2026 CVEs (page 460)
Page 460 of 462 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22081 | | 2026-01-09 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flag for session cookie… | |
CVE-2026-22080 | | 2026-01-09 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the transmission of credentials encoded usin… | |
CVE-2026-22079 | | 2026-01-09 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the plaintext transmission of login credenti… | |
CVE-2026-0627 | Medium | 6.4 | 2026-01-09 | The AMP for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.1.10. This is due… |
CVE-2026-21409 | Medium | 5.9 | 2026-01-09 | Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is conducted on the communication between the a… |
CVE-2026-20976 | High | 7.8 | 2026-01-09 | Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script. |
CVE-2026-20975 | Medium | 5.5 | 2026-01-09 | Improper handling of insufficient permission in Samsung Cloud prior to version 5.6.11 allows local attackers to access specific files in arbitrary path. |
CVE-2026-20974 | Medium | 4.6 | 2026-01-09 | Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass Carrier Relock. |
CVE-2026-20973 | Medium | 5.3 | 2026-01-09 | Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory. |
CVE-2026-20972 | Low | 3.3 | 2026-01-09 | Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB. |
CVE-2026-20971 | High | 7.8 | 2026-01-09 | Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code. |
CVE-2026-20970 | High | 7.8 | 2026-01-09 | Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs. |
CVE-2026-20969 | Medium | 5.5 | 2026-01-09 | Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege. User interaction is requir… |
CVE-2026-20968 | Medium | 6.7 | 2026-01-09 | Use after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to execute arbitrary code. |
CVE-2026-0563 | Medium | 6.4 | 2026-01-09 | The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpgsv_m… |
CVE-2026-22714 | | 2026-01-09 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Monaco Skin a… | |
CVE-2026-22713 | Medium | 5.4 | 2026-01-09 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperim… |
CVE-2026-22712 | Medium | 4.3 | 2026-01-09 | Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Ext… |
CVE-2026-22710 | Medium | 5.4 | 2026-01-09 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Exte… |
CVE-2026-0733 | Medium | 6.3 | 2026-01-09 | A vulnerability was determined in PHPGurukul Online Course Registration System up to 3.1. This impacts an unknown function of the file /onlinecourse/admin/mana… |
CVE-2026-0732 | Medium | 6.3 | 2026-01-09 | A vulnerability was found in D-Link DI-8200G 17.12.20A1. This affects an unknown function of the file /upgrade_filter.asp. The manipulation of the argument pat… |
CVE-2026-0731 | Medium | 5.3 | 2026-01-08 | A vulnerability has been found in TOTOLINK WA1200 5.9c.2914. The impacted element is an unknown function of the file cstecgi.cgi of the component HTTP Request… |
CVE-2026-0730 | Low | 2.4 | 2026-01-08 | A flaw has been found in PHPGurukul Staff Leave Management System 1.0. The affected element is the function ADD_STAFF/UPDATE_STAFF of the file /staffleave/slms… |
CVE-2026-0729 | Medium | 4.7 | 2026-01-08 | A vulnerability was detected in code-projects Intern Membership Management System 1.0. Impacted is an unknown function of the file /intern/admin/add_activity.p… |
CVE-2026-22588 | Medium | 6.5 | 2026-01-08 | Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Objec… |
CVE-2026-0728 | Medium | 4.7 | 2026-01-08 | A security vulnerability has been detected in code-projects Intern Membership Management System 1.0. This issue affects some unknown processing of the file /in… |
CVE-2026-0747 | Low | 3.3 | 2026-01-08 | Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows… |
CVE-2026-22257 | High | 8.8 | 2026-01-08 | Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generates a file view of a folder without sanitizing the files or folder… |
CVE-2026-22256 | High | 8.8 | 2026-01-08 | Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generate an file view of a folder which include a render of the current… |
CVE-2026-22253 | Medium | 5.4 | 2026-01-08 | Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the LFS lock deletion endpoint allows any au… |
CVE-2026-21860 | Medium | 5.3 | 2026-01-08 | Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names… |
CVE-2026-22587 | Medium | 5.5 | 2026-01-08 | Ideagen DevonWay contains a stored cross site scripting vulnerability. A remote, authenticated attacker could craft a payload in the 'Reports' page that execut… |
CVE-2026-22235 | High | 7.5 | 2026-01-08 | OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber… |
CVE-2026-22234 | Critical | 9.8 | 2026-01-08 | OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable value… |
CVE-2026-22233 | Medium | 5.5 | 2026-01-08 | OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment in the "Estimated Staff Hours" field. The JavaScript is executed whenever a… |
CVE-2026-22232 | Medium | 5.5 | 2026-01-08 | OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality. The JavaScript is… |
CVE-2026-22231 | Medium | 5.5 | 2026-01-08 | OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment within the Document Check Out functionality. The JavaScript is executed whe… |
CVE-2026-22230 | High | 7.6 | 2026-01-08 | OPEXUS eCASE Audit allows an authenticated attacker to modify client-side JavaScript or craft HTTP requests to access functions or buttons that have been disab… |
CVE-2026-21896 | Medium | 5.7 | 2026-01-08 | Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerabil… |
CVE-2026-22522 | Medium | 6.5 | 2026-01-08 | Missing Authorization vulnerability in Munir Kamal Block Slider block-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-22521 | High | 7.5 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in G5Theme Handmade Framework handmade-fr… |
CVE-2026-22519 | Medium | 6.5 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev MediaPress mediapress allows Stored XSS.This iss… |
CVE-2026-22518 | Medium | 6.5 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows… |
CVE-2026-22517 | Medium | 5.4 | 2026-01-08 | Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Contro… |
CVE-2026-22492 | Medium | 4.3 | 2026-01-08 | Missing Authorization vulnerability in Nawawi Jamili Docket Cache docket-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-22490 | Medium | 5.4 | 2026-01-08 | Missing Authorization vulnerability in niklaslindemann Bulk Landing Page Creator for WordPress LPagery lpagery allows Exploiting Incorrectly Configured Access… |
CVE-2026-22489 | Medium | 4.3 | 2026-01-08 | Authorization Bypass Through User-Controlled Key vulnerability in Wptexture Image Slider Slideshow image-slider-slideshow allows Exploiting Incorrectly Configu… |
CVE-2026-22488 | Medium | 5.3 | 2026-01-08 | Missing Authorization vulnerability in IdeaBox Creations Dashboard Welcome for Beaver Builder dashboard-welcome-for-beaver-builder allows Exploiting Incorrectl… |
CVE-2026-22487 | Medium | 4.3 | 2026-01-08 | Missing Authorization vulnerability in baqend Speed Kit baqend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Speed… |
CVE-2026-22486 | Medium | 5.3 | 2026-01-08 | Missing Authorization vulnerability in Re Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Re Gallery: from n… |
CVE-2026-21639 | High | 8.8 | 2026-01-08 | A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE… |
CVE-2026-21638 | High | 8.8 | 2026-01-08 | A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE… |
CVE-2026-0671 | Medium | 6.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - UploadWizard exte… |
CVE-2026-22255 | High | 8.8 | 2026-01-08 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-22246 | Medium | 6.5 | 2026-01-08 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to in… |
CVE-2026-22245 | High | 7.5 | 2026-01-08 | Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. M… |
CVE-2026-22244 | High | 7.2 | 2026-01-08 | OpenMetadata is a unified metadata platform. Versions prior to 1.11.4 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in Free… |
CVE-2026-22241 | High | 7.2 | 2026-01-08 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability… |
CVE-2026-22043 | Critical | 9.8 | 2026-01-08 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IA… |
CVE-2026-22042 | High | 8.8 | 2026-01-08 | RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API validates permissions using `ExportIAMAc… |
CVE-2026-22041 | Medium | 5.3 | 2026-01-08 | Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to version 0.0.6, non-st… |
CVE-2026-22034 | Critical | 9.8 | 2026-01-08 | Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snu… |
CVE-2026-22032 | Medium | 4.3 | 2026-01-08 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directu… |
CVE-2026-22028 | Medium | 6.1 | 2026-01-08 | Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A re… |
CVE-2026-21895 | Medium | 5.3 | 2026-01-08 | The `rsa` crate is an RSA implementation written in rust. Prior to version 0.9.10, when creating a RSA private key from its components, the construction panics… |
CVE-2026-21892 | Medium | 5.3 | 2026-01-08 | Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 2026.01.05. The applic… |
CVE-2026-21891 | Critical | 9.4 | 2026-01-08 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks th… |
CVE-2026-21885 | Medium | 6.5 | 2026-01-08 | Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to… |
CVE-2026-21876 | Critical | 9.3 | 2026-01-08 | The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8… |
CVE-2026-0719 | High | 8.6 | 2026-01-08 | A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When pro… |
CVE-2026-22242 | Medium | 4.9 | 2026-01-08 | CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authent… |
CVE-2026-21894 | Medium | 6.5 | 2026-01-08 | n8n is an open source workflow automation platform. In versions from 0.150.0 to before 2.2.2, an authentication bypass vulnerability in the Stripe Trigger node… |
CVE-2026-21874 | Medium | 5.3 | 2026-01-08 | NiceGUI is a Python-based UI framework. From versions v2.10.0 to 3.4.1, an unauthenticated attacker can exhaust Redis connections by repeatedly opening and clo… |
CVE-2026-21873 | High | 7.2 | 2026-01-08 | NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages allows an… |
CVE-2026-21872 | Medium | 6.1 | 2026-01-08 | NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the click event listener used by ui.sub_pages, combined with… |
CVE-2026-21871 | Medium | 6.1 | 2026-01-08 | NiceGUI is a Python-based UI framework. From versions 2.13.0 to 3.4.1, there is a XSS risk in NiceGUI when developers pass attacker-controlled strings into ui… |
CVE-2026-0676 | Medium | 5.3 | 2026-01-08 | Missing Authorization vulnerability in G5Theme Zorka zorka allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zorka: fr… |
CVE-2026-0674 | Medium | 4.3 | 2026-01-08 | Missing Authorization vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-0701 | Medium | 4.7 | 2026-01-08 | A vulnerability was identified in code-projects Intern Membership Management System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-0700 | High | 7.3 | 2026-01-08 | A vulnerability was determined in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /intern/admin/check_admin… |
CVE-2026-0699 | Medium | 4.7 | 2026-01-08 | A vulnerability was found in code-projects Intern Membership Management System 1.0. This impacts an unknown function of the file /intern/admin/edit_activity.ph… |
CVE-2026-0698 | Medium | 4.7 | 2026-01-08 | A vulnerability has been found in code-projects Intern Membership Management System 1.0. This affects an unknown function of the file /intern/admin/edit_studen… |
CVE-2026-0697 | Medium | 4.7 | 2026-01-08 | A flaw has been found in code-projects Intern Membership Management System 1.0. The impacted element is an unknown function of the file /intern/admin/edit_admi… |
CVE-2026-21427 | High | 7.8 | 2026-01-08 | The installers for multiple products provided by PIONEER CORPORATION contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Li… |
CVE-2026-0707 | Medium | 5.3 | 2026-01-08 | A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It… |
CVE-2026-21883 | Medium | 5.4 | 2026-01-08 | Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist (e.g., dashboard.corp… |
CVE-2026-21881 | Critical | 9.1 | 2026-01-08 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE… |
CVE-2026-21880 | Medium | 5.3 | 2026-01-08 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authenticatio… |
CVE-2026-21879 | Medium | 4.7 | 2026-01-08 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows maliciou… |
CVE-2026-22035 | High | 7.7 | 2026-01-08 | Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection through unsanitized filename processing… |
CVE-2026-21877 | Critical | 9.9 | 2026-01-08 | n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8… |
CVE-2026-21868 | High | 7.5 | 2026-01-08 | Flag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile… |
CVE-2026-21875 | Critical | 9.8 | 2026-01-08 | ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection through the add comment… |
CVE-2026-21869 | High | 8.8 | 2026-01-08 | llama.cpp is an inference of several LLM models in C/C++. In commits 55d4206c8 and prior, the n_discard parameter is parsed directly from JSON input in the lla… |
CVE-2026-21859 | Medium | 5.8 | 2026-01-08 | Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability in the /proxy endpoi… |
CVE-2026-21858 | Critical | 10.0 | 2026-01-08 | n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server… |
CVE-2026-21695 | Medium | 4.3 | 2026-01-08 | Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users… |
CVE-2026-21694 | Medium | 6.8 | 2026-01-08 | Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time… |
CVE-2026-21857 | Medium | 6.5 | 2026-01-07 | REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webro… |
CVE-2026-21851 | Medium | 5.3 | 2026-01-07 | MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.1, a Path Traversal (Zip Slip) vulnerability… |