2026 CVEs (page 54)
Page 54 of 446 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-69098 | Critical | 9.8 | 2026-08-04 | kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiat… |
CVE-2026-25292 | High | 7.6 | 2026-08-04 | Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration. |
CVE-2026-25289 | Critical | 9.6 | 2026-08-04 | Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values. |
CVE-2026-25288 | High | 7.4 | 2026-08-04 | Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size. |
CVE-2026-24084 | High | 7.5 | 2026-08-04 | Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities. |
CVE-2026-24083 | High | 7.8 | 2026-08-04 | Memory Corruption while processing IOCTL device driver requests with invalid arguments. |
CVE-2026-24080 | High | 7.8 | 2026-08-04 | Memory Corruption when handling malformed request parameters in the fingerprint TA. |
CVE-2026-24079 | High | 8.1 | 2026-08-04 | Cryptographic Issue while processing registration requests with malformed or missing authentication parameters. |
CVE-2026-24078 | Medium | 6.5 | 2026-08-04 | Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling. |
CVE-2026-24077 | Medium | 6.5 | 2026-08-04 | Information Disclosure when processing wireless network channel switch information with improperly formatted length fields. |
CVE-2026-24076 | Medium | 6.7 | 2026-08-04 | Memory Corruption when processing registry values with incorrect types using a direct query method. |
CVE-2026-21366 | High | 7.8 | 2026-08-04 | Memory corruption while processing a packet with a size close to the maximum allowed value. |
CVE-2026-18801 | | 2026-08-04 | OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create o… | |
CVE-2026-18773 | Medium | 6.3 | 2026-08-04 | A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function _check_slash_access of the file gateway/run.py… |
CVE-2026-10032 | | 2026-08-04 | The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply… | |
CVE-2026-69251 | | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed… | |
CVE-2026-69250 | | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-… | |
CVE-2026-68494 | | 2026-08-04 | The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is inco… | |
CVE-2026-67618 | Medium | 6.5 | 2026-08-04 | marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious ba… |
CVE-2026-67200 | High | 7.5 | 2026-08-04 | Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by in… |
CVE-2026-67199 | Medium | 6.5 | 2026-08-04 | Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted e… |
CVE-2026-67198 | High | 7.5 | 2026-08-04 | Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the… |
CVE-2026-67196 | Medium | 5.4 | 2026-08-04 | Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by w… |
CVE-2026-67195 | High | 8.8 | 2026-08-04 | Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submit… |
CVE-2026-61515 | Critical | 9.8 | 2026-08-04 | Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrar… |
CVE-2026-61514 | Critical | 9.8 | 2026-08-04 | Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device funct… |
CVE-2026-18770 | High | 7.3 | 2026-08-04 | A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the… |
CVE-2026-18766 | Medium | 6.3 | 2026-08-04 | A flaw has been found in chetans9 core-php-admin-panel up to 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f. This issue affects some unknown processing of the file /… |
CVE-2026-18650 | High | 8.8 | 2026-08-04 | Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Privilege Escalation. This issue affects Liman MYS: from 2.2.3 before 2.3.1. |
CVE-2026-18401 | | 2026-08-04 | The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 cha… | |
CVE-2026-11368 | High | 7.1 | 2026-08-04 | The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_data_storage[… |
CVE-2026-70368 | Medium | 6.5 | 2026-08-04 | A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attac… |
CVE-2026-70367 | Medium | 5.4 | 2026-08-04 | A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to… |
CVE-2026-17070 | High | 8.8 | 2026-08-04 | Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Liman MYS… |
CVE-2026-14337 | | 2026-08-04 | Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high… | |
CVE-2026-70373 | High | 8.8 | 2026-08-04 | Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled reque… |
CVE-2026-70372 | High | 8.8 | 2026-08-04 | Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string… |
CVE-2026-70371 | High | 8.8 | 2026-08-04 | Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query stri… |
CVE-2026-70370 | High | 8.8 | 2026-08-04 | Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into ide… |
CVE-2026-70369 | High | 8.8 | 2026-08-04 | Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters direc… |
CVE-2026-63252 | High | 7.5 | 2026-08-04 | In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowi… |
CVE-2026-63248 | Medium | 6.5 | 2026-08-04 | In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics o… |
CVE-2026-62927 | High | 7.5 | 2026-08-04 | In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, a… |
CVE-2026-61387 | High | 7.5 | 2026-08-04 | In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server… |
CVE-2026-60007 | High | 7.4 | 2026-08-04 | In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentica… |
CVE-2026-58080 | High | 8.2 | 2026-08-04 | In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions… |
CVE-2026-18809 | Medium | 6.5 | 2026-08-04 | Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3. |
CVE-2026-18806 | High | 7.1 | 2026-08-04 | External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Cl… |
CVE-2026-10710 | High | 7.8 | 2026-08-04 | A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malici… |
CVE-2026-10709 | High | 7.8 | 2026-08-04 | A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSecti… |
CVE-2026-66884 | | 2026-08-04 | Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.AuthorizationCallback module) allows an attacker to make a victi… | |
CVE-2026-66883 | | 2026-08-04 | Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user agent session bind… | |
CVE-2026-10050 | Critical | 9.1 | 2026-08-04 | In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specifi… |
CVE-2026-18772 | Medium | 6.5 | 2026-08-04 | Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion. |
CVE-2026-15721 | Critical | 9.8 | 2026-08-04 | Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injecti… |
CVE-2026-14838 | High | 7.4 | 2026-08-04 | Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows… |
CVE-2026-14804 | Critical | 9.1 | 2026-08-04 | Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Con… |
CVE-2026-14465 | Medium | 6.5 | 2026-08-04 | Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs (a… |
CVE-2026-14219 | Medium | 5.4 | 2026-08-04 | URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Ph… |
CVE-2026-14202 | Medium | 5.3 | 2026-08-04 | Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. … |
CVE-2026-14194 | Medium | 6.5 | 2026-08-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digita… |
CVE-2026-14192 | Medium | 5.4 | 2026-08-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST… |
CVE-2026-14175 | Critical | 9.8 | 2026-08-04 | Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload… |
CVE-2026-67243 | High | 7.2 | 2026-08-04 | freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges fo… |
CVE-2026-18759 | | 2026-08-04 | The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encry… | |
CVE-2026-18755 | High | 7.3 | 2026-08-04 | A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to an unsafe search directory to execute arbitrary code. By p… |
CVE-2026-18754 | Critical | 9.1 | 2026-08-04 | The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows … |
CVE-2026-18753 | Critical | 9.1 | 2026-08-04 | The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows … |
CVE-2026-64565 | | 2026-08-04 | In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() The `ims_pcu_process_… | |
CVE-2026-64564 | Critical | 9.8 | 2026-08-04 | In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() ca… |
CVE-2026-64563 | High | 7.8 | 2026-08-04 | In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two re… |
CVE-2026-64562 | High | 8.8 | 2026-08-04 | In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR free_nested() frees the shadow VMCS while… |
CVE-2026-64561 | High | 8.8 | 2026-08-04 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a… |
CVE-2026-16623 | High | 8.0 | 2026-08-04 | The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a m… |
CVE-2026-16618 | Critical | 9.8 | 2026-08-04 | The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the… |
CVE-2026-16548 | Medium | 6.5 | 2026-08-04 | The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type… |
CVE-2026-16547 | Medium | 5.9 | 2026-08-04 | The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check… |
CVE-2026-16546 | Medium | 4.3 | 2026-08-04 | The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the… |
CVE-2026-16536 | Medium | 5.3 | 2026-08-04 | The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, a… |
CVE-2026-16296 | Medium | 4.7 | 2026-08-04 | The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI… |
CVE-2026-16295 | Medium | 4.3 | 2026-08-04 | The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user s… |
CVE-2026-16293 | Medium | 6.8 | 2026-08-04 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could all… |
CVE-2026-16070 | Low | 2.7 | 2026-08-04 | The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validatin… |
CVE-2026-16069 | Medium | 6.8 | 2026-08-04 | The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before s… |
CVE-2026-16068 | Low | 3.5 | 2026-08-04 | The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before… |
CVE-2026-16056 | Medium | 4.3 | 2026-08-04 | The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down… |
CVE-2026-16035 | Medium | 4.3 | 2026-08-04 | The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the… |
CVE-2026-15958 | Critical | 9.3 | 2026-08-04 | The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it al… |
CVE-2026-15233 | Medium | 4.8 | 2026-08-04 | The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing s… |
CVE-2026-14939 | Medium | 6.8 | 2026-08-04 | The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with… |
CVE-2026-14872 | Medium | 6.8 | 2026-08-04 | The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a… |
CVE-2026-14848 | Medium | 5.4 | 2026-08-04 | The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout… |
CVE-2026-14824 | Medium | 4.8 | 2026-08-04 | The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribu… |
CVE-2026-14816 | Medium | 6.5 | 2026-08-04 | The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-co… |
CVE-2026-12698 | Medium | 4.3 | 2026-08-04 | The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a su… |
CVE-2026-11366 | Low | 3.7 | 2026-08-04 | The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsig… |
CVE-2026-10526 | Medium | 5.8 | 2026-08-04 | The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowi… |
CVE-2026-68744 | Low | 3.3 | 2026-08-04 | A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink… |
CVE-2026-18739 | Low | 2.5 | 2026-08-04 | A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host applicatio… |
CVE-2026-18569 | Low | 3.7 | 2026-08-04 | A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles… |