2026 CVEs (page 51)
Page 51 of 662 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-94488 | High | 8.2 | 2026-09-21 | Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_ht… |
CVE-2026-93012 | Critical | 9.8 | 2026-09-21 | Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches… |
CVE-2026-92382 | Medium | 4.1 | 2026-09-21 | An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer per… |
CVE-2026-69190 | Medium | 6.3 | 2026-09-21 | Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a… |
CVE-2026-62369 | High | 8.1 | 2026-09-21 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2… |
CVE-2026-62182 | High | 8.8 | 2026-09-21 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2… |
CVE-2026-61745 | Medium | 4.3 | 2026-09-21 | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py u… |
CVE-2026-61612 | Medium | 5.7 | 2026-09-21 | CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard `validateServerUrl` (added for CVE-2026-33060, extended… |
CVE-2026-55473 | | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets and BlockCloudMetadata notifier SSRF protections in backend… | |
CVE-2026-48976 | High | 8.1 | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifi… |
CVE-2026-48975 | High | 8.1 | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/intern… |
CVE-2026-48974 | Medium | 5.4 | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a c… |
CVE-2026-48826 | High | 8.1 | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1_ctrl_actions.go authorizes POST /v1… |
CVE-2026-94449 | High | 7.5 | 2026-09-21 | A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. T… |
CVE-2026-84990 | High | 8.8 | 2026-09-21 | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and… |
CVE-2026-83621 | High | 8.1 | 2026-09-21 | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scripts/lua/rest/v2/edit… |
CVE-2026-79920 | Critical | 9.9 | 2026-09-21 | Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, Un… |
CVE-2026-77582 | | 2026-09-21 | Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempt… | |
CVE-2026-77561 | Medium | 5.3 | 2026-09-21 | Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 dist… |
CVE-2026-77560 | High | 8.1 | 2026-09-21 | Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equi… |
CVE-2026-76898 | | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Lo… | |
CVE-2026-63416 | Low | 3.7 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses req… |
CVE-2026-63373 | Medium | 4.2 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/Ab… |
CVE-2026-63334 | Medium | 6.8 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-s… |
CVE-2026-63116 | High | 8.8 | 2026-09-21 | deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/perm… |
CVE-2026-62987 | Medium | 5.8 | 2026-09-21 | Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses p… |
CVE-2026-62866 | Medium | 6.2 | 2026-09-21 | Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCu… |
CVE-2026-62371 | High | 8.8 | 2026-09-21 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2… |
CVE-2026-62370 | Medium | 6.5 | 2026-09-21 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2… |
CVE-2026-61674 | | 2026-09-21 | Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/out_forward/forwa… | |
CVE-2026-59168 | Medium | 6.2 | 2026-09-21 | Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decode… |
CVE-2026-58504 | Medium | 6.1 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-… |
CVE-2026-17051 | Medium | 6.0 | 2026-09-21 | The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). It read the peer-wri… |
CVE-2026-17050 | Medium | 5.7 | 2026-09-21 | The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_c… |
CVE-2026-88978 | Medium | 4.3 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pk… |
CVE-2026-85751 | Critical | 9.8 | 2026-09-21 | Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH… |
CVE-2026-84298 | Low | 3.1 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores… |
CVE-2026-82412 | High | 8.8 | 2026-09-21 | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua an… |
CVE-2026-77166 | Low | 2.4 | 2026-09-21 | The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes bro… |
CVE-2026-77165 | Medium | 6.5 | 2026-09-21 | File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database. |
CVE-2026-63342 | Medium | 6.3 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-r… |
CVE-2026-61687 | High | 7.1 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state… |
CVE-2026-61681 | Medium | 4.1 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler i… |
CVE-2026-55563 | | 2026-09-21 | Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/pr_integration_tests.yml uses pull_request_target with t… | |
CVE-2026-53940 | High | 8.8 | 2026-09-21 | Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_entry_point_def in co… |
CVE-2026-36472 | Medium | 5.2 | 2026-09-21 | CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __referer value 2.0.1 allows a remote attacker to execute arbitrar… |
CVE-2026-36471 | Medium | 5.8 | 2026-09-21 | Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into i… |
CVE-2026-36470 | Medium | 5.8 | 2026-09-21 | CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unesca… |
CVE-2026-36469 | Critical | 9.1 | 2026-09-21 | CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionali… |
CVE-2026-36468 | Medium | 6.1 | 2026-09-21 | Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part… |
CVE-2026-36467 | High | 7.2 | 2026-09-21 | Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manage… |
CVE-2026-94301 | Critical | 9.8 | 2026-09-21 | The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 an… |
CVE-2026-94184 | Medium | 5.3 | 2026-09-21 | A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication… |
CVE-2026-93339 | Medium | 5.4 | 2026-09-21 | Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-lev… |
CVE-2026-86473 | Critical | 9.1 | 2026-09-21 | Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as a… |
CVE-2026-82355 | Medium | 4.2 | 2026-09-21 | When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie… |
CVE-2026-80110 | High | 8.1 | 2026-09-21 | A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string c… |
CVE-2026-75939 | High | 7.4 | 2026-09-21 | A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors befo… |
CVE-2026-75158 | Medium | 4.3 | 2026-09-21 | Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authoriz… |
CVE-2026-71543 | | 2026-09-21 | OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled i… | |
CVE-2026-68919 | | 2026-09-21 | GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic th… | |
CVE-2026-61630 | Medium | 4.2 | 2026-09-21 | nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reuse… |
CVE-2026-61629 | High | 7.5 | 2026-09-21 | nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in… |
CVE-2026-61628 | High | 8.1 | 2026-09-21 | nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthent… |
CVE-2026-55870 | | 2026-09-21 | GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control… | |
CVE-2026-55625 | Medium | 4.9 | 2026-09-21 | GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/i… |
CVE-2026-55567 | High | 7.8 | 2026-09-21 | BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent dir… |
CVE-2026-55074 | | 2026-09-21 | Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's put… | |
CVE-2026-55071 | High | 8.4 | 2026-09-21 | MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_install MCP tool in s… |
CVE-2026-55060 | Low | 3.7 | 2026-09-21 | GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended administrator-only autho… |
CVE-2026-54584 | | 2026-09-21 | mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid… | |
CVE-2026-52743 | Medium | 4.3 | 2026-09-21 | GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belong… |
CVE-2026-52742 | | 2026-09-21 | GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/* expose historical full server configuration to pipeline… | |
CVE-2026-52741 | | 2026-09-21 | GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenie… | |
CVE-2026-52740 | | 2026-09-21 | GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authoriza… | |
CVE-2026-94404 | | 2026-09-21 | MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving t… | |
CVE-2026-94401 | | 2026-09-21 | MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importi… | |
CVE-2026-94394 | | 2026-09-21 | When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whe… | |
CVE-2026-94393 | | 2026-09-21 | When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actual… | |
CVE-2026-94387 | Medium | 5.4 | 2026-09-21 | Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered… |
CVE-2026-94382 | Medium | 4.2 | 2026-09-21 | Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authent… |
CVE-2026-88807 | | 2026-09-21 | A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. | |
CVE-2026-88806 | High | 7.5 | 2026-09-21 | A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map. |
CVE-2026-85220 | Low | 3.7 | 2026-09-21 | A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeyp… |
CVE-2026-94383 | | 2026-09-21 | The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied w… | |
CVE-2026-94381 | | 2026-09-21 | MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someone view infor… | |
CVE-2026-94379 | | 2026-09-21 | The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code us… | |
CVE-2026-94374 | | 2026-09-21 | MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the… | |
CVE-2026-94373 | | 2026-09-21 | MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML <option… | |
CVE-2026-94372 | | 2026-09-21 | MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or defa… | |
CVE-2026-94216 | Medium | 4.3 | 2026-09-21 | A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution. This vulnerability affects unknown code of the file /autho… |
CVE-2026-94214 | Medium | 4.3 | 2026-09-21 | A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the component Lo… |
CVE-2026-94211 | Low | 2.4 | 2026-09-21 | A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/… |
CVE-2026-84285 | High | 8.8 | 2026-09-21 | An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the s… |
CVE-2026-94368 | High | 7.1 | 2026-09-21 | A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the serv… |
CVE-2026-94210 | Low | 3.5 | 2026-09-21 | A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Ticke… |
CVE-2026-91867 | Medium | 4.3 | 2026-09-21 | When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fe… |
CVE-2026-91866 | High | 7.5 | 2026-09-21 | A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (deni… |
CVE-2026-91865 | High | 7.5 | 2026-09-21 | A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming hug… |
CVE-2026-91864 | High | 7.5 | 2026-09-21 | A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its si… |