2026 CVEs (page 512)
Page 512 of 673 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-38428 | Critical | 9.8 | 2026-05-05 | Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated i… |
CVE-2026-31835 | Medium | 5.4 | 2026-05-05 | Vaultwarden is a Bitwarden-compatible server written in Rust. In versions 1.35.4 and earlier, the WebAuthn authentication flow in `validate_webauthn_login()` u… |
CVE-2026-30923 | High | 7.5 | 2026-05-05 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecuri… |
CVE-2026-27960 | Critical | 9.8 | 2026-05-05 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege esc… |
CVE-2026-7853 | Critical | 9.8 | 2026-05-05 | A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.asp of the component HTTP Handler. This… |
CVE-2026-7851 | High | 7.2 | 2026-05-05 | A vulnerability was identified in D-Link DI-8100 16.07.26A1. This affects the function sprintf of the file yyxz.asp. The manipulation of the argument ID leads… |
CVE-2026-7847 | Low | 2.6 | 2026-05-05 | A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-serve… |
CVE-2026-43002 | Medium | 5.3 | 2026-05-05 | An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and t… |
CVE-2026-38432 | Medium | 6.1 | 2026-05-05 | ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email temp… |
CVE-2026-38431 | Critical | 9.8 | 2026-05-05 | ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject t… |
CVE-2026-38429 | Critical | 9.8 | 2026-05-05 | OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files contai… |
CVE-2026-25589 | High | 8.8 | 2026-05-05 | RedisBloom is a probabilistic data structures module for Redis. In all versions of RedisBloom before 2.8.20, the module does not properly validate serialized v… |
CVE-2026-25588 | High | 8.8 | 2026-05-05 | RedisTimeSeries is a time-series module for Redis. In all versions before 1.12.14 of RedisTimeSeries, the module does not properly validate serialized values p… |
CVE-2026-25243 | High | 8.8 | 2026-05-05 | Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authe… |
CVE-2026-23631 | High | 8.1 | 2026-05-05 | Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchr… |
CVE-2026-23479 | High | 8.8 | 2026-05-05 | Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processComman… |
CVE-2026-7865 | | 2026-05-05 | A hidden console command is vulnerable to command injection flaw when control characters are passed to its second argument. A third party researcher Eugene L… | |
CVE-2026-7846 | Low | 2.6 | 2026-05-05 | A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-server/chatchat/ser… |
CVE-2026-7845 | Low | 2.6 | 2026-05-05 | A flaw has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. This issue affects the function PIL.Image.tobytes of the file libs/chatchat-server/ch… |
CVE-2026-7844 | Medium | 6.3 | 2026-05-05 | A vulnerability was detected in chatchat-space Langchain-Chatchat up to 0.3.1.3. This vulnerability affects the function files/list_files/retrieve_file/retriev… |
CVE-2026-7412 | High | 8.6 | 2026-05-05 | In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requ… |
CVE-2026-7411 | Critical | 10.0 | 2026-05-05 | In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote… |
CVE-2026-6907 | Medium | 4.3 | 2026-05-05 | An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary`… |
CVE-2026-5766 | Medium | 5.3 | 2026-05-05 | An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPL… |
CVE-2026-43073 | Medium | 5.5 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: x86-64: rename misleadingly named '__copy_user_nocache()' function This function was a ma… |
CVE-2026-43072 | Medium | 5.5 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: platform_get_irq_byname() returns an int platform_get_irq_byname() will return a… |
CVE-2026-43071 | Critical | 9.1 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: dcache: Limit the minimal number of bucket to two There is an OOB read problem on dentry_… |
CVE-2026-43070 | High | 7.8 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register ID for BPF_END value tracking When a register undergoes a BPF_END (by… |
CVE-2026-43069 | Medium | 5.5 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_ll: Fix firmware leak on error path Smatch reports: drivers/bluetooth/hci… |
CVE-2026-43068 | Medium | 5.5 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() There's issue a… |
CVE-2026-43067 | Critical | 9.8 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: ext4: handle wraparound when searching for blocks for indirect mapped blocks Commit 4865c… |
CVE-2026-43066 | Medium | 5.5 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths During code review, Joseph f… |
CVE-2026-43065 | Medium | 5.5 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: ext4: always drain queued discard work in ext4_mb_release() While reviewing recent ext4 p… |
CVE-2026-43064 | Medium | 5.5 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix not releasing workqueue on .release() The workqueue associated with… |
CVE-2026-43063 | High | 7.8 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: xfs: don't irele after failing to iget in xfs_attri_recover_work xlog_recovery_iget* neve… |
CVE-2026-43062 | High | 7.1 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() l2cap_ecred_reconf_rsp()… |
CVE-2026-43061 | Medium | 5.5 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Fix TX deadlock when using DMA `dmaengine_terminate_async` does not guarant… |
CVE-2026-43060 | High | 7.8 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: drop pending enqueued packets on removal Packets sitting in nfqueue mi… |
CVE-2026-43059 | High | 7.8 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Commit 302a1f67… |
CVE-2026-39103 | Medium | 5.5 | 2026-05-05 | Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scene… |
CVE-2026-35192 | Medium | 6.5 | 2026-05-05 | An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVER… |
CVE-2026-34956 | Medium | 5.9 | 2026-05-05 | A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can se… |
CVE-2026-34002 | Medium | 6.1 | 2026-05-05 | A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker wi… |
CVE-2026-34000 | Medium | 6.1 | 2026-05-05 | A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `Xkb… |
CVE-2026-32689 | | 2026-05-05 | Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix allows a denial of service via the long-poll transport's NDJSON… | |
CVE-2026-31196 | High | 8.8 | 2026-05-05 | OS command injection vulnerability in the traceroute diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre Router with firmware… |
CVE-2026-31195 | High | 8.8 | 2026-05-05 | OS command injection vulnerability in the ping diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre Router with firmware 3GN80… |
CVE-2026-7834 | Critical | 9.8 | 2026-05-05 | A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24. This issue affects the function get_csrf_whites of the file /cgi/advanced/misc_main.c… |
CVE-2026-7778 | Medium | 5.0 | 2026-05-05 | An issue that could allow a dashboard configuration to be viewed from outside of the authorized organization scope has been resolved. This is an instance of CW… |
CVE-2026-4304 | High | 7.5 | 2026-05-05 | The WeePie Cookie Allow plugin for WordPress is vulnerable to SQL Injection via the 'consent' parameter in all versions up to, and including, 3.4.11 due to ins… |
CVE-2026-36356 | Critical | 9.1 | 2026-05-05 | The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /actio… |
CVE-2026-36355 | High | 7.7 | 2026-05-05 | The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access control checks on the wri… |
CVE-2026-34408 | Critical | 9.1 | 2026-05-05 | An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0). The password reset function can be bypassed to set arbitrar… |
CVE-2026-29168 | High | 7.3 | 2026-05-05 | Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data. This issue affects Apache HTTP Serv… |
CVE-2026-7833 | High | 7.2 | 2026-05-05 | A weakness has been identified in EFM ipTIME C200 up to 1.092. This vulnerability affects the function sub_408F90 of the file /cgi/iux_set.cgi of the component… |
CVE-2026-7832 | High | 7.0 | 2026-05-05 | A security flaw has been discovered in IObit Advanced SystemCare 19. This affects an unknown part of the file ASC.exe of the component Service. The manipulatio… |
CVE-2026-6918 | High | 7.5 | 2026-05-05 | In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message. |
CVE-2026-30246 | Medium | 6.5 | 2026-05-05 | Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware uses only the request… |
CVE-2026-28510 | Medium | 5.9 | 2026-05-05 | eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication… |
CVE-2026-27694 | Medium | 5.4 | 2026-05-05 | Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-c… |
CVE-2026-27693 | Medium | 5.4 | 2026-05-05 | Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes de… |
CVE-2026-27644 | Medium | 6.5 | 2026-05-05 | Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-control… |
CVE-2026-6262 | Medium | 6.5 | 2026-05-05 | The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the upload_icons() function wor… |
CVE-2026-6261 | High | 8.8 | 2026-05-05 | The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workf… |
CVE-2026-43574 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as exp… |
CVE-2026-43573 | High | 7.7 | 2026-05-05 | OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypa… |
CVE-2026-43572 | Medium | 5.3 | 2026-05-05 | OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender… |
CVE-2026-43571 | High | 8.8 | 2026-05-05 | OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bun… |
CVE-2026-43570 | Medium | 6.5 | 2026-05-05 | OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to e… |
CVE-2026-43569 | High | 8.8 | 2026-05-05 | OpenClaw before 2026.4.9 contains an authentication bypass vulnerability allowing untrusted workspace plugins to be auto-enabled during non-interactive onboard… |
CVE-2026-43568 | Medium | 6.5 | 2026-05-05 | OpenClaw versions 2026.4.5 before 2026.4.10 contain a privilege escalation vulnerability allowing write-scoped operators to modify persistent memory dreaming s… |
CVE-2026-43567 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards… |
CVE-2026-43566 | Critical | 9.1 | 2026-05-05 | OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carryi… |
CVE-2026-43535 | Medium | 6.8 | 2026-05-05 | OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to in… |
CVE-2026-43534 | Critical | 9.1 | 2026-05-05 | OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can… |
CVE-2026-43533 | High | 8.6 | 2026-05-05 | OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the int… |
CVE-2026-43532 | High | 7.7 | 2026-05-05 | OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media norm… |
CVE-2026-43531 | High | 7.3 | 2026-05-05 | OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Att… |
CVE-2026-43530 | High | 8.8 | 2026-05-05 | OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that allows attacker… |
CVE-2026-43529 | Low | 2.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to byp… |
CVE-2026-43528 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfi… |
CVE-2026-43527 | High | 7.7 | 2026-05-05 | OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attack… |
CVE-2026-43526 | High | 8.2 | 2026-05-05 | OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary conte… |
CVE-2026-42439 | High | 8.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can… |
CVE-2026-42438 | High | 7.7 | 2026-05-05 | OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthor… |
CVE-2026-42437 | High | 7.5 | 2026-05-05 | OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames w… |
CVE-2026-42436 | High | 7.7 | 2026-05-05 | OpenClaw before 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab routes that fail to consistently validate… |
CVE-2026-42435 | High | 8.8 | 2026-05-05 | OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variab… |
CVE-2026-42434 | High | 8.8 | 2026-05-05 | OpenClaw versions 2026.4.5 before 2026.4.10 contain a sandbox escape vulnerability allowing sandboxed agents to override exec routing by specifying host=node… |
CVE-2026-42433 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requir… |
CVE-2026-6322 | High | 7.5 | 2026-05-05 | fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A… |
CVE-2026-43870 | High | 7.3 | 2026-05-05 | Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Head… |
CVE-2026-43868 | Medium | 5.3 | 2026-05-05 | Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade… |
CVE-2026-3601 | Medium | 4.3 | 2026-05-05 | The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `embed_form… |
CVE-2026-3359 | High | 7.5 | 2026-05-05 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in ve… |
CVE-2026-43869 | High | 7.3 | 2026-05-05 | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended… |
CVE-2026-7824 | | 2026-05-05 | An issue was discovered in the PaperCut Hive Ricoh embedded application. When the "Deep Logging" (diagnostic) mode is enabled, the application inadvertently re… | |
CVE-2026-6418 | Medium | 4.9 | 2026-05-05 | An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configu… |
CVE-2026-6180 | High | 8.1 | 2026-05-05 | A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving drop… |
CVE-2026-5192 | High | 7.5 | 2026-05-05 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Path Traversal in versions up to, and including… |