2026 CVEs (page 527)
Page 527 of 669 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41172 | | 2026-04-22 | Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allows a user with asse… | |
CVE-2026-41171 | | 2026-04-22 | Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a Server-Side Request Forgery (SSRF) vul… | |
CVE-2026-41170 | | 2026-04-22 | Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the `RestoreController.PostRestoreJob` endpoi… | |
CVE-2026-40517 | High | 7.8 | 2026-04-22 | radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary command… |
CVE-2026-41168 | Medium | 5.3 | 2026-04-22 | pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads t… |
CVE-2026-41167 | Critical | 9.1 | 2026-04-22 | Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolatin… |
CVE-2026-41166 | High | 7.0 | 2026-04-22 | OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has `write:admin` in one Keycloak realm can call the Manager API… |
CVE-2026-41134 | High | 7.8 | 2026-04-22 | Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.29.1 and 1.31.1 are affected by a code-generation literal injection vulnerability in… |
CVE-2026-40937 | High | 8.3 | 2026-04-22 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in `rustfs/src/admin/han… |
CVE-2026-40882 | High | 7.6 | 2026-04-22 | OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit… |
CVE-2026-3837 | Medium | 5.4 | 2026-04-22 | An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected docu… |
CVE-2026-34068 | Medium | 6.8 | 2026-04-22 | nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, the staking contract accepts `UpdateVal… |
CVE-2026-34067 | Low | 3.1 | 2026-04-22 | nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryTreeProof::verify` panics on a… |
CVE-2026-33733 | High | 7.2 | 2026-04-22 | EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-control… |
CVE-2026-33656 | Critical | 9.1 | 2026-04-22 | EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating a… |
CVE-2026-6019 | Medium | 6.1 | 2026-04-22 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sen… |
CVE-2026-3673 | Medium | 5.4 | 2026-04-22 | An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are… |
CVE-2026-34066 | Medium | 5.3 | 2026-04-22 | nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryStore::put_historic_txns` uses an `assert!`… |
CVE-2026-34065 | High | 7.5 | 2026-04-22 | nimiq-primitives contains primitives (e.g., block, account, transaction) to be used in Nimiq's Rust implementation. Prior to version 1.3.0, an untrusted p2p pe… |
CVE-2026-34064 | Medium | 5.3 | 2026-04-22 | nimiq-account contains account primitives to be used in Nimiq's Rust implementation. Prior to version 1.3.0, `VestingContract::can_change_balance` returns `Acc… |
CVE-2026-34063 | High | 7.5 | 2026-04-22 | Nimiq's network-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, `network-libp2p` discovery uses a libp2p `ConnectionHandler`… |
CVE-2026-34062 | Medium | 5.3 | 2026-04-22 | nimiq-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, `MessageCodec::read_request` and `read_response` call `read_to_end()` o… |
CVE-2026-33471 | Critical | 9.6 | 2026-04-22 | nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::verify` computes its quorum check using `BitSet.len()`, then… |
CVE-2026-41469 | Medium | 5.2 | 2026-04-22 | Beghelli Sicuro24 SicuroWeb does not enforce a Content Security Policy, allowing unrestricted loading of external JavaScript resources from attacker-controlled… |
CVE-2026-41468 | High | 8.7 | 2026-04-22 | Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. When combined with template injection… |
CVE-2026-41459 | Medium | 5.3 | 2026-04-22 | Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full serv… |
CVE-2026-34415 | Critical | 9.8 | 2026-04-22 | Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP… |
CVE-2026-34414 | High | 7.1 | 2026-04-22 | Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/conn… |
CVE-2026-34413 | High | 8.6 | 2026-04-22 | Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/conne… |
CVE-2026-28950 | Medium | 6.2 | 2026-04-22 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 15.8.8 and iPadOS 15.8.8, iOS 16.7.16 and iPadOS 16.7.16, iOS 18.7.8 and… |
CVE-2026-26354 | High | 8.1 | 2026-04-22 | Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3… |
CVE-2026-6515 | Medium | 5.4 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have a… |
CVE-2026-5816 | High | 8.0 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1 that could have allowed an unauthentic… |
CVE-2026-5377 | Medium | 4.3 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that could have allowed an authenticated user to access titles… |
CVE-2026-5262 | High | 8.0 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.1.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under cert… |
CVE-2026-4922 | High | 8.1 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have a… |
CVE-2026-3254 | Low | 3.5 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that under certain conditions could have allowed an authenticat… |
CVE-2026-35381 | Low | 3.3 | 2026-04-22 | A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d '' (e… |
CVE-2026-35380 | Medium | 5.5 | 2026-04-22 | A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' (two single quotes) as an empty… |
CVE-2026-35379 | Low | 3.3 | 2026-04-22 | A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation… |
CVE-2026-35378 | Low | 3.3 | 2026-04-22 | A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rather than at the e… |
CVE-2026-35377 | Low | 3.3 | 2026-04-22 | A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (split-string) option. In… |
CVE-2026-35376 | Medium | 4.5 | 2026-04-22 | A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during recursive operations. The implementation resolves… |
CVE-2026-35375 | Low | 3.3 | 2026-04-22 | A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffix inputs. The impl… |
CVE-2026-35374 | Medium | 6.3 | 2026-04-22 | A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program attempts to prevent data loss by checking fo… |
CVE-2026-35373 | Low | 3.3 | 2026-04-22 | A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory f… |
CVE-2026-35372 | Medium | 5.0 | 2026-04-22 | A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference (or -n) flag is exp… |
CVE-2026-35371 | Low | 3.3 | 2026-04-22 | The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation inco… |
CVE-2026-35370 | Medium | 4.4 | 2026-04-22 | The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to… |
CVE-2026-35369 | Medium | 5.5 | 2026-04-22 | An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1. S… |
CVE-2026-35368 | High | 7.8 | 2026-04-22 | A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() a… |
CVE-2026-35367 | Low | 3.3 | 2026-04-22 | The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to i… |
CVE-2026-35366 | Medium | 4.4 | 2026-04-22 | The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in… |
CVE-2026-35365 | Medium | 6.6 | 2026-04-22 | The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries. Instead of preservin… |
CVE-2026-35364 | Medium | 6.3 | 2026-04-22 | A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the des… |
CVE-2026-35363 | Medium | 5.6 | 2026-04-22 | A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility co… |
CVE-2026-35362 | Low | 3.6 | 2026-04-22 | The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-rela… |
CVE-2026-35361 | Low | 3.4 | 2026-04-22 | The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails… |
CVE-2026-35360 | Medium | 6.3 | 2026-04-22 | The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies… |
CVE-2026-35359 | Medium | 4.7 | 2026-04-22 | A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility che… |
CVE-2026-35358 | Medium | 4.4 | 2026-04-22 | The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than pr… |
CVE-2026-35357 | Medium | 4.7 | 2026-04-22 | The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permis… |
CVE-2026-35356 | Medium | 6.3 | 2026-04-22 | A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent dire… |
CVE-2026-35355 | Medium | 6.3 | 2026-04-22 | The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. The implementation un… |
CVE-2026-35354 | Medium | 4.7 | 2026-04-22 | A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) pr… |
CVE-2026-35353 | Low | 3.3 | 2026-04-22 | The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically… |
CVE-2026-35352 | High | 7.0 | 2026-04-22 | A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-ba… |
CVE-2026-35351 | Medium | 4.2 | 2026-04-22 | The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-d… |
CVE-2026-35350 | Medium | 6.6 | 2026-04-22 | The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag… |
CVE-2026-35349 | Medium | 6.7 | 2026-04-22 | A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-string check rather tha… |
CVE-2026-35348 | Medium | 5.5 | 2026-04-22 | The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The imple… |
CVE-2026-35347 | Medium | 4.4 | 2026-04-22 | The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical fu… |
CVE-2026-35346 | Low | 3.3 | 2026-04-22 | The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8… |
CVE-2026-35345 | Medium | 5.3 | 2026-04-22 | A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU… |
CVE-2026-35344 | Low | 3.3 | 2026-04-22 | The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While in… |
CVE-2026-35343 | Low | 3.3 | 2026-04-22 | The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementati… |
CVE-2026-35342 | Low | 3.3 | 2026-04-22 | The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR i… |
CVE-2026-35341 | High | 7.1 | 2026-04-22 | A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO becaus… |
CVE-2026-35340 | Medium | 5.5 | 2026-04-22 | A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive operations. The fin… |
CVE-2026-35339 | Medium | 5.5 | 2026-04-22 | The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is deter… |
CVE-2026-35338 | High | 7.3 | 2026-04-22 | A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the… |
CVE-2026-32885 | Medium | 6.5 | 2026-04-22 | DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both `U… |
CVE-2026-1660 | Medium | 6.5 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certai… |
CVE-2026-30139 | Medium | 6.1 | 2026-04-22 | A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core before version 6.4.6 allows attackers to execute ar… |
CVE-2026-35548 | High | 8.5 | 2026-04-22 | An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0). A logic flaw allowed stored d… |
CVE-2026-6862 | Medium | 5.5 | 2026-04-22 | A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4… |
CVE-2026-6861 | Medium | 6.1 | 2026-04-22 | A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG (Scalable Vector Graphics) CSS… |
CVE-2026-6859 | High | 8.8 | 2026-04-22 | A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote atta… |
CVE-2026-6356 | Critical | 9.6 | 2026-04-22 | A vulnerability in the web application allows standard users to escalate their privileges to those of a super administrator through parameter manipulation, ena… |
CVE-2026-6355 | Medium | 6.5 | 2026-04-22 | A vulnerability in the web application allows unauthorized users to access and manipulate sensitive data across different tenants by exploiting insecure direct… |
CVE-2026-5750 | | 2026-04-22 | An insecure direct object reference (IDOR) vulnerability in the Fullstep V5 registration process allows authenticated users to access data belonging to other r… | |
CVE-2026-5749 | | 2026-04-22 | Inadequate access control in the registration process in Fullstep V5, which could allow unauthenticated users to obtain a valid JWT token with which to interac… | |
CVE-2026-41651 | High | 8.8 | 2026-04-22 | PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit betw… |
CVE-2026-33611 | Medium | 6.5 | 2026-04-22 | An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database… |
CVE-2026-33610 | Medium | 5.9 | 2026-04-22 | A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request… |
CVE-2026-33609 | Medium | 5.3 | 2026-04-22 | Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees. |
CVE-2026-33608 | High | 7.4 | 2026-04-22 | An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration t… |
CVE-2026-33602 | Medium | 6.5 | 2026-04-22 | A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading t… |
CVE-2026-33599 | Low | 3.1 | 2026-04-22 | A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newS… |
CVE-2026-33598 | Medium | 4.8 | 2026-04-22 | A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache. |