2026 CVEs (page 507)
Page 507 of 673 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-3953 | High | 8.8 | 2026-05-07 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gosoft Software Industry and Trade Ltd. Co. Proticaret E-… |
CVE-2026-33589 | Medium | 6.5 | 2026-05-07 | Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files content from the docke… |
CVE-2026-33588 | High | 8.1 | 2026-05-07 | Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify files on the docker cont… |
CVE-2026-33587 | Critical | 10.0 | 2026-05-07 | Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker contain… |
CVE-2026-28201 | High | 7.8 | 2026-05-07 | An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimat… |
CVE-2026-27415 | Medium | 4.3 | 2026-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in PluginUs.Net BEAR allows Cross Site Request Forgery. This issue affects BEAR: from n/a through 1.1.5. |
CVE-2026-6805 | High | 7.5 | 2026-05-07 | Vulnerability on the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the server allowing an of… |
CVE-2026-44407 | Medium | 4.7 | 2026-05-07 | A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corruption and remote denial of service. |
CVE-2026-27421 | Medium | 6.5 | 2026-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons allows Stored XSS. This i… |
CVE-2026-27416 | Medium | 5.3 | 2026-05-07 | Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF Pos… |
CVE-2026-27329 | Medium | 5.3 | 2026-05-07 | Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-25468 | Medium | 5.3 | 2026-05-07 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs Happy Addons for Elementor allows Retrieve Embedded Sensitiv… |
CVE-2026-25436 | Medium | 5.3 | 2026-05-07 | Missing Authorization vulnerability in WProyal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affe… |
CVE-2026-4430 | High | 7.8 | 2026-05-07 | Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters. This issue af… |
CVE-2026-44406 | Medium | 5.7 | 2026-05-07 | ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enabl… |
CVE-2026-8063 | Medium | 6.5 | 2026-05-07 | An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects t… |
CVE-2026-7252 | High | 8.1 | 2026-05-07 | The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arbitrary file deleti… |
CVE-2026-6692 | High | 8.8 | 2026-05-07 | The Slider Revolution plugin for WordPress is vulnerable to Arbitrary File Upload in versions 7.0.0 to 7.0.10 via the '_get_media_url' and '_check_file_path' f… |
CVE-2026-4348 | High | 7.5 | 2026-05-07 | The BetterDocs Pro plugin for WordPress is vulnerable to SQL Injection via the `get_current_letter_docs` and `docs_sort_by_letter` AJAX actions in all versions… |
CVE-2026-41641 | High | 7.2 | 2026-05-07 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() valida… |
CVE-2026-41586 | Critical | 9.8 | 2026-05-07 | Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, C… |
CVE-2026-41413 | Medium | 5.0 | 2026-05-07 | Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is created w… |
CVE-2026-41143 | High | 8.8 | 2026-05-07 | YesWiki is a wiki system written in PHP. Prior to version 4.6.1, YesWiki bazar module contains a SQL injection vulnerability in tools/bazar/services/EntryManag… |
CVE-2026-41139 | High | 8.8 | 2026-05-07 | Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the exp… |
CVE-2026-6214 | Medium | 6.5 | 2026-05-07 | The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listen_for_saving_e… |
CVE-2026-44603 | Low | 3.7 | 2026-05-07 | Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007. |
CVE-2026-44602 | Low | 3.7 | 2026-05-07 | Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006. |
CVE-2026-44601 | Low | 3.7 | 2026-05-07 | Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009. |
CVE-2026-42217 | Critical | 9.8 | 2026-05-07 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions… |
CVE-2026-42216 | Critical | 9.1 | 2026-05-07 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions… |
CVE-2026-42194 | Medium | 6.8 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP a… |
CVE-2026-41891 | | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26… | |
CVE-2026-41890 | | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.31… | |
CVE-2026-41675 | High | 7.5 | 2026-05-07 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0… |
CVE-2026-41674 | High | 7.5 | 2026-05-07 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0… |
CVE-2026-41673 | High | 7.5 | 2026-05-07 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0… |
CVE-2026-41672 | High | 7.5 | 2026-05-07 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0… |
CVE-2026-41671 | Medium | 6.8 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the OIDC token introspection endpoint (/modules/sso/index.php/oidc/introspect) alwa… |
CVE-2026-41670 | High | 8.2 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO module uses the AssertionConsumerServi… |
CVE-2026-41669 | High | 8.2 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio SAML Identity Provider implementation discards the return value of its… |
CVE-2026-41663 | Low | 3.5 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, several administrative operations in Admidio's preferences module (database backup… |
CVE-2026-41662 | Medium | 5.2 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, Role::stopMembership() does not verify whether removing a user from the administrat… |
CVE-2026-41661 | Medium | 6.1 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, an unauthenticated attacker can execute arbitrary JavaScript in any Admidio user's… |
CVE-2026-41660 | High | 7.1 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorizatio… |
CVE-2026-41659 | Low | 2.7 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_data.php) includes hi… |
CVE-2026-41658 | Medium | 6.5 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces authorization for destructive operations (del… |
CVE-2026-41657 | Medium | 4.9 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the contacts_data.php endpoint uses a weaker permission check (isAdministratorUsers… |
CVE-2026-41656 | Medium | 4.5 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the add mode in modules/documents-files.php accepts a name parameter validated only… |
CVE-2026-41655 | Medium | 6.5 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the ecard_preview.php endpoint does not validate that the ecard_template POST param… |
CVE-2026-41640 | High | 7.5 | 2026-05-07 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL()… |
CVE-2026-41587 | | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26… | |
CVE-2026-41203 | | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… | |
CVE-2026-41202 | | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… | |
CVE-2026-41201 | Critical | 9.1 | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. In version 0.31.4… |
CVE-2026-41142 | High | 8.8 | 2026-05-07 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions… |
CVE-2026-41004 | Medium | 4.4 | 2026-05-07 | When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from… |
CVE-2026-41002 | High | 7.2 | 2026-05-07 | The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-che… |
CVE-2026-40982 | Critical | 9.1 | 2026-05-07 | Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker… |
CVE-2026-40981 | High | 7.5 | 2026-05-07 | When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secret… |
CVE-2026-40004 | Medium | 5.5 | 2026-05-07 | There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code locally and escalate p… |
CVE-2026-4807 | Medium | 6.5 | 2026-05-07 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.6.10.6. This is due to a flawed… |
CVE-2026-44600 | Low | 3.7 | 2026-05-07 | Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010. |
CVE-2026-44599 | Low | 3.7 | 2026-05-07 | Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008. |
CVE-2026-6222 | Medium | 5.3 | 2026-05-07 | The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1. This is due to the `processRequest()`… |
CVE-2026-40003 | Medium | 5.1 | 2026-05-07 | ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the… |
CVE-2026-44597 | Low | 3.7 | 2026-05-07 | Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011. |
CVE-2026-41484 | Medium | 5.3 | 2026-05-06 | OpenTelemetry.Exporter.OneCollector is a .NET exporter that sends telemetry to a OneCollector back-end over HTTP. In versions 1.15.0 and earlier, when a reques… |
CVE-2026-41483 | Medium | 5.9 | 2026-05-06 | OpenTelemetry.Resources.Azure is the .NET resource detector for Azure environments. In versions 1.15.0-beta.1 and earlier, the AzureVmMetaDataRequestor class m… |
CVE-2026-41417 | Medium | 5.3 | 2026-05-06 | Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `… |
CVE-2026-41310 | Medium | 5.3 | 2026-05-06 | OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin exporter remote endpoint cache accepts… |
CVE-2026-40296 | Medium | 5.4 | 2026-05-06 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value d… |
CVE-2026-3291 | Medium | 5.5 | 2026-05-06 | Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the application via mobile devic… |
CVE-2026-40332 | | 2026-05-06 | Masa CMS is affected by an Open Redirect vulnerability due to improper handling of scheme-relative URLs. The application incorrectly interprets paths beginning… | |
CVE-2026-40281 | Critical | 10.0 | 2026-05-06 | Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control char… |
CVE-2026-40251 | Medium | 6.5 | 2026-05-06 | Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authen… |
CVE-2026-40243 | Medium | 4.8 | 2026-05-06 | Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow c… |
CVE-2026-40197 | Medium | 6.5 | 2026-05-06 | Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authen… |
CVE-2026-40195 | Medium | 6.5 | 2026-05-06 | Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authen… |
CVE-2026-8033 | Medium | 5.3 | 2026-05-06 | A vulnerability has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. This affects an unknown function of the file /cdemos/echs/api/v2/ of the com… |
CVE-2026-8032 | High | 7.3 | 2026-05-06 | A flaw has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. The impacted element is an unknown function of the file /cdemos/echs/priv/echs.js. Th… |
CVE-2026-44118 | High | 7.8 | 2026-05-06 | OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can pres… |
CVE-2026-44117 | Medium | 5.8 | 2026-05-06 | OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSR… |
CVE-2026-44116 | High | 8.6 | 2026-05-06 | OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validate outbound photo UR… |
CVE-2026-44115 | High | 8.8 | 2026-05-06 | OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass al… |
CVE-2026-44114 | High | 7.8 | 2026-05-06 | OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing attackers to overri… |
CVE-2026-44113 | High | 7.7 | 2026-05-06 | OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside th… |
CVE-2026-44112 | Critical | 9.6 | 2026-05-06 | OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes o… |
CVE-2026-44111 | Medium | 4.3 | 2026-05-06 | OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allows callers to read any Markdown files w… |
CVE-2026-44110 | High | 8.8 | 2026-05-06 | OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization that trusts DM pairing-store entries. Att… |
CVE-2026-44109 | Critical | 9.8 | 2026-05-06 | OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to… |
CVE-2026-43585 | High | 8.1 | 2026-05-06 | OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTT… |
CVE-2026-43584 | High | 8.8 | 2026-05-06 | OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows operator-supplied ove… |
CVE-2026-43583 | Medium | 5.3 | 2026-05-06 | OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay. Attackers can exploit recovered q… |
CVE-2026-43582 | Medium | 6.3 | 2026-05-06 | OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation… |
CVE-2026-43581 | Critical | 9.6 | 2026-05-06 | OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0… |
CVE-2026-43580 | High | 7.7 | 2026-05-06 | OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforc… |
CVE-2026-43579 | Medium | 6.5 | 2026-05-06 | OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permission… |
CVE-2026-43578 | Critical | 9.1 | 2026-05-06 | OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background asy… |
CVE-2026-43577 | Medium | 6.5 | 2026-05-06 | OpenClaw before 2026.4.9 contains a file read vulnerability allowing attackers to bypass navigation guards through browser act/evaluate interactions. Attackers… |
CVE-2026-43576 | High | 7.7 | 2026-05-06 | OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to unt… |