2026 CVEs (page 558)
Page 558 of 667 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34379 | High | 7.1 | 2026-04-06 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to… |
CVE-2026-34378 | Medium | 6.5 | 2026-04-06 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to… |
CVE-2026-34217 | High | 7.2 | 2026-04-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, a scope modification vulnerability exists in @nyariv/sandboxjs. The vulnerability allows untrust… |
CVE-2026-34211 | High | 7.5 | 2026-04-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, the @nyariv/sandboxjs parser contains unbounded recursion in the restOfExp function and the lisp… |
CVE-2026-34208 | Critical | 10.0 | 2026-04-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this p… |
CVE-2026-34148 | High | 7.5 | 2026-04-06 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP… |
CVE-2026-33752 | High | 8.6 | 2026-04-06 | curl_cffi is the a Python binding for curl. Prior to 0.15.0, curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically vi… |
CVE-2026-33727 | Medium | 6.4 | 2026-04-06 | Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Version 6.4 has a local privilege-escalation vulnerability allows cod… |
CVE-2026-33405 | Low | 3.1 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the form… |
CVE-2026-31354 | Medium | 5.4 | 2026-04-06 | Multiple authenticated stored cross-site scripting (XSS) vulnerabilities in the Permissions module of Feehi CMS v2.1.1 allows attackers to execute arbitrary we… |
CVE-2026-31353 | Medium | 5.4 | 2026-04-06 | An authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts o… |
CVE-2026-31352 | Medium | 5.4 | 2026-04-06 | An authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web sc… |
CVE-2026-31351 | Medium | 4.8 | 2026-04-06 | An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web s… |
CVE-2026-31350 | Medium | 5.4 | 2026-04-06 | An authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a… |
CVE-2026-21382 | High | 7.8 | 2026-04-06 | Memory Corruption when handling power management requests with improperly sized input/output buffers. |
CVE-2026-21381 | High | 7.6 | 2026-04-06 | Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection. |
CVE-2026-21380 | High | 7.8 | 2026-04-06 | Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory. |
CVE-2026-21378 | High | 7.8 | 2026-04-06 | Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver. |
CVE-2026-21376 | High | 7.8 | 2026-04-06 | Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver. |
CVE-2026-21375 | High | 7.8 | 2026-04-06 | Memory Corruption when accessing an output buffer without validating its size during IOCTL processing. |
CVE-2026-21374 | High | 7.8 | 2026-04-06 | Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation. |
CVE-2026-21373 | High | 7.8 | 2026-04-06 | Memory Corruption when accessing an output buffer without validating its size during IOCTL processing. |
CVE-2026-21372 | High | 7.8 | 2026-04-06 | Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations. |
CVE-2026-21371 | High | 7.8 | 2026-04-06 | Memory Corruption when retrieving output buffer with insufficient size validation. |
CVE-2026-21367 | High | 7.6 | 2026-04-06 | Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans. |
CVE-2026-5663 | High | 7.3 | 2026-04-06 | A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/stores… |
CVE-2026-5661 | Medium | 5.3 | 2026-04-06 | A vulnerability was identified in Free5GC 4.2.0. This affects an unknown function of the component NGSetupRequest Handler. Such manipulation leads to denial of… |
CVE-2026-34897 | Medium | 6.5 | 2026-04-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS.T… |
CVE-2026-34885 | High | 8.5 | 2026-04-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant allows SQL Injectio… |
CVE-2026-33540 | High | 7.5 | 2026-04-06 | Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mode, distribution discovers token auth en… |
CVE-2026-33510 | High | 8.8 | 2026-04-06 | Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has been discovered in Homarr's /auth/login page. The… |
CVE-2026-33406 | Medium | 5.4 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configur… |
CVE-2026-33404 | Low | 3.4 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client h… |
CVE-2026-33403 | Medium | 6.1 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflec… |
CVE-2026-32602 | Medium | 4.2 | 2026-04-06 | Homarr is an open-source dashboard. Prior to 1.57.0, the user registration endpoint (/api/trpc/user.register) is vulnerable to a race condition that allows an… |
CVE-2026-31153 | Medium | 5.4 | 2026-04-06 | A stored cross-site scripting (XSS) vulnerability in Bynder before 12 January 2026 allows attackers to execute arbitrary web scripts or HTML via a crafted payl… |
CVE-2026-31151 | Critical | 9.8 | 2026-04-06 | An issue in the login mechanism of Kaleris YMS v7.2.2.1 allows attackers to bypass login verification to access the application 's resources. |
CVE-2026-31150 | Medium | 4.3 | 2026-04-06 | Incorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the shipping/receiving role to view the truck's dashboard resources. |
CVE-2026-31067 | Medium | 6.8 | 2026-04-06 | A remote command execution (RCE) vulnerability in the /goform/formReleaseConnect component of UTT Aggressive 520W v3v1.7.7-180627 allows attackers to execute a… |
CVE-2026-31066 | Medium | 4.5 | 2026-04-06 | UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the selDateType parameter of the formTaskEdit function. This vulnerabi… |
CVE-2026-31065 | Medium | 4.5 | 2026-04-06 | UTT Aggressive 520W v3v1.7.7-180627 was discovered to contain a buffer overflow in the addCommand parameter of the formConfigCliForEngineerOnly function. This… |
CVE-2026-31063 | Medium | 4.5 | 2026-04-06 | UTT Aggressive HiPER 1200GW v2.5.3-170306 was discovered to contain a buffer overflow in the pools parameter of the formArpBindConfig function. This vulnerabil… |
CVE-2026-31062 | Medium | 4.5 | 2026-04-06 | UTT Aggressive 520W v3v1.7.7-180627 was discovered to contain a buffer overflow in the filename parameter of the formFtpServerDirConfig function. This vulnerab… |
CVE-2026-31061 | Medium | 4.5 | 2026-04-06 | UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the timestart parameter of the ConfigAdvideo function. This vulnerabil… |
CVE-2026-31060 | Medium | 4.5 | 2026-04-06 | UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the notes parameter of the formGroupConfig function. This vulnerabilit… |
CVE-2026-31059 | Critical | 9.8 | 2026-04-06 | A remote command execution (RCE) vulnerability in the /goform/formDia component of UTT Aggressive HiPER 520W v3v1.7.7-180627 allows attackers to execute arbitr… |
CVE-2026-31058 | Medium | 4.5 | 2026-04-06 | UTT Aggressive HiPER 1200GW v2.5.3-170306 was discovered to contain a buffer overflow in the timeRangeName parameter of the formConfigDnsFilterGlobal function… |
CVE-2026-31053 | Medium | 6.2 | 2026-04-06 | A double free vulnerability exists in librz/bin/format/le/le.c in the function le_load_fixup_record(). When processing malformed or circular LE fixup chains, r… |
CVE-2026-29047 | High | 7.2 | 2026-04-06 | GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the lo… |
CVE-2026-26263 | High | 8.1 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Searc… |
CVE-2026-26027 | High | 7.5 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory e… |
CVE-2026-26026 | Critical | 9.1 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability i… |
CVE-2026-25932 | High | 7.2 | 2026-04-06 | GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier f… |
CVE-2026-5660 | Medium | 6.3 | 2026-04-06 | A vulnerability was determined in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /borrowed_equip.php… |
CVE-2026-5659 | Medium | 6.3 | 2026-04-06 | A vulnerability was found in pytries datrie up to 0.8.3. The affected element is the function Trie.load/Trie.read/Trie.__setstate__ of the file src/datrie.pyx… |
CVE-2026-30078 | High | 7.5 | 2026-04-06 | OpenAirInterface V2.2.0 AMF crashes when it receives an NGAP message with invalid procedure code or invalid PDU-type. For example when the message specificatio… |
CVE-2026-3524 | High | 8.8 | 2026-04-06 | Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated att… |
CVE-2026-5650 | Medium | 5.3 | 2026-04-06 | A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollment/database/oas.sq… |
CVE-2026-5649 | Medium | 6.3 | 2026-04-06 | A vulnerability has been found in code-projects Online Application System for Admission 1.0. This issue affects some unknown processing of the file /enrollment… |
CVE-2026-5648 | High | 7.3 | 2026-04-06 | A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /userfinishregister.php of the component… |
CVE-2026-5647 | Low | 2.4 | 2026-04-06 | A vulnerability was detected in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /admin/admin_feature.php of the component Add Pro… |
CVE-2026-5646 | High | 7.3 | 2026-04-06 | A security vulnerability has been detected in code-projects Easy Blog Site 1.0. Affected by this issue is some unknown functionality of the file login.php. The… |
CVE-2026-5645 | High | 7.3 | 2026-04-06 | A weakness has been identified in projectworlds Car Rental System 1.0. Affected by this vulnerability is an unknown functionality of the file /pay.php of the c… |
CVE-2026-5673 | Medium | 5.6 | 2026-04-06 | A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_… |
CVE-2026-5644 | Low | 2.4 | 2026-04-06 | A security flaw has been discovered in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. Affected is an unknown function of t… |
CVE-2026-5643 | Low | 2.4 | 2026-04-06 | A vulnerability was identified in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This impacts an unknown function of the f… |
CVE-2026-5642 | High | 7.3 | 2026-04-06 | A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown function of the f… |
CVE-2026-5641 | Medium | 6.3 | 2026-04-06 | A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /admin/update-image1.php of… |
CVE-2026-5640 | Medium | 6.3 | 2026-04-06 | A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /admin/update-image2.p… |
CVE-2026-5639 | Medium | 6.3 | 2026-04-06 | A flaw has been found in PHPGurukul Online Shopping Portal Project 2.1. Impacted is an unknown function of the file /admin/update-image3.php of the component P… |
CVE-2026-5638 | Medium | 5.3 | 2026-04-06 | A vulnerability was detected in HerikLyma CPPWebFramework up to 3.1. This issue affects some unknown processing. Performing a manipulation results in path trav… |
CVE-2026-5637 | High | 7.3 | 2026-04-06 | A security vulnerability has been detected in projectworlds Car Rental System 1.0. This vulnerability affects unknown code of the file /message_admin.php of th… |
CVE-2026-37977 | Low | 3.7 | 2026-04-06 | A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Ac… |
CVE-2026-5636 | Medium | 6.3 | 2026-04-06 | A weakness has been identified in PHPGurukul Online Shopping Portal Project 2.1. This affects an unknown part of the file /cancelorder.php of the component Par… |
CVE-2026-5635 | Medium | 6.3 | 2026-04-06 | A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. Affected by this issue is some unknown functionality of the file /categor… |
CVE-2026-5634 | High | 7.3 | 2026-04-06 | A vulnerability was identified in projectworlds Car Rental Project 1.0. Affected by this vulnerability is an unknown functionality of the file /book_car.php of… |
CVE-2026-5633 | High | 7.3 | 2026-04-06 | A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulatio… |
CVE-2026-31410 | Medium | 5.5 | 2026-04-06 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION Use sb->s_uuid for a proper volume ide… |
CVE-2026-31409 | High | 8.8 | 2026-04-06 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset conn->binding on failed binding request When a multichannel SMB2_SESSION_SET… |
CVE-2026-31408 | High | 8.8 | 2026-04-06 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_… |
CVE-2026-31407 | High | 7.1 | 2026-04-06 | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: add missing netlink policy validations Hyunwoo Kim reports out-of-b… |
CVE-2026-31406 | High | 7.8 | 2026-04-06 | In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() After cancel_del… |
CVE-2026-31405 | Critical | 9.8 | 2026-04-06 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handl… |
CVE-2026-5632 | High | 7.3 | 2026-04-06 | A vulnerability was found in assafelovic gpt-researcher up to 3.4.3. This impacts an unknown function of the component HTTP REST API Endpoint. Performing a man… |
CVE-2026-5631 | High | 7.3 | 2026-04-06 | A vulnerability has been found in assafelovic gpt-researcher up to 3.4.3. This affects the function extract_command_data of the file backend/server/server_util… |
CVE-2026-5630 | Medium | 4.3 | 2026-04-06 | A flaw has been found in assafelovic gpt-researcher up to 3.4.3. The impacted element is an unknown function of the file backend/server/app.py of the component… |
CVE-2026-5629 | High | 8.8 | 2026-04-06 | A vulnerability was detected in Belkin F9K1015 1.00.10. The affected element is the function formSetFirewall of the file /goform/formSetFirewall. The manipulat… |
CVE-2026-5628 | High | 8.8 | 2026-04-06 | A security vulnerability has been detected in Belkin F9K1015 1.00.10. Impacted is the function formSetSystemSettings of the file /goform/formSetSystemSettings… |
CVE-2026-5625 | Medium | 4.3 | 2026-04-06 | A weakness has been identified in assafelovic gpt-researcher up to 3.4.3. This issue affects some unknown processing of the file gpt_researcher/skills/research… |
CVE-2026-5624 | Medium | 4.3 | 2026-04-06 | A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in… |
CVE-2026-5623 | Medium | 6.3 | 2026-04-06 | A vulnerability was identified in hcengineering Huly Platform 0.7.382. This affects an unknown part of the file server/front/src/index.ts of the component Impo… |
CVE-2026-5622 | Low | 3.7 | 2026-04-06 | A vulnerability was determined in hcengineering Huly Platform 0.7.382. Affected by this issue is some unknown functionality of the file foundations/core/packag… |
CVE-2026-5621 | Medium | 5.3 | 2026-04-06 | A vulnerability was found in ChrisChinchilla Vale-MCP up to 0.1.0. Affected by this vulnerability is an unknown functionality of the file src/index.ts of the c… |
CVE-2026-5620 | Medium | 6.3 | 2026-04-06 | A vulnerability has been found in itsourcecode Construction Management System 1.0. Affected is an unknown function of the file /borrowed_equip_report.php of th… |
CVE-2026-5619 | Medium | 5.3 | 2026-04-06 | A flaw has been found in Braffolk mcp-summarization-functions up to 0.1.5. This impacts an unknown function of the file src/server/mcp-server.ts of the compone… |
CVE-2026-5618 | Medium | 5.6 | 2026-04-06 | A vulnerability was detected in kalcaddle kodbox up to 1.64. This affects an unknown function of the component shareMake/shareCheck. Performing a manipulation… |
CVE-2026-5616 | High | 7.3 | 2026-04-06 | A security vulnerability has been detected in JeecgBoot 3.9.0/3.9.1. The impacted element is an unknown function of the file jeecg-boot/jeecg-module-system/jee… |
CVE-2026-5615 | Medium | 4.3 | 2026-04-06 | A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload E… |
CVE-2026-5614 | High | 8.8 | 2026-04-06 | A security flaw has been discovered in Belkin F9K1015 1.00.10. Impacted is the function formSetPassword of the file /goform/formSetPassword. The manipulation o… |
CVE-2026-5613 | High | 8.8 | 2026-04-06 | A vulnerability was identified in Belkin F9K1015 1.00.10. This issue affects the function formReboot of the file /goform/formReboot. The manipulation of the ar… |