2026 CVEs (page 488)
Page 488 of 678 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-31388 | Medium | 5.3 | 2026-05-19 | Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to… |
CVE-2026-31387 | Medium | 5.3 | 2026-05-19 | Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06… |
CVE-2026-31380 | Medium | 6.5 | 2026-05-19 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This iss… |
CVE-2026-31379 | Medium | 6.1 | 2026-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traver… |
CVE-2026-31378 | Medium | 6.5 | 2026-05-19 | Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09… |
CVE-2026-2611 | Critical | 9.6 | 2026-05-19 | In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote atta… |
CVE-2026-29226 | High | 7.3 | 2026-05-19 | Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects Apache OFBiz: before 24.09.06. Users ar… |
CVE-2026-29220 | Medium | 6.5 | 2026-05-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06… |
CVE-2026-29207 | Medium | 6.5 | 2026-05-19 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users… |
CVE-2026-44408 | Medium | 6.3 | 2026-05-19 | There is an unauthorized access vulnerability in ZTE MU5250. Due to improper permission control of the Web interface, an unauthorized attacker can modify conf… |
CVE-2026-8922 | Medium | 5.4 | 2026-05-19 | A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspec… |
CVE-2026-4885 | Critical | 9.8 | 2026-05-19 | The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_bui… |
CVE-2026-47317 | Medium | 5.5 | 2026-05-19 | Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects Escargot: 590345cc6258317c5da850d846ce6ba… |
CVE-2026-47316 | Medium | 5.5 | 2026-05-19 | Improper Check or Handling of Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation. This issue affects Escargot… |
CVE-2026-47315 | Medium | 5.5 | 2026-05-19 | Improper Check for Unusual or Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation. This issue affects Escargot… |
CVE-2026-47314 | High | 7.8 | 2026-05-19 | Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2… |
CVE-2026-47313 | Medium | 5.5 | 2026-05-19 | Memory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects Escargot: 590345cc62… |
CVE-2026-47312 | Medium | 5.5 | 2026-05-19 | Release of invalid pointer or reference vulnerability in Samsung Open Source Escargot allows Buffer Manipulation. This issue affects Escargot: 590345cc6258317… |
CVE-2026-8830 | Medium | 4.3 | 2026-05-19 | A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScri… |
CVE-2026-8814 | Medium | 5.3 | 2026-05-19 | Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zT… |
CVE-2026-8813 | High | 7.5 | 2026-05-19 | This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together… |
CVE-2026-47311 | High | 7.8 | 2026-05-19 | Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da850d846ce6ba… |
CVE-2026-47310 | High | 7.8 | 2026-05-19 | Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d… |
CVE-2026-47309 | Medium | 5.5 | 2026-05-19 | Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads. This issue affects Escargot: 590345cc6258317c5… |
CVE-2026-47308 | Medium | 5.5 | 2026-05-19 | NULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation. This issue affects Walrus: f339b8ee4ea701772e8ae640b3d1b12ac… |
CVE-2026-32994 | Medium | 5.3 | 2026-05-19 | The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows any authenticated… |
CVE-2026-47307 | Medium | 5.5 | 2026-05-19 | NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via a crafted WebAssembly module containin… |
CVE-2026-33565 | Low | 3.3 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. |
CVE-2026-28751 | Low | 3.3 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. |
CVE-2026-28733 | Medium | 6.5 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a local attacker arbitrary code execution. |
CVE-2026-27781 | Low | 3.3 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. |
CVE-2026-27766 | Medium | 5.5 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak. |
CVE-2026-27648 | High | 8.8 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps. |
CVE-2026-25850 | Medium | 5.5 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak |
CVE-2026-25781 | High | 8.4 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS and it cannot be recovered. |
CVE-2026-25110 | Low | 3.3 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. |
CVE-2026-24792 | High | 8.1 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps. |
CVE-2026-33514 | Medium | 4.3 | 2026-05-19 | Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, an authenticated user on a Discourse… |
CVE-2026-33234 | Medium | 5.0 | 2026-05-19 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.1.0 through 0.6.51, S… |
CVE-2026-33233 | High | 7.6 | 2026-05-19 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.6.34 through 0.6.51, t… |
CVE-2026-33232 | High | 7.5 | 2026-05-19 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.4.2 through 0.6.51 are vu… |
CVE-2026-33052 | | 2026-05-19 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_t… | |
CVE-2026-32323 | High | 7.3 | 2026-05-19 | Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation durin… |
CVE-2026-32312 | Medium | 4.3 | 2026-05-19 | GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the str… |
CVE-2026-32244 | Medium | 5.3 | 2026-05-19 | Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, outdated cached AI summaries can leak… |
CVE-2026-30950 | High | 7.1 | 2026-05-18 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.6.36 through 0.6.50 are v… |
CVE-2026-27964 | Low | 3.9 | 2026-05-18 | FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability thro… |
CVE-2026-27892 | Medium | 6.5 | 2026-05-18 | FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores and serves uploaded images byte-for-by… |
CVE-2026-27891 | High | 7.2 | 2026-05-18 | FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins::add() function. Th… |
CVE-2026-27737 | Medium | 6.5 | 2026-05-18 | BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user's input in… |
CVE-2026-8851 | High | 8.1 | 2026-05-18 | SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to ex… |
CVE-2026-8838 | Critical | 9.8 | 2026-05-18 | Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2.1.14 allows a rogue server or man-i… |
CVE-2026-4137 | High | 7.8 | 2026-05-18 | In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-… |
CVE-2026-27130 | Critical | 9.9 | 2026-05-18 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 and below have OS command injection through the appName parameter. 3 chained iss… |
CVE-2026-26978 | | 2026-05-18 | FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore operations, potentiall… | |
CVE-2026-25244 | Critical | 9.8 | 2026-05-18 | WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a comm… |
CVE-2026-22810 | High | 8.2 | 2026-05-18 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vuln… |
CVE-2026-47092 | High | 7.8 | 2026-05-18 | Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by m… |
CVE-2026-47091 | Low | 3.3 | 2026-05-18 | Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unv… |
CVE-2026-47090 | Medium | 4.6 | 2026-05-18 | Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping… |
CVE-2026-45246 | Medium | 5.5 | 2026-05-18 | Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sen… |
CVE-2026-45245 | High | 7.4 | 2026-05-18 | Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacke… |
CVE-2026-45244 | Medium | 5.4 | 2026-05-18 | Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user appr… |
CVE-2026-21789 | Medium | 4.6 | 2026-05-18 | HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios. |
CVE-2026-8836 | Critical | 9.8 | 2026-05-18 | A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 U… |
CVE-2026-45243 | Medium | 6.1 | 2026-05-18 | Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform… |
CVE-2026-45242 | High | 7.1 | 2026-05-18 | Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbi… |
CVE-2026-45231 | Medium | 6.1 | 2026-05-18 | DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, description, modelNumber, serialNumber, and tags… |
CVE-2026-45495 | High | 8.8 | 2026-05-18 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2026-45494 | Medium | 5.4 | 2026-05-18 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2026-45492 | Medium | 5.4 | 2026-05-18 | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-45230 | Critical | 9.1 | 2026-05-18 | DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthen… |
CVE-2026-42822 | Critical | 10.0 | 2026-05-18 | Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-32849 | Medium | 5.5 | 2026-05-18 | NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/opencrypto/cryptodev.c where the local va… |
CVE-2026-32848 | Medium | 4.7 | 2026-05-18 | NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger… |
CVE-2026-29965 | Medium | 6.1 | 2026-05-18 | HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police/WarningUrlPage.php endpoint due to improper neutralization of user-supplie… |
CVE-2026-29964 | Medium | 6.1 | 2026-05-18 | HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization of user-controlled i… |
CVE-2026-29963 | High | 7.5 | 2026-05-18 | HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. The text parameter… |
CVE-2026-29962 | High | 7.5 | 2026-05-18 | HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths. The endpoint /vendor/php… |
CVE-2026-8843 | Medium | 6.5 | 2026-05-18 | Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating… |
CVE-2026-45829 | Critical | 10.0 | 2026-05-18 | A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary… |
CVE-2026-41085 | High | 8.8 | 2026-05-18 | Thermo Fisher Scientific Torrent Suite Dx through 5.14.2 has a privilege escalation vulnerability that may allow an authenticated user with limited access priv… |
CVE-2026-38719 | Medium | 6.2 | 2026-05-18 | OpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format (CPF) parser, specifically in CreateCommonPacketFormatStructu… |
CVE-2026-36438 | Medium | 5.3 | 2026-05-18 | An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information via password reset functionality under… |
CVE-2026-20685 | Medium | 6.5 | 2026-05-18 | An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addressed with improved validation. This issu… |
CVE-2026-41949 | Medium | 5.9 | 2026-05-18 | Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 c… |
CVE-2026-41948 | Critical | 9.4 | 2026-05-18 | Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's in… |
CVE-2026-41947 | Critical | 9.1 | 2026-05-18 | Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any… |
CVE-2026-39079 | High | 7.5 | 2026-05-18 | An issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker to obtain sensitive information via the /modules/upsshipping/lo… |
CVE-2026-26462 | High | 7.3 | 2026-05-18 | Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration. The application enables Node.js integ… |
CVE-2026-42009 | High | 7.5 | 2026-05-18 | A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator fu… |
CVE-2026-8803 | Low | 3.7 | 2026-05-18 | A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the compone… |
CVE-2026-7304 | Critical | 9.8 | 2026-05-18 | SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as Pyt… |
CVE-2026-7302 | Critical | 9.1 | 2026-05-18 | SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere… |
CVE-2026-7301 | Critical | 9.8 | 2026-05-18 | SGLangs multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 by default and contains a sink that calls pickle.loads() on incoming messages… |
CVE-2026-0983 | | 2026-05-18 | Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the… | |
CVE-2026-8802 | Medium | 4.3 | 2026-05-18 | A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/It… |
CVE-2026-4320 | | 2026-05-18 | Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HT… | |
CVE-2026-41119 | Medium | 6.8 | 2026-05-18 | Dell Live Optics Windows and Personal Edition collectors contain an improper certificate validation vulnerability. A remote unauthenticated attacker could pote… |
CVE-2026-7498 | High | 8.8 | 2026-05-18 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Information Technology Consulting and Organizatio… |