2026 CVEs (page 525)
Page 525 of 669 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-7039 | High | 7.8 | 2026-04-26 | A security vulnerability has been detected in tufantunc ssh-mcp up to 1.5.0. The affected element is the function shell.write of the file src/index.ts. Such ma… |
CVE-2026-7038 | Low | 3.3 | 2026-04-26 | A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler… |
CVE-2026-7037 | Critical | 9.8 | 2026-04-26 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-7036 | High | 7.3 | 2026-04-26 | A vulnerability was identified in Tenda i9 1.0.0.5(2204). This vulnerability affects the function R7WebsSecurityHandlerfunction of the component HTTP Handler… |
CVE-2026-7035 | High | 8.8 | 2026-04-26 | A vulnerability was determined in Tenda FH1202 1.2.0.14. This affects the function fromWrlclientSet of the file /goform/WrlclientSet of the component httpd. Ex… |
CVE-2026-7034 | High | 8.8 | 2026-04-26 | A vulnerability was found in Tenda FH1202 1.2.0.14(408). Affected by this issue is the function WrlExtraSet of the file /goform/WrlExtraSet of the component ht… |
CVE-2026-7033 | High | 8.8 | 2026-04-26 | A vulnerability has been found in Tenda F456 1.0.0.5. Affected by this vulnerability is the function fromSafeClientFilter of the file /goform/SafeClientFilter… |
CVE-2026-7032 | High | 8.8 | 2026-04-26 | A flaw has been found in Tenda F456 1.0.0.5. Affected is the function SafeEmailFilter of the file /goform/SafeEmailFilter. This manipulation of the argument pa… |
CVE-2026-7031 | High | 8.8 | 2026-04-26 | A vulnerability was detected in Tenda F456 1.0.0.5. This impacts the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the argu… |
CVE-2026-7030 | High | 8.8 | 2026-04-26 | A security vulnerability has been detected in Tenda F456 1.0.0.5. This affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation o… |
CVE-2026-7029 | High | 8.8 | 2026-04-26 | A weakness has been identified in Tenda F456 1.0.0.5. The impacted element is the function fromaddressNat of the file /goform/addressNat. Executing a manipulat… |
CVE-2026-7028 | Medium | 4.7 | 2026-04-26 | A security flaw has been discovered in CodeAstro Online Job Portal 1.0. The affected element is an unknown function of the file /admin/jobs-admins/delete-jobs… |
CVE-2026-7027 | Low | 2.4 | 2026-04-26 | A vulnerability was identified in D-Link DSL-2740R EU_01.15. Impacted is an unknown function of the component Wireless Setup Section. Such manipulation of the… |
CVE-2026-7026 | Medium | 4.5 | 2026-04-26 | A vulnerability was determined in D-Link DGS-3420 1.50.018. This issue affects some unknown processing of the component System Information Settings Page. This… |
CVE-2026-7025 | High | 7.3 | 2026-04-26 | A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the com… |
CVE-2026-7024 | Medium | 5.4 | 2026-04-26 | A flaw has been found in rawchen sims up to 004f783b1db5ecdfad81c8fdc3b34171211112de. Affected by this issue is some unknown functionality of the file sims-mas… |
CVE-2026-7023 | Medium | 6.3 | 2026-04-26 | A vulnerability was detected in ByteDance coze-studio up to 0.5.1. Affected by this vulnerability is the function ExecuteSQL of the file backend/domain/memory/… |
CVE-2026-7022 | High | 7.3 | 2026-04-26 | A security vulnerability has been detected in SmythOS sre up to 0.0.15. Affected is the function AgentRuntime of the file packages/core/src/subsystems/AgentMan… |
CVE-2026-7021 | Low | 3.5 | 2026-04-26 | A weakness has been identified in SmythOS sre up to 0.0.15. This impacts an unknown function of the file packages/sdk/src/LLM/utils.ts of the component Connect… |
CVE-2026-7020 | Low | 3.7 | 2026-04-26 | A security flaw has been discovered in Ollama up to 0.20.2. This affects the function digestToPath of the file x/imagegen/transfer/transfer.go of the component… |
CVE-2026-7019 | High | 8.8 | 2026-04-26 | A vulnerability was identified in Tenda F456 1.0.0.5. The impacted element is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulatio… |
CVE-2026-7018 | Medium | 5.6 | 2026-04-26 | A vulnerability was determined in Datavane Datavines up to 13607645e14a4982468cfdbcf75c85cde63bae71. The affected element is an unknown function of the file da… |
CVE-2026-7016 | Low | 2.4 | 2026-04-26 | A vulnerability was found in MaxSite CMS up to 109.3. Impacted is an unknown function of the component ushki Plugin. Performing a manipulation of the argument… |
CVE-2026-42255 | High | 7.2 | 2026-04-26 | Technitium DNS Server before 15.0 allows DNS traffic amplification via cyclic name server delegation. |
CVE-2026-7015 | Low | 2.4 | 2026-04-26 | A vulnerability has been found in MaxSite CMS up to 109.3. This issue affects some unknown processing of the component Guestbook Plugin. Such manipulation of t… |
CVE-2026-7014 | Low | 2.4 | 2026-04-26 | A flaw has been found in MaxSite CMS up to 109.3. This vulnerability affects unknown code of the component down_count Plugin. This manipulation of the argument… |
CVE-2026-7013 | Low | 2.4 | 2026-04-26 | A security vulnerability has been detected in MaxSite CMS up to 109.3. Affected by this issue is some unknown functionality of the component mail_send Plugin… |
CVE-2026-42254 | Medium | 4.0 | 2026-04-26 | Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a respon… |
CVE-2026-7012 | Low | 2.4 | 2026-04-26 | A vulnerability was detected in MaxSite CMS up to 109.3. This affects an unknown part of the component Redirect Plugin. The manipulation of the argument f_all/… |
CVE-2026-7011 | Low | 2.4 | 2026-04-26 | A weakness has been identified in MaxSite CMS up to 109.3. Affected by this vulnerability is an unknown functionality of the file /admin/plugin_antispam of the… |
CVE-2026-7002 | High | 7.3 | 2026-04-25 | A vulnerability was determined in KLiK SocialMediaWebsite up to 1.0.1. This vulnerability affects unknown code of the file /includes/get_message_ajax.php of th… |
CVE-2026-7001 | Low | 2.4 | 2026-04-25 | A vulnerability was found in Datacom DM4100 1.3.6.1.4.1.3709. This affects an unknown part of the component Ethernet Configuration Page. Performing a manipulat… |
CVE-2026-7000 | Low | 2.4 | 2026-04-25 | A vulnerability has been found in Datacom DM4100 1.3.6.1.4.1.3709. Affected by this issue is some unknown functionality of the component VLAN Page. Such manipu… |
CVE-2026-6999 | Low | 2.4 | 2026-04-25 | A flaw has been found in BIVOCOM TR321 21.1.1.50. Affected by this vulnerability is an unknown functionality of the component Wireless Setting. This manipulati… |
CVE-2026-6998 | Low | 2.4 | 2026-04-25 | A vulnerability was detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. Affected is an unknown function of the component New RMON Statistics Page. The manipula… |
CVE-2026-6997 | Low | 2.4 | 2026-04-25 | A security vulnerability has been detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. This impacts an unknown function of the component New RMON History Page… |
CVE-2026-6996 | Low | 2.4 | 2026-04-25 | A weakness has been identified in BDCOM P3310D 0.4.2 10.1.0F Build 86345. This affects an unknown function of the component rmon event Tab. Executing a manipul… |
CVE-2026-6995 | Low | 2.4 | 2026-04-25 | A security flaw has been discovered in BDCOM P3310D 0.4.2 10.1.0F Build 86345. The impacted element is an unknown function of the file /index.asp of the compon… |
CVE-2026-6994 | Medium | 6.3 | 2026-04-25 | A weakness has been identified in Envoy up to 1.33.0. Affected is the function params.add of the file source/extensions/filters/http/header_mutation/header_mut… |
CVE-2026-6993 | Medium | 5.3 | 2026-04-25 | A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component… |
CVE-2026-6992 | High | 7.2 | 2026-04-25 | A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGetSmartConnectStatus of the file /etc/init.d/run_central2.sh… |
CVE-2026-6991 | Medium | 6.3 | 2026-04-25 | A vulnerability was determined in colinhacks Zod up to 4.3.6. The impacted element is an unknown function of the file packages/zod/src/v4/core/regexes.ts of th… |
CVE-2026-6990 | Low | 3.5 | 2026-04-25 | A vulnerability was found in projeto-siga siga 11.0.3.18. The affected element is an unknown function of the file /sigawf/app/responsavel/novo. Performing a ma… |
CVE-2026-6989 | Medium | 6.3 | 2026-04-25 | A vulnerability has been found in Tenda F453 up to 1.0.0.3. Impacted is the function TendaTelnet of the file /goform/telnet of the component Telnet Service. Su… |
CVE-2026-6988 | High | 8.8 | 2026-04-25 | A flaw has been found in Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon. This issue affects the function formRoute of the file /boaform/formRouting of the compone… |
CVE-2026-6987 | High | 7.3 | 2026-04-25 | A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management… |
CVE-2026-6986 | Low | 3.7 | 2026-04-25 | A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of… |
CVE-2026-6985 | Medium | 5.3 | 2026-04-25 | A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the function handle_opt of the file /src/net_builtin.c of the compone… |
CVE-2026-6984 | Medium | 4.7 | 2026-04-25 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function create_template of the file astrbot/dashboard/routes/t2i.py… |
CVE-2026-6983 | Medium | 4.7 | 2026-04-25 | A vulnerability was identified in pagekit up to 1.0.18. Affected by this issue is some unknown functionality of the file /index.php/admin/system/update/downloa… |
CVE-2026-6982 | Medium | 6.3 | 2026-04-25 | A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0. Affected by this vulnerability is an unknown functionality of the file server/Appl… |
CVE-2026-6981 | Medium | 6.3 | 2026-04-25 | A vulnerability was found in IhateCreatingUserNames2 AiraHub2 up to 3e4b77fd7d48ed811ffe5b8d222068c17c76495e. Affected is the function connect_stream_endpoint/… |
CVE-2026-6980 | High | 7.3 | 2026-04-25 | A vulnerability has been found in Divyanshu-hash GitPilot-MCP up to 9ed9f153ba4158a2ad230ee4871b25130da29ffd. This impacts the function repo_path of the file m… |
CVE-2026-6979 | Medium | 6.3 | 2026-04-25 | A flaw has been found in devlikeapro WAHA up to 2026.3.4. This affects an unknown function of the file src/api/media.controller.ts of the component API Request… |
CVE-2026-6978 | Medium | 4.7 | 2026-04-25 | A vulnerability was detected in JiZhiCMS up to 2.5.6. The impacted element is the function htmlspecialchars_decode of the file /index.php/admins/Sys/addcache.h… |
CVE-2026-6977 | High | 7.3 | 2026-04-25 | A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The ma… |
CVE-2026-31685 | Critical | 9.4 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets `eui64_mt6()` derives a… |
CVE-2026-31684 | Medium | 5.5 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN heade… |
CVE-2026-31683 | High | 7.8 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: avoid OGM aggregation when skb tailroom is insufficient When OGM aggregation… |
CVE-2026-31682 | Critical | 9.1 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour… |
CVE-2026-31681 | Medium | 5.5 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_multiport: validate range encoding in checkentry ports_match_v1() treats an… |
CVE-2026-31680 | High | 7.8 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: net: ipv6: flowlabel: defer exclusive option free until RCU teardown `ip6fl_seq_show()` w… |
CVE-2026-31679 | High | 7.1 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: validate MPLS set/set_masked payload length validate_set() accepted OVS_KEY_… |
CVE-2026-31678 | High | 7.8 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunnel_destroy() may run a… |
CVE-2026-31677 | Medium | 5.5 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - limit RX SG extraction by receive buffer budget Make af_alg_get_rsgl() l… |
CVE-2026-31676 | High | 7.5 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: only handle RESPONSE during service challenge Only process RESPONSE packets while… |
CVE-2026-31675 | High | 7.8 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_netem: fix out-of-bounds access in packet corruption In netem_enqueue(), t… |
CVE-2026-31674 | High | 7.1 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Reject rt match rules whose… |
CVE-2026-31673 | High | 7.8 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: af_unix: read UNIX_DIAG_VFS data under unix_state_lock Exact UNIX diag lookups hold a ref… |
CVE-2026-6951 | Critical | 9.8 | 2026-04-25 | Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.s… |
CVE-2026-42171 | High | 7.8 | 2026-04-24 | NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gai… |
CVE-2026-41488 | Low | 3.1 | 2026-04-24 | LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_size() helper (used by get_num_tokens_fr… |
CVE-2026-41481 | Medium | 6.5 | 2026-04-24 | LangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters 1.1.2, HTMLHeaderTextSplitter.split_text_from_url… |
CVE-2026-41478 | Critical | 9.9 | 2026-04-24 | Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcor… |
CVE-2026-41473 | Critical | 9.1 | 2026-04-24 | CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote att… |
CVE-2026-41472 | Medium | 6.1 | 2026-04-24 | CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endp… |
CVE-2026-41248 | Critical | 9.1 | 2026-04-24 | Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypa… |
CVE-2026-6968 | Medium | 5.9 | 2026-04-24 | Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside… |
CVE-2026-6967 | Medium | 5.9 | 2026-04-24 | Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with… |
CVE-2026-6966 | Medium | 5.3 | 2026-04-24 | Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated user… |
CVE-2026-41503 | High | 7.5 | 2026-04-24 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's ReadP… |
CVE-2026-41502 | High | 7.5 | 2026-04-24 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an off-by-one out-of-bounds read vulnerability in bacnet-st… |
CVE-2026-41477 | High | 7.8 | 2026-04-24 | Deskflow is a keyboard and mouse sharing app. In 1.20.0, 1.26.0.134, and earlier, Deskflow daemon runs as SYSTEM and exposes an IPC named pipe with WorldAcces… |
CVE-2026-41476 | High | 8.8 | 2026-04-24 | Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.138, a remote memory-safety vulnerability in Deskflow's clipboard deserialization allows a conne… |
CVE-2026-41475 | Critical | 9.1 | 2026-04-24 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's Write… |
CVE-2026-41433 | High | 8.4 | 2026-04-24 | OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent inje… |
CVE-2026-41429 | High | 8.8 | 2026-04-24 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reach… |
CVE-2026-41428 | Critical | 9.1 | 2026-04-24 | Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpo… |
CVE-2026-41427 | Medium | 6.5 | 2026-04-24 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth… |
CVE-2026-41426 | Medium | 6.1 | 2026-04-24 | pretalx is a conference planning tool. Prior to 2026.1.0, an unauthenticated attacker can send arbitrary HTML-rendered emails from a pretalx instance's configu… |
CVE-2026-41425 | Medium | 5.4 | 2026-04-24 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integra… |
CVE-2026-41244 | Medium | 4.7 | 2026-04-24 | Mojic is a CLI tool to transform readable C code into an unrecognizable chaotic stream of emojis. Prior to 2.1.4, the CipherEngine uses a standard equality ope… |
CVE-2026-41907 | High | 7.5 | 2026-04-24 | uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range wri… |
CVE-2026-41894 | | 2026-04-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, the fix for CVE-2026-30869 only added a denylist check (IsSensitivePath) but did… | |
CVE-2026-41492 | Critical | 9.8 | 2026-04-24 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoi… |
CVE-2026-41421 | High | 8.8 | 2026-04-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, SiYuan desktop renders notification messages as raw HTML inside an Electron rend… |
CVE-2026-41419 | High | 7.6 | 2026-04-24 | 4ga Boards is a boards system for realtime project management. Prior to 3.3.5, a path traversal vulnerability allows an authenticated user with board import pr… |
CVE-2026-41418 | Medium | 5.3 | 2026-04-24 | 4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnerable to user enumeration via a timing side-channel in the lo… |
CVE-2026-41416 | High | 7.5 | 2026-04-24 | PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer overflow in media stream buffer size ca… |
CVE-2026-41415 | Critical | 9.1 | 2026-04-24 | PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when parsing a malformed Con… |