2026 CVEs (page 52)
Page 52 of 662 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-91863 | High | 7.5 | 2026-09-21 | A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the pa… |
CVE-2026-89139 | | 2026-09-21 | Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose funct… | |
CVE-2026-87858 | | 2026-09-21 | Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only writ… | |
CVE-2026-65654 | | 2026-09-21 | github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not appl… | |
CVE-2026-65653 | | 2026-09-21 | github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment read… | |
CVE-2026-65652 | | 2026-09-21 | github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener c… | |
CVE-2026-65651 | | 2026-09-21 | temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an app… | |
CVE-2026-16652 | | 2026-09-21 | Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission cou… | |
CVE-2026-16651 | | 2026-09-21 | temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to fi… | |
CVE-2026-92612 | | 2026-09-21 | In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts tho… | |
CVE-2026-77021 | | 2026-09-21 | Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a h… | |
CVE-2026-94277 | | 2026-09-21 | MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any H… | |
CVE-2026-92574 | High | 8.8 | 2026-09-21 | A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes sec… |
CVE-2026-91921 | | 2026-09-21 | Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unaut… | |
CVE-2026-94152 | Medium | 4.3 | 2026-09-21 | A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the compone… |
CVE-2026-94151 | Medium | 5.3 | 2026-09-21 | A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the compone… |
CVE-2026-94150 | Low | 2.4 | 2026-09-21 | A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the compon… |
CVE-2026-92400 | Medium | 5.3 | 2026-09-21 | The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's… |
CVE-2026-86802 | Low | 3.7 | 2026-09-21 | The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetc… |
CVE-2026-85113 | Medium | 6.5 | 2026-09-21 | The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortc… |
CVE-2026-85010 | Medium | 5.3 | 2026-09-21 | The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in th… |
CVE-2026-15801 | High | 8.0 | 2026-09-21 | A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint arch… |
CVE-2026-94149 | Medium | 4.3 | 2026-09-21 | A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of… |
CVE-2026-94148 | Medium | 5.3 | 2026-09-21 | A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the compone… |
CVE-2026-47321 | High | 7.5 | 2026-09-21 | The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting s… |
CVE-2026-94218 | Low | 3.1 | 2026-09-21 | A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enfor… |
CVE-2026-94217 | Low | 3.5 | 2026-09-21 | A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission t… |
CVE-2026-94215 | Medium | 5.5 | 2026-09-21 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request… |
CVE-2026-94213 | Medium | 4.9 | 2026-09-21 | A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy ev… |
CVE-2026-94146 | High | 8.8 | 2026-09-21 | A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys of the component IOCTL… |
CVE-2026-94145 | Low | 3.5 | 2026-09-21 | A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/jo… |
CVE-2026-94144 | High | 7.3 | 2026-09-21 | A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library orm_lib/src/Criteria.cc of the component OR… |
CVE-2026-90860 | High | 7.1 | 2026-09-21 | The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor w… |
CVE-2026-82187 | Critical | 9.8 | 2026-09-21 | The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those… |
CVE-2026-94143 | High | 7.3 | 2026-09-21 | A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the comp… |
CVE-2026-94142 | High | 8.8 | 2026-09-21 | A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. Affected by this vulnerability is the function sub_1105C of th… |
CVE-2026-94139 | High | 7.4 | 2026-09-21 | A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /send_ord… |
CVE-2026-94138 | Medium | 6.6 | 2026-09-21 | A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /se… |
CVE-2026-94137 | Low | 3.3 | 2026-09-21 | A vulnerability was identified in Hangzhou Shunwang Technology shzh 10.7.2.693. This affects the function sub_180004AC0 of the file shdrv_x64.sys of the compon… |
CVE-2026-94185 | Medium | 5.5 | 2026-09-21 | nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto th… |
CVE-2026-94129 | High | 8.8 | 2026-09-21 | A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. This vulnerability affects the function sub_1105C of the file BS_RVSIO64.sys of the com… |
CVE-2026-94128 | High | 8.8 | 2026-09-21 | A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects the function sub_1105C of the file BS_LED64.sys of the component… |
CVE-2026-94110 | High | 7.3 | 2026-09-21 | A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function self_Tmp in the library Lib/Config/Controllers.php of the compo… |
CVE-2026-94103 | Medium | 4.7 | 2026-09-21 | A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of the file roocms/site_pagePHP.php of the component Frontend… |
CVE-2026-94102 | Medium | 4.3 | 2026-09-21 | A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulati… |
CVE-2026-94101 | Critical | 9.9 | 2026-09-21 | A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlan_load_form_uci of the file /usr/bin/… |
CVE-2026-94100 | Critical | 9.9 | 2026-09-21 | A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. Impacted is the function wan_config_set_vlan of the file /usr/bin/routerd of the componen… |
CVE-2026-94099 | Critical | 9.9 | 2026-09-21 | A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of the file restore.cgi of the component… |
CVE-2026-94098 | Critical | 9.1 | 2026-09-21 | A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component… |
CVE-2026-94097 | Critical | 10.0 | 2026-09-21 | A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI… |
CVE-2026-94096 | Critical | 9.9 | 2026-09-21 | A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the… |
CVE-2026-94095 | Critical | 9.9 | 2026-09-21 | A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_t… |
CVE-2026-94094 | Medium | 4.3 | 2026-09-20 | A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the comp… |
CVE-2026-94093 | Medium | 6.3 | 2026-09-20 | A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/load_replay_buffer/VecNormalize.load of… |
CVE-2026-94092 | Medium | 5.5 | 2026-09-20 | A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file utils.py. Performing a manipulation of t… |
CVE-2026-94091 | Medium | 5.5 | 2026-09-20 | A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file gensim/utils.py of the component Model Lo… |
CVE-2026-94090 | Medium | 6.3 | 2026-09-20 | A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::_parse_debug of the file manape/pe.cpp of the compo… |
CVE-2026-94089 | Critical | 10.0 | 2026-09-20 | A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfa_authentication.cgi of the component Authen… |
CVE-2026-94051 | Medium | 6.3 | 2026-09-20 | A vulnerability was found in 0717376 cowork_bench up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d. Affected by this vulnerability is the function ControlFlowNod… |
CVE-2026-94050 | Medium | 4.3 | 2026-09-20 | A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfg_get/routerd.get_rand_key of the compone… |
CVE-2026-94049 | Medium | 4.3 | 2026-09-20 | A flaw has been found in 06ketan slideshot up to 4.4.0. This impacts the function render_slides of the file packages/cli/src/renderer.ts. This manipulation of… |
CVE-2026-94048 | Medium | 6.6 | 2026-09-20 | A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of the file app/Controllers/UserController.p… |
CVE-2026-94047 | Medium | 6.3 | 2026-09-20 | A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function importTemplate of the file src/services/temp… |
CVE-2026-94046 | Medium | 4.3 | 2026-09-20 | A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. The affected element is the function get_file_snippet of the file getFileSnippet.ts of t… |
CVE-2026-94045 | Low | 3.5 | 2026-09-20 | A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java… |
CVE-2026-94044 | High | 7.3 | 2026-09-20 | A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affects the function create_file of the file… |
CVE-2026-94043 | Medium | 5.3 | 2026-09-20 | A vulnerability was determined in Free5GC up to 4.2.3. This vulnerability affects unknown code of the file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handle… |
CVE-2026-94042 | Medium | 6.3 | 2026-09-20 | A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query… |
CVE-2026-94041 | Medium | 6.3 | 2026-09-20 | A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is some un… |
CVE-2026-88857 | | 2026-09-20 | Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions save… | |
CVE-2026-88856 | | 2026-09-20 | Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions upda… | |
CVE-2026-88855 | | 2026-09-20 | Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveGallery(… | |
CVE-2026-88854 | | 2026-09-20 | Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and… | |
CVE-2026-94040 | Medium | 5.3 | 2026-09-20 | A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/(app)/apps/settings/… |
CVE-2026-94039 | High | 7.3 | 2026-09-20 | A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoicePDF of the file /apps/invoices/actions.ts of the component… |
CVE-2026-94038 | High | 7.3 | 2026-09-20 | A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component D… |
CVE-2026-94037 | Medium | 4.3 | 2026-09-20 | A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. This affects the function ControlFlowNode of the… |
CVE-2026-94036 | High | 8.8 | 2026-09-20 | A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus… |
CVE-2026-94035 | Medium | 4.3 | 2026-09-20 | A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the file /drug_recommender/index.php. Execu… |
CVE-2026-94034 | Low | 3.5 | 2026-09-20 | A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drug_recommender/Admin/chan… |
CVE-2026-94033 | Low | 3.5 | 2026-09-20 | A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drug_recommender/Admin/ad… |
CVE-2026-94032 | Medium | 6.3 | 2026-09-20 | A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of… |
CVE-2026-94031 | Medium | 6.3 | 2026-09-20 | A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function child_process.exec of the… |
CVE-2026-94030 | Low | 3.1 | 2026-09-20 | A security vulnerability has been detected in SerenityOS up to 3d83e4509fd20d7438e1ae8470ffe668c136229c. Affected by this vulnerability is the function decode_… |
CVE-2026-94028 | Medium | 4.3 | 2026-09-20 | A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the file mealie/routes/households/controll… |
CVE-2026-94016 | Low | 2.4 | 2026-09-20 | A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drug_recommender/Admin/add_… |
CVE-2026-94015 | High | 7.3 | 2026-09-20 | A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file /drug_recommender/Admin/edit_user… |
CVE-2026-92254 | | 2026-09-20 | Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Mic… | |
CVE-2026-92253 | | 2026-09-20 | Improper link resolution before file access in the quarantine restoration process of WatchDog Anti-Virus 1.8.640 on Windows allows local, low-privileged attack… | |
CVE-2026-92252 | | 2026-09-20 | Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete a… | |
CVE-2026-90817 | Critical | 9.8 | 2026-09-20 | An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user… |
CVE-2026-94113 | Medium | 6.5 | 2026-09-20 | Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to… |
CVE-2026-94112 | Medium | 6.8 | 2026-09-20 | mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Att… |
CVE-2026-94111 | Medium | 6.6 | 2026-09-20 | Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-exte… |
CVE-2026-94109 | High | 8.0 | 2026-09-20 | openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows… |
CVE-2026-94108 | Medium | 6.5 | 2026-09-20 | getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on… |
CVE-2026-94107 | High | 8.1 | 2026-09-20 | NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(m… |
CVE-2026-94106 | High | 8.8 | 2026-09-20 | getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft… |
CVE-2026-94105 | Medium | 5.3 | 2026-09-20 | NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to… |
CVE-2026-94104 | High | 8.8 | 2026-09-20 | NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new file… |