2026 CVEs (page 511)
Page 511 of 673 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-43119 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: annotate data-races around hdev->req_status __hci_cmd_sync_sk() sets… |
CVE-2026-43118 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix zero size inode with non-zero size after log replay When logging that an inode… |
CVE-2026-43117 | Critical | 9.1 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() If over… |
CVE-2026-43116 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ensure safe access to master conntrack Holding reference on the exp… |
CVE-2026-43115 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: srcu: Use irq_work to start GP in tiny SRCU Tiny SRCU's srcu_gp_start_if_needed() directl… |
CVE-2026-43114 | Critical | 9.4 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case f… |
CVE-2026-43113 | High | 8.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: wl1251: validate packet IDs before indexing tx_frames wl1251_tx_packet_cb() uses th… |
CVE-2026-43112 | High | 8.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath When cifs_sanitize_prepath… |
CVE-2026-43111 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: HID: roccat: fix use-after-free in roccat_report_event roccat_report_event() iterates ove… |
CVE-2026-43110 | High | 8.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validat… |
CVE-2026-43109 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: x86: shadow stacks: proper error handling for mmap lock 김영민 reports that shstk_pop_sigfra… |
CVE-2026-43108 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei It looks element lengt… |
CVE-2026-43107 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: xfrm: account XFRMA_IF_ID in aevent size calculation xfrm_get_ae() allocates the reply sk… |
CVE-2026-43106 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix incorrect dentry refcount in cachefiles_cull() The patch mentioned below… |
CVE-2026-43105 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Fix memory leak of BO array in hang state The hang state's BO array is allocated… |
CVE-2026-43104 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Fix a memory leak in hang state error path When vc4_save_hang_state() encounters… |
CVE-2026-43103 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: lapbether: handle NETDEV_PRE_TYPE_CHANGE lapbeth_data_transmit() expects the underly… |
CVE-2026-43102 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix memory leak in airoha_qdma_rx_process() If an error occurs on the subseq… |
CVE-2026-43101 | High | 7.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() We need to check… |
CVE-2026-43100 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: bridge: guard local VLAN-0 FDB helpers against NULL vlan group When CONFIG_BRIDGE_VLAN_FI… |
CVE-2026-43099 | High | 7.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: fix null-ptr-deref in icmp_build_probe() ipv6_stub->ipv6_dev_find() may retur… |
CVE-2026-43098 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: nfc: s3fwrn5: allocate rx skb before consuming bytes s3fwrn82_uart_read() reports the num… |
CVE-2026-43097 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: PCI: hv: Fix double ida_free in hv_pci_probe error path If hv_pci_probe() fails after sto… |
CVE-2026-43096 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: mshv: Fix infinite fault loop on permission-denied GPA intercepts Prevent infinite fault… |
CVE-2026-43095 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Fix errors in IRQ cleanup IRQs are enabled through sdca_irq_populate() from c… |
CVE-2026-43094 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ixgbevf: add missing negotiate_features op to Hyper-V ops table Commit a7075f501bd3 ("ixg… |
CVE-2026-43093 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: xsk: tighten UMEM headroom validation to account for tailroom and min frame The current h… |
CVE-2026-43092 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: xsk: validate MTU against usable frame size on bind AF_XDP bind currently accepts zero-co… |
CVE-2026-43091 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: xfrm: Wait for RCU readers during policy netns exit xfrm_policy_fini() frees the policy_b… |
CVE-2026-43090 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: xfrm: fix refcount leak in xfrm_migrate_policy_find syzkaller reported a memory leak in x… |
CVE-2026-43089 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_mapping() struct xfrm_usersa_id has a one-byte padding… |
CVE-2026-43088 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: af_key: zero aligned sockaddr tail in PF_KEY exports PF_KEY export paths use `pfkey_… |
CVE-2026-43087 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: mcp23s08: Disable all pin interrupts during probe A chip being probed may have t… |
CVE-2026-43086 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ipvs: fix NULL deref in ip_vs_add_service error path When ip_vs_bind_scheduler() succeeds… |
CVE-2026-43085 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator When batching mult… |
CVE-2026-43084 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: make hash table per queue Sharing a global hash table among a… |
CVE-2026-43083 | Critical | 9.1 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.b… |
CVE-2026-43082 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: txgbe: leave space for null terminators on property_entry Lists of struct property_e… |
CVE-2026-43081 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ Fix the field masks to match… |
CVE-2026-43080 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: l2tp: Drop large packets with UDP encap syzbot reported a WARN on my patch series [1]. Th… |
CVE-2026-43079 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Skip discovery table for offline dies This warning can be triggere… |
CVE-2026-43078 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl When page reassignmen… |
CVE-2026-43077 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Fix minimum RX size check for decryption The check for the minimum r… |
CVE-2026-43076 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline data i_size during inode read When reading an inode from disk, ocf… |
CVE-2026-43075 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2_write_end_inline KASAN reports a use-after-free w… |
CVE-2026-43074 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free… |
CVE-2026-42509 | Medium | 6.1 | 2026-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8… |
CVE-2026-40010 | Critical | 9.1 | 2026-05-06 | Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. T… |
CVE-2026-40001 | Medium | 5.2 | 2026-05-06 | There is a local privilege escalation vulnerability in the ZTE PROCESS Guard service of the cloud computer client, which may allow local arbitrary code executi… |
CVE-2026-35255 | Medium | 6.6 | 2026-05-06 | Vulnerability in the Oracle Cloud Native Environment Command Line Interface product of Oracle Open Source Projects. The supported versions that is affected is… |
CVE-2026-1719 | High | 7.5 | 2026-05-06 | The Gravity Bookings Premium plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.5.9 due to insufficient escaping on th… |
CVE-2026-7841 | High | 8.8 | 2026-05-06 | A remote code execution vulnerability exists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated user with System Setting permissions can ex… |
CVE-2026-7457 | Medium | 6.4 | 2026-05-06 | The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.5.0. This is due to insufficient input sa… |
CVE-2026-7332 | High | 7.2 | 2026-05-06 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_form_pag… |
CVE-2026-6672 | Medium | 6.4 | 2026-05-06 | The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up… |
CVE-2026-6344 | Medium | 4.9 | 2026-05-06 | The Fluent Forms plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 6.2.1. This is due to insufficient path validation i… |
CVE-2026-35254 | Medium | 6.1 | 2026-05-06 | Vulnerability in the Oracle OCI CLI product of Oracle Open Source Projects. The supported versions that is affected is 3.77. Easily exploitable vulnerability a… |
CVE-2026-35253 | Medium | 4.7 | 2026-05-06 | Vulnerability in the Oracle Macoron Tool product of Oracle Open Source Projects. The supported versions that is affected is v0.22.0. Easily exploitable vulnera… |
CVE-2026-23928 | Medium | 6.8 | 2026-05-06 | The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow… |
CVE-2026-23927 | Medium | 6.5 | 2026-05-06 | A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-co… |
CVE-2026-23926 | Medium | 6.8 | 2026-05-06 | An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that m… |
CVE-2026-2306 | Medium | 4.3 | 2026-05-06 | The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to unauthorized database table creation due to missing authorization checks on th… |
CVE-2026-5753 | Medium | 6.5 | 2026-05-06 | The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83. This is due… |
CVE-2026-3208 | Medium | 5.3 | 2026-05-06 | The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_im… |
CVE-2026-7573 | Medium | 5.0 | 2026-05-06 | An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 allows any authenticated low-privilege u… |
CVE-2026-7572 | Medium | 4.4 | 2026-05-06 | An off-by-one error (CWE-193) in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux a… |
CVE-2026-44405 | Low | 3.4 | 2026-05-06 | In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm. |
CVE-2026-40934 | Medium | 6.8 | 2026-05-05 | Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a st… |
CVE-2026-40110 | High | 7.3 | 2026-05-05 | Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check inco… |
CVE-2026-40075 | High | 7.5 | 2026-05-05 | OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the `/openmrs/moduleR… |
CVE-2026-28780 | Critical | 9.8 | 2026-05-05 | Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a… |
CVE-2026-41950 | Medium | 6.5 | 2026-05-05 | Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other… |
CVE-2026-40068 | High | 8.8 | 2026-05-05 | In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its contents. An… |
CVE-2026-39852 | High | 8.2 | 2026-05-05 | Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path nor… |
CVE-2026-39849 | High | 8.8 | 2026-05-05 | Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. In versions before 6.6.1, the `dns.interface` configuration fiel… |
CVE-2026-39402 | Medium | 6.5 | 2026-05-05 | lxc is a Linux container runtime. In the setuid helper lxc-user-nic, the delete path contains a logic flaw in the find_line() function that allows an unprivile… |
CVE-2026-39383 | High | 7.2 | 2026-05-05 | Gotenberg is an API-based document conversion tool. In version 8.29.1, an unauthenticated attacker with network access can force the server to make outbound HT… |
CVE-2026-35579 | Critical | 9.8 | 2026-05-05 | CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authenticat… |
CVE-2026-35527 | Medium | 5.0 | 2026-05-05 | Incus is an open source container and virtual machine manager. In versions prior to 7.0.0, the image import flow issues an outbound HEAD request to a user-supp… |
CVE-2026-7857 | High | 7.2 | 2026-05-05 | A vulnerability has been found in D-Link DI-8100 16.07.26A1. This vulnerability affects the function sprintf of the file /user_group.asp of the component CGI H… |
CVE-2026-7856 | High | 7.2 | 2026-05-05 | A flaw has been found in D-Link DI-8100 16.07.26A1. This affects an unknown part of the file /url_member.asp of the component Web Management Interface. Executi… |
CVE-2026-44331 | High | 8.1 | 2026-05-05 | In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inj… |
CVE-2026-40331 | | 2026-05-05 | Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, the… | |
CVE-2026-40330 | | 2026-05-05 | Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, a SQ… | |
CVE-2026-40329 | | 2026-05-05 | Masa CMS is an open source content management system. In versions 7.5.2 and earlier, a SQL injection vulnerability exists in the beanFeed.cfc component within… | |
CVE-2026-40280 | High | 7.5 | 2026-05-05 | Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-dow… |
CVE-2026-38947 | Medium | 6.1 | 2026-05-05 | FluentCMS 1.2.3 is vulnerable to Cross Site Scripting (XSS) in TextHTML plugin. |
CVE-2026-35453 | Medium | 5.4 | 2026-05-05 | PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through… |
CVE-2026-35397 | High | 8.8 | 2026-05-05 | Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authentica… |
CVE-2026-34596 | High | 7.0 | 2026-05-05 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a Time-of-Check-to-Time-of-Use (TOCTOU) race con… |
CVE-2026-34527 | Medium | 5.3 | 2026-05-05 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, SbieIniServer::HashPassword converts a SHA-1 dig… |
CVE-2026-34464 | High | 8.8 | 2026-05-05 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, NamedPipeServer::OpenHandler copies the server f… |
CVE-2026-34462 | High | 7.8 | 2026-05-05 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, several ProcessServer handlers (KillAllHandler… |
CVE-2026-34461 | High | 7.8 | 2026-05-05 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieIniServer RunSbieCtrl handler contains a… |
CVE-2026-34459 | High | 8.8 | 2026-05-05 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieSvc proxy service's GetRawInputDeviceInf… |
CVE-2026-34458 | High | 8.8 | 2026-05-05 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows any standa… |
CVE-2026-34084 | Critical | 9.8 | 2026-05-05 | PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through… |
CVE-2026-33975 | | 2026-05-05 | Twenty is an open source CRM built with NestJS (Node.js). In versions 1.18.0 and earlier, the SSRF protection in twenty-server's SecureHttpClientService can be… | |
CVE-2026-33489 | High | 7.5 | 2026-05-05 | CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a mor… |
CVE-2026-33420 | Medium | 5.3 | 2026-05-05 | Vaultwarden is a Bitwarden-compatible server written in Rust. In version 1.35.4 and earlier, the get_org_collections_details endpoint (GET /api/organizations/{… |