker cou… |
CVE-2026-75649 | High | 7.8 | 2026-09-22 | Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-75638 | Medium | 6.5 | 2026-09-22 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-75634 | Medium | 4.3 | 2026-09-22 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-75633 | Medium | 5.5 | 2026-09-22 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could expl… |
CVE-2026-75632 | High | 7.5 | 2026-09-22 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-63386 | Medium | 5.3 | 2026-09-22 | js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the… |
CVE-2026-57149 | Critical | 9.9 | 2026-09-22 | plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting i… |
CVE-2026-48361 | Medium | 6.1 | 2026-09-22 | Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable… |
CVE-2026-37604 | Critical | 9.8 | 2026-09-22 | pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP an… |
CVE-2026-37603 | Medium | 6.5 | 2026-09-22 | Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) through 19.2.0. The CAP… |
CVE-2026-34689 | High | 8.6 | 2026-09-22 | Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file… |
CVE-2026-19480 | High | 7.5 | 2026-09-22 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-95660 | Medium | 6.3 | 2026-09-22 | A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/… |
CVE-2026-95657 | Low | 3.5 | 2026-09-22 | A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectioni… |
CVE-2026-95656 | High | 7.3 | 2026-09-22 | A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function add_watch_ui_snapshot of the file changedetect… |
CVE-2026-95624 | Medium | 6.8 | 2026-09-22 | The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replac… |
CVE-2026-94384 | High | 8.1 | 2026-09-22 | Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected fun… |
CVE-2026-93345 | High | 7.5 | 2026-09-22 | MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an… |
CVE-2026-8849 | | 2026-09-22 | Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation. This issue affects Connext Professional: from 7.6.0 befor… | |
CVE-2026-89276 | Critical | 9.9 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code exec… |
CVE-2026-89275 | Critical | 10.0 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code exec… |
CVE-2026-86056 | Medium | 5.5 | 2026-09-22 | Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a s… |
CVE-2026-86054 | High | 7.8 | 2026-09-22 | Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in NppParameters::writeSession in PowerEdito… |
CVE-2026-85995 | High | 7.3 | 2026-09-22 | Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP… |
CVE-2026-85288 | Medium | 6.7 | 2026-09-22 | Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMAC… |
CVE-2026-85279 | High | 8.6 | 2026-09-22 | Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in Pow… |
CVE-2026-84412 | Critical | 10.0 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code exec… |
CVE-2026-83660 | Critical | 9.9 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this… |
CVE-2026-83597 | High | 7.0 | 2026-09-22 | Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as ele… |
CVE-2026-82443 | Critical | 9.6 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged atta… |
CVE-2026-82013 | Critical | 9.9 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged atta… |
CVE-2026-82011 | Critical | 9.1 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re… |