2026 CVEs (page 544)
Page 544 of 668 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6194 | High | 8.8 | 2026-04-13 | A weakness has been identified in Totolink A3002MU B20211125.1046. Affected by this vulnerability is the function sub_410188 of the file /boafrm/formWlanSetup… |
CVE-2026-6100 | High | 8.1 | 2026-04-13 | Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError… |
CVE-2026-32316 | High | 8.2 | 2026-04-13 | jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_… |
CVE-2026-28291 | High | 8.1 | 2026-04-13 | simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option ma… |
CVE-2026-6193 | High | 7.3 | 2026-04-13 | A security flaw has been discovered in PHPGurukul Daily Expense Tracking System 1.1. Affected is an unknown function of the file /register.php. The manipulatio… |
CVE-2026-6192 | Low | 3.3 | 2026-04-13 | A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The m… |
CVE-2026-6191 | Medium | 6.3 | 2026-04-13 | A vulnerability was determined in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /equipments.php. Executing a ma… |
CVE-2026-6190 | Medium | 6.3 | 2026-04-13 | A vulnerability was found in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /employees.php. Performin… |
CVE-2026-6189 | High | 7.3 | 2026-04-13 | A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?act… |
CVE-2026-39940 | | 2026-04-13 | ChurchCRM is an open-source church management system. Prior to 7.0.0, it was possible in many places across the ChurchCRM application to create a link that, wh… | |
CVE-2026-36952 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in the file /otas/admin/curriculum/manage_curriculum.php. |
CVE-2026-36950 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projects_per_department.php. |
CVE-2026-36948 | High | 7.3 | 2026-04-13 | Sourcecodester Online Thesis Archiving System v1.0 is vulnerale to SQL injection in the file /otas/view_archive.php. |
CVE-2026-33555 | Medium | 4.0 | 2026-04-13 | An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length w… |
CVE-2026-23891 | High | 8.7 | 2026-04-13 | Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name… |
CVE-2026-6231 | Medium | 4.3 | 2026-04-13 | The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data… |
CVE-2026-6188 | High | 7.3 | 2026-04-13 | A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /ajax.php?action=delete_sales. Thi… |
CVE-2026-6187 | High | 7.3 | 2026-04-13 | A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. This issue affects some unknown processing of the file /ajax.php?action… |
CVE-2026-6186 | High | 8.8 | 2026-04-13 | A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This vulnerability affects the function strcpy of the file /goform/formNatSt… |
CVE-2026-6184 | Low | 2.4 | 2026-04-13 | A weakness has been identified in code-projects Simple Content Management System 1.0. This affects an unknown part of the file /web/admin/welcome.php. Executin… |
CVE-2026-36938 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/rooms/view_room.php. |
CVE-2026-36937 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/reservations/view_details.php. |
CVE-2026-34188 | High | 7.2 | 2026-04-13 | Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution. This issue affects Pa… |
CVE-2026-34186 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects Pandora FMS: from 7… |
CVE-2026-30813 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search. This issue affects Pandora FMS: from 7… |
CVE-2026-30812 | Medium | 5.4 | 2026-04-13 | Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments. This issue affects Pandora FMS… |
CVE-2026-30811 | Medium | 6.5 | 2026-04-13 | Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint. This issue affects Pandora FMS: from 777 through 800 |
CVE-2026-30809 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug. This issue affects Pandor… |
CVE-2026-30806 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report. This issue affects Pandora FMS… |
CVE-2026-30804 | High | 7.2 | 2026-04-13 | Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload. This issue affects Pandora FMS: from 777 through 800 |
CVE-2026-6183 | High | 7.3 | 2026-04-13 | A security flaw has been discovered in code-projects Simple Content Management System 1.0. Affected by this issue is some unknown functionality of the file /we… |
CVE-2026-6182 | High | 7.3 | 2026-04-13 | A vulnerability was identified in code-projects Simple Content Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /w… |
CVE-2026-36945 | Low | 2.7 | 2026-04-13 | Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/clients/manage_client.php |
CVE-2026-36944 | Low | 2.7 | 2026-04-13 | Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerale to SQL injection in the file/rsms/admin/repairs/view_details.php. |
CVE-2026-36943 | Low | 2.7 | 2026-04-13 | Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/repairs/manage_repair.php. |
CVE-2026-36942 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in the file /orms/admin/activities/manage_activity.php. |
CVE-2026-36941 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL Injection in the file /orms/admin/rooms/manage_room.php. |
CVE-2026-33858 | High | 8.8 | 2026-04-13 | Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code… |
CVE-2026-31283 | Critical | 9.8 | 2026-04-13 | In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. which can be used for an Email Bombing… |
CVE-2026-31282 | Critical | 9.8 | 2026-04-13 | Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form. An attacker can chain… |
CVE-2026-31281 | High | 8.0 | 2026-04-13 | Totara LMS v19.1.5 and before is vulnerable to HTML Injection. An attacker can inject malicious HTML code in a message and send it to all the users in the appl… |
CVE-2026-30999 | High | 7.5 | 2026-04-13 | A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2026-30998 | High | 7.5 | 2026-04-13 | An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (Do… |
CVE-2026-30997 | High | 7.5 | 2026-04-13 | An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a craf… |
CVE-2026-29628 | Medium | 6.2 | 2026-04-13 | A stack overflow in the experimental/tinyobj_loader_opt.h file of tinyobjloader commit d56555b allows attackers to cause a Denial of Service (DoS) via supplyin… |
CVE-2026-1462 | High | 7.8 | 2026-04-13 | A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserial… |
CVE-2026-36947 | Low | 2.7 | 2026-04-13 | Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL Injection in the file /rsms/admin/services/view_service.php. |
CVE-2026-36946 | Low | 2.7 | 2026-04-13 | Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/inquiries/view_details.php. |
CVE-2026-31428 | Medium | 5.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD __build_packet_… |
CVE-2026-31427 | Medium | 5.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp process_sdp… |
CVE-2026-31426 | High | 7.0 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() When ec_install_handlers(… |
CVE-2026-31425 | Medium | 5.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: rds: ib: reject FRMR registration before IB connection is established rds_ib_get_mr() ext… |
CVE-2026-31424 | Medium | 5.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP W… |
CVE-2026-31423 | Medium | 5.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() m2sm() converts a u32 slope to a u6… |
CVE-2026-31422 | Medium | 5.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flow: fix NULL pointer dereference on shared blocks flow_change() calls tc… |
CVE-2026-31421 | Medium | 5.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_fw: fix NULL pointer dereference on shared blocks The old-method path in f… |
CVE-2026-31420 | Medium | 5.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: bridge: mrp: reject zero test interval to avoid OOM panic br_mrp_start_test() and br_mrp_… |
CVE-2026-31419 | High | 7.8 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses th… |
CVE-2026-31418 | Medium | 5.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: drop logically empty buckets in mtype_del mtype_del() counts empty slot… |
CVE-2026-31417 | High | 7.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix overflow when accumulating packets Add a check to ensure that `x25_sock.frag… |
CVE-2026-31416 | Medium | 5.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: account for netlink header size This is a followup to an old bu… |
CVE-2026-31415 | Medium | 5.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : <quote> I believ… |
CVE-2026-31414 | Critical | 9.8 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use expect->helper Use expect->helper in ctnetlink and /p… |
CVE-2026-36923 | Low | 2.7 | 2026-04-13 | Sourcecodester Cab Management System 1.0 is vulnerable to SQL Injection in the file /cms/admin/bookings/view_booking.php. |
CVE-2026-36922 | Low | 2.7 | 2026-04-13 | Sourcecodester Cab Management System v1.0 is vulnerable to SQL injection in the file /cms/admin/categories/view_category.php. |
CVE-2026-36920 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Reviewer System v1.0 is vulnerable to SQL Injection in the file /system/system/admins/assessments/examproper/questions-view.php. |
CVE-2026-36919 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Reviewer System v1.0 is vulnerale to SQL Injection in the file /system/system/admins/assessments/examproper/exam-update.php. |
CVE-2026-36874 | Low | 2.7 | 2026-04-13 | Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_student.php. |
CVE-2026-36873 | Low | 2.7 | 2026-04-13 | Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_admin.php. |
CVE-2026-36872 | Low | 2.7 | 2026-04-13 | Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_book.php. |
CVE-2026-34476 | High | 7.1 | 2026-04-13 | Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended… |
CVE-2026-6204 | High | 7.2 | 2026-04-13 | LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand… |
CVE-2026-2728 | Medium | 4.8 | 2026-04-13 | LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires ad… |
CVE-2026-35565 | Medium | 5.4 | 2026-04-13 | Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI Versions Affected: before 2.8.6 Description: The Storm UI visualizat… |
CVE-2026-35337 | High | 8.8 | 2026-04-13 | Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitte… |
CVE-2026-4810 | | 2026-04-13 | A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Py… | |
CVE-2026-0234 | Critical | 9.1 | 2026-04-13 | An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that… |
CVE-2026-0233 | High | 8.8 | 2026-04-13 | A certificate validation vulnerability in Palo Alto Networks Autonomous Digital Experience Manager on Windows allows an unauthenticated attacker with adjacent… |
CVE-2026-0232 | Medium | 4.4 | 2026-04-13 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This iss… |
CVE-2026-6168 | High | 8.8 | 2026-04-13 | A flaw has been found in TOTOLINK A7000R up to 9.1.0u.6115. The affected element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. This man… |
CVE-2026-6167 | High | 7.3 | 2026-04-13 | A vulnerability was detected in code-projects Faculty Management System 1.0. Impacted is an unknown function of the file /subject-print.php. The manipulation o… |
CVE-2026-6166 | High | 7.3 | 2026-04-13 | A security vulnerability has been detected in code-projects Vehicle Showroom Management System 1.0. This issue affects some unknown processing of the file /uti… |
CVE-2026-5936 | High | 8.5 | 2026-04-13 | An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior… |
CVE-2026-5085 | Critical | 9.1 | 2026-04-13 | Solstice::Session versions through 1440 for Perl generates session ids insecurely. The _generateSessionID method returns an MD5 digest seeded by the epoch tim… |
CVE-2026-40436 | High | 7.1 | 2026-04-13 | The ZTE ZXEDM iEMS product has a password reset vulnerability for any user.Because the management of the cloud EMS portal does not properly control access to t… |
CVE-2026-3830 | High | 8.6 | 2026-04-13 | The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing u… |
CVE-2026-34866 | Medium | 5.1 | 2026-04-13 | Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2026-34865 | Critical | 9.1 | 2026-04-13 | Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2026-6165 | High | 7.3 | 2026-04-13 | A weakness has been identified in code-projects Vehicle Showroom Management System 1.0. This vulnerability affects unknown code of the file /util/Login_check.p… |
CVE-2026-6164 | High | 7.3 | 2026-04-13 | A security flaw has been discovered in code-projects Lost and Found Thing Management 1.0. This affects an unknown part of the file /addcat.php. Performing a ma… |
CVE-2026-6163 | High | 7.3 | 2026-04-13 | A vulnerability was identified in code-projects Lost and Found Thing Management 1.0. Affected by this issue is some unknown functionality of the file /catageor… |
CVE-2026-40447 | Medium | 5.1 | 2026-04-13 | Integer overflow or wraparound vulnerability in Samsung Open Source Escargot allows undefined behavior.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c… |
CVE-2026-21014 | Low | 2.8 | 2026-04-13 | Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. User interaction is required for triggerin… |
CVE-2026-21013 | Medium | 5.5 | 2026-04-13 | Incorrect default permission in Galaxy Wearable prior to version 2.2.68.26 allows local attackers to access sensitive information. |
CVE-2026-21012 | Low | 3.3 | 2026-04-13 | External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create file with system privilege. |
CVE-2026-21011 | Medium | 6.8 | 2026-04-13 | Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Extend Unlock. |
CVE-2026-21010 | Medium | 6.6 | 2026-04-13 | Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions. |
CVE-2026-21009 | Medium | 6.8 | 2026-04-13 | Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass App Pinning. |
CVE-2026-21008 | Medium | 6.5 | 2026-04-13 | Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensitive information. |
CVE-2026-21007 | Medium | 6.8 | 2026-04-13 | Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Knox Guard. |