2026 CVEs (page 486)
Page 486 of 678 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44392 | Medium | 4.3 | 2026-05-20 | Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, uni… |
CVE-2026-2955 | Medium | 6.4 | 2026-05-20 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up… |
CVE-2026-9057 | High | 8.2 | 2026-05-20 | A broken access control issue has been identified in the Talend Administration Center, that allows a user with “View” permission to modify the Talend Studio up… |
CVE-2026-9056 | Medium | 5.4 | 2026-05-20 | A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permission to manage servers can store a XSS p… |
CVE-2026-7522 | High | 8.8 | 2026-05-20 | The Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.1.0 via the 'template' p… |
CVE-2026-5075 | Medium | 4.3 | 2026-05-20 | The All in One SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via 'internalOptions' localized script data in versions up to, and incl… |
CVE-2026-9010 | High | 7.5 | 2026-05-20 | The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to, and including, 2.0… |
CVE-2026-9003 | High | 7.5 | 2026-05-20 | E-LAN Hybrid Recording System developed by TONNET has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands… |
CVE-2026-7637 | Critical | 9.8 | 2026-05-20 | The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deserialization of untrusted input in the STYX… |
CVE-2026-7460 | | 2026-05-20 | mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager. The Queue Manager fetches mail queue entries from /… | |
CVE-2026-24215 | Medium | 5.7 | 2026-05-20 | NVIDIA Triton Inference Server contains a vulnerability in the DALI backend, where an attacker could cause uncontrolled resource consumption. A successful expl… |
CVE-2026-24214 | High | 8.0 | 2026-05-20 | NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integer overflow. A successful exploit of this vul… |
CVE-2026-24213 | High | 8.0 | 2026-05-20 | NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-of-bounds read. A successful exploit of this v… |
CVE-2026-24210 | High | 7.5 | 2026-05-20 | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an integer overflow. A successful exploit of this vulnerability might lea… |
CVE-2026-24209 | High | 7.5 | 2026-05-20 | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vulnerability might… |
CVE-2026-24208 | Medium | 5.3 | 2026-05-20 | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vulnerability might… |
CVE-2026-24207 | Critical | 9.8 | 2026-05-20 | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability migh… |
CVE-2026-24206 | High | 7.3 | 2026-05-20 | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability migh… |
CVE-2026-24163 | High | 7.5 | 2026-05-20 | NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deserialization. A successful exploit of this… |
CVE-2026-24160 | Medium | 5.5 | 2026-05-20 | NVIDIA TRT-LLM for any platform contains a vulnerability where an attacker could cause an unchecked return value to a null pointer dereference. A successful e… |
CVE-2026-24142 | Medium | 6.3 | 2026-05-20 | NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle. A successful exploit of this vulnerability might lead… |
CVE-2026-8685 | Medium | 6.5 | 2026-05-20 | The Infility Global plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' parameters in all versions up to, and including, 2.15.16… |
CVE-2026-8627 | Medium | 6.1 | 2026-05-20 | The Correct Prices plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['PHP_SELF'] variable in versions up to and including 1… |
CVE-2026-8626 | Medium | 6.1 | 2026-05-20 | The SponsorMe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.5.2 due to in… |
CVE-2026-8624 | Medium | 6.1 | 2026-05-20 | The LJ comments import: reloaded plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and includi… |
CVE-2026-8610 | Medium | 4.3 | 2026-05-20 | The TypeSquare Webfonts for ConoHa plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.4. This is due to the p… |
CVE-2026-8424 | Medium | 4.3 | 2026-05-20 | The Remove Yellow BGBOX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or i… |
CVE-2026-8423 | Medium | 4.3 | 2026-05-20 | The JaviBola Custom Theme Test plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to mis… |
CVE-2026-8420 | Medium | 6.1 | 2026-05-20 | The BLOGCHAT Chat System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6.3. This is due to missing… |
CVE-2026-8419 | Medium | 4.3 | 2026-05-20 | The Amazon Scraper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorr… |
CVE-2026-8418 | Medium | 4.3 | 2026-05-20 | The Games Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.0. This is due to missing or incorrect… |
CVE-2026-8038 | Medium | 6.4 | 2026-05-20 | The Faces of Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in the 'facesofusers' shortcode in a… |
CVE-2026-7472 | Medium | 4.9 | 2026-05-20 | The Read More & Accordion plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including… |
CVE-2026-7467 | High | 8.8 | 2026-05-20 | The Read More & Accordion plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.7. This is due to the 'RadMoreAj… |
CVE-2026-7462 | Medium | 6.1 | 2026-05-20 | The VatanSMS WP SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `page` parameter in all versions up to, and including, 1.01. T… |
CVE-2026-7284 | Critical | 9.8 | 2026-05-20 | The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation via user registration in all versions u… |
CVE-2026-6555 | Critical | 9.8 | 2026-05-20 | The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validati… |
CVE-2026-6549 | Medium | 6.4 | 2026-05-20 | The Logo Manager For Enamad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute of the `vc_enamad_namad`, `vc_enamad_sh… |
CVE-2026-6456 | High | 8.8 | 2026-05-20 | The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.2. This is due to the `rememberLogin`… |
CVE-2026-6452 | Medium | 4.3 | 2026-05-20 | The Bigfishgames Syndicate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing o… |
CVE-2026-6404 | Medium | 4.4 | 2026-05-20 | The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'anomify_api_key' parameter in versio… |
CVE-2026-6401 | Medium | 4.3 | 2026-05-20 | The Bottom Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.1.7. This is due to missing nonce verific… |
CVE-2026-6400 | Medium | 4.3 | 2026-05-20 | The Child Height Predictor by Ostheimer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.3. This is due t… |
CVE-2026-6399 | Medium | 4.4 | 2026-05-20 | The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0. This is due to the use of sanitize… |
CVE-2026-6397 | Medium | 6.4 | 2026-05-20 | The Sticky plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `cvmh-sticky` shortcode `readmoretext` attribute in versions up to and inc… |
CVE-2026-6395 | Medium | 6.1 | 2026-05-20 | The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2… |
CVE-2026-6394 | Medium | 5.4 | 2026-05-20 | The Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in version… |
CVE-2026-6391 | Medium | 6.1 | 2026-05-20 | The Sentence To SEO (keywords, description and tags) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0… |
CVE-2026-6072 | Medium | 6.5 | 2026-05-20 | The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to… |
CVE-2026-5293 | Medium | 6.4 | 2026-05-20 | The 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and includ… |
CVE-2026-45232 | Low | 3.1 | 2026-05-20 | Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows… |
CVE-2026-43620 | Medium | 6.5 | 2026-05-20 | Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server… |
CVE-2026-43619 | Medium | 6.3 | 2026-05-20 | Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir… |
CVE-2026-43618 | High | 8.1 | 2026-05-20 | Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overfl… |
CVE-2026-43617 | Medium | 4.8 | 2026-05-20 | Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configure… |
CVE-2026-3985 | High | 7.5 | 2026-05-20 | The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkout_uuid' parameter in all… |
CVE-2026-45585 | Medium | 6.8 | 2026-05-20 | Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerabi… |
CVE-2026-39309 | Medium | 5.5 | 2026-05-20 | Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the… |
CVE-2026-35593 | Medium | 6.8 | 2026-05-20 | Trilium Notes is an open-source, cross-platform hierarchical note taking application for building large personal knowledge bases. Versions 0.102.1 and prior ar… |
CVE-2026-34970 | | 2026-05-20 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow a bugnote author to access the note's Revisions page after losin… | |
CVE-2026-34754 | Medium | 4.3 | 2026-05-20 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow an authenticated user to upload attachments to private Issues th… |
CVE-2026-8495 | Critical | 9.8 | 2026-05-19 | Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15. |
CVE-2026-8493 | Medium | 5.4 | 2026-05-19 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS)… |
CVE-2026-8492 | Low | 2.7 | 2026-05-19 | Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects T… |
CVE-2026-8491 | Low | 3.7 | 2026-05-19 | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing. This issue affects Node View Perm… |
CVE-2026-6871 | Medium | 6.1 | 2026-05-19 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS). This… |
CVE-2026-6367 | Medium | 6.1 | 2026-05-19 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Th… |
CVE-2026-6366 | Medium | 6.6 | 2026-05-19 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects… |
CVE-2026-6365 | Medium | 6.1 | 2026-05-19 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Th… |
CVE-2026-6095 | Medium | 6.1 | 2026-05-19 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS). This i… |
CVE-2026-34744 | | 2026-05-19 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior permit a user to list and download their own attachments from an Issue… | |
CVE-2026-34600 | Medium | 5.7 | 2026-05-19 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.5.2 and prior contain a logic error in the… |
CVE-2026-34579 | | 2026-05-19 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior are vulnerable to Authorization Bypass through the private issue monit… | |
CVE-2026-5090 | Medium | 6.1 | 2026-05-19 | Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML a… |
CVE-2026-34463 | | 2026-05-19 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior contain a Stored XSS vulnerability. When cloning an issue originating… | |
CVE-2026-34390 | | 2026-05-19 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior have a Privilege Escalation vulnerability where insufficient access co… | |
CVE-2026-34358 | High | 8.1 | 2026-05-19 | CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contains a broken access control vulnerability where multiple admin c… |
CVE-2026-34246 | Medium | 4.8 | 2026-05-19 | CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability exists in t… |
CVE-2026-34241 | High | 8.7 | 2026-05-19 | CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the tick… |
CVE-2026-34234 | Critical | 10.0 | 2026-05-19 | CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerabl… |
CVE-2026-39250 | High | 7.3 | 2026-05-19 | An authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an attacker can directly access backend application interfaces, leadi… |
CVE-2026-34233 | Medium | 6.5 | 2026-05-19 | CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, multiple admin controllers expose DataTable endpoints without aut… |
CVE-2026-34216 | Medium | 6.6 | 2026-05-19 | CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the admin settings update endpoint accepted a fully qualified cla… |
CVE-2026-32882 | High | 7.1 | 2026-05-19 | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in libheif/p… |
CVE-2026-32814 | Medium | 6.5 | 2026-05-19 | libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the defau… |
CVE-2026-32741 | High | 7.1 | 2026-05-19 | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_image(). Wh… |
CVE-2026-42526 | Medium | 5.3 | 2026-05-19 | In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve… |
CVE-2026-32740 | High | 8.8 | 2026-05-19 | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile com… |
CVE-2026-32739 | Medium | 6.5 | 2026-05-19 | libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_… |
CVE-2026-27173 | High | 8.7 | 2026-05-19 | JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users wit… |
CVE-2026-8370 | | 2026-05-19 | Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power 64 BE, Linux Power 64 LE, zLinux (zSeri… | |
CVE-2026-8096 | Medium | 6.5 | 2026-05-19 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-8073 | High | 7.5 | 2026-05-19 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path val… |
CVE-2026-41470 | Medium | 5.9 | 2026-05-19 | LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens… |
CVE-2026-34154 | Medium | 5.3 | 2026-05-19 | Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, a vulnerability in the discourse-sub… |
CVE-2026-33741 | Medium | 6.8 | 2026-05-19 | EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below allow authenticated users to upload SVG attachments through no… |
CVE-2026-33642 | Critical | 9.9 | 2026-05-19 | Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validatio… |
CVE-2026-33637 | Unrated | | 2026-05-19 | Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-rel… |
CVE-2026-32738 | Medium | 6.5 | 2026-05-19 | libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the… |
CVE-2026-8605 | Critical | 9.8 | 2026-05-19 | In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin. |