2026 CVEs (page 563)
Page 563 of 666 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-35168 | High | 8.8 | 2026-04-02 | OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the Aggiornamenti (Updates) module in Ope… |
CVE-2026-31933 | High | 7.5 | 2026-04-02 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, specially crafted traffic can cause Suricata to slow down, affecting perform… |
CVE-2026-31932 | High | 7.5 | 2026-04-02 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, inefficiency in KRB5 buffering can lead to performance degradation. This iss… |
CVE-2026-31931 | High | 7.5 | 2026-04-02 | Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, use of the "tls.alpn" rule keyword can cause Suricata to crash with… |
CVE-2026-30867 | Medium | 5.7 | 2026-04-02 | CocoaMQTT is a MQTT 5.0 client library for iOS and macOS written in Swift. Prior to version 2.2.2, a vulnerability exists in the packet parsing logic of CocoaM… |
CVE-2026-2737 | Medium | 6.1 | 2026-04-02 | A vulnerability exists in Progress Flowmon versions prior to 12.5.8 and 13.0.6, whereby an administrator who clicks a malicious link provided by an attacker ma… |
CVE-2026-2701 | Critical | 9.1 | 2026-04-02 | Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution. |
CVE-2026-2699 | Critical | 9.8 | 2026-04-02 | Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing s… |
CVE-2026-29782 | High | 7.2 | 2026-04-02 | OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is… |
CVE-2026-28805 | High | 8.8 | 2026-04-02 | OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, multiple AJAX select handlers in OpenSTAM… |
CVE-2026-26928 | | 2026-04-02 | SzafirHost downloads necessary files in the context of the initiating web page. When called, SzafirHost updates its dynamic library. JAR files are correctly ve… | |
CVE-2026-26927 | | 2026-04-02 | Szafir SDK Web is a browser plug-in that can run SzafirHost application which download the necessary files when launched. In Szafir SDK Web it is possible to c… | |
CVE-2026-5331 | Medium | 4.7 | 2026-04-02 | A vulnerability was determined in OpenCart 4.1.0.3. This affects an unknown part of the file installer.php of the component Extension Installer Page. Executing… |
CVE-2026-5330 | Medium | 6.5 | 2026-04-02 | A vulnerability was found in SourceCodester/mayuri_k Best Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax… |
CVE-2026-5328 | Medium | 6.3 | 2026-04-02 | A weakness has been identified in shsuishang modulithshop up to 829bac71f507e84684c782b9b062b8bf3b5585d6. The impacted element is the function listItem of the… |
CVE-2026-4636 | High | 8.1 | 2026-04-02 | A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attack… |
CVE-2026-4634 | High | 7.5 | 2026-04-02 | A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long s… |
CVE-2026-4325 | Medium | 5.3 | 2026-04-02 | A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an at… |
CVE-2026-4282 | High | 7.4 | 2026-04-02 | A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an un… |
CVE-2026-3872 | High | 7.3 | 2026-04-02 | A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform R… |
CVE-2026-34890 | Medium | 6.5 | 2026-04-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark O’Donnell MSTW League Manager allows DOM-Based XSS.T… |
CVE-2026-5327 | Medium | 6.3 | 2026-04-02 | A security flaw has been discovered in efforthye fast-filesystem-mcp up to 3.5.1. The affected element is the function handleGetDiskUsage of the file src/index… |
CVE-2026-23417 | Medium | 5.5 | 2026-04-02 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix constant blinding for PROBE_MEM32 stores BPF_ST | BPF_PROBE_MEM32 immediate stor… |
CVE-2026-23416 | Medium | 5.5 | 2026-04-02 | In the Linux kernel, the following vulnerability has been resolved: mm/mseal: update VMA end correctly on merge Previously we stored the end of the current V… |
CVE-2026-23415 | High | 7.8 | 2026-04-02 | In the Linux kernel, the following vulnerability has been resolved: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() During futex_key_… |
CVE-2026-23414 | High | 7.5 | 2026-04-02 | In the Linux kernel, the following vulnerability has been resolved: tls: Purge async_hold in tls_decrypt_async_wait() The async_hold queue pins encrypted inp… |
CVE-2026-23413 | High | 7.8 | 2026-04-02 | In the Linux kernel, the following vulnerability has been resolved: clsact: Fix use-after-free in init/destroy rollback asymmetry Fix a use-after-free in the… |
CVE-2026-23412 | High | 7.8 | 2026-04-02 | In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: defer hook memory release until rcu readers are done Yiming Qian reports… |
CVE-2026-5326 | Medium | 5.3 | 2026-04-02 | A vulnerability was identified in SourceCodester Leave Application System 1.0. Impacted is an unknown function of the file /index.php?page=manage_user of the c… |
CVE-2026-32145 | High | 7.5 | 2026-04-02 | Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp wisp allows a denial of service via multipart form body parsing. The multipar… |
CVE-2026-5246 | Medium | 5.6 | 2026-04-02 | A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-… |
CVE-2026-5245 | Medium | 5.6 | 2026-04-02 | A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Hand… |
CVE-2026-33617 | Medium | 5.3 | 2026-04-02 | An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidentiality, but ther… |
CVE-2026-33616 | High | 7.5 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of s… |
CVE-2026-33615 | Critical | 9.1 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special… |
CVE-2026-33614 | High | 7.5 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special… |
CVE-2026-33613 | High | 7.2 | 2026-04-02 | Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray functi… |
CVE-2026-29144 | Medium | 5.3 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge security tags using Unicode lookalike character… |
CVE-2026-29143 | Critical | 9.1 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 does not properly authenticate the inner message of S/MIME-encrypted MIME entities, allowing an attacker to… |
CVE-2026-29142 | Medium | 5.3 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to forge a GINA-encrypted email. |
CVE-2026-29141 | Medium | 5.3 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge tags such as [signed OK]. |
CVE-2026-29140 | Medium | 5.3 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to cause attacker-controlled certificates to be used for future encryption to a victim b… |
CVE-2026-29139 | Critical | 9.8 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by abusing GINA account initialization to reset a victim account password. |
CVE-2026-29138 | High | 7.5 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to claim another user's PGP signature as their own. |
CVE-2026-29137 | Medium | 5.3 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to hide security tags from users by crafting a long subject. |
CVE-2026-29136 | Medium | 6.1 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to inject HTML into notification emails about new CA certificates. |
CVE-2026-29135 | High | 7.5 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to craft a password-tag that bypasses subject sanitization. |
CVE-2026-29134 | High | 7.5 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an external user to modify GINA webdomain metadata and bypass per-domain restrictions. |
CVE-2026-29133 | Critical | 9.1 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to upload PGP keys with UIDs that do not match their email address. |
CVE-2026-29132 | High | 7.5 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker with access to a victim's GINA account to bypass a second-password check and read protec… |
CVE-2026-29131 | High | 7.5 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to read the contents of emails encrypted for other… |
CVE-2026-0634 | High | 7.8 | 2026-04-02 | Code execution in AssistFeedbackService of TECNO Pova7 Pro 5G on Android allows local apps to execute arbitrary code as system via command injection. |
CVE-2026-5244 | High | 7.3 | 2026-04-02 | A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handl… |
CVE-2026-5032 | High | 7.5 | 2026-04-02 | The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing… |
CVE-2026-0688 | Medium | 6.4 | 2026-04-02 | The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 via the 'Tools::read' function. Th… |
CVE-2026-0686 | High | 7.2 | 2026-04-02 | The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 in the 'MF2::parse_authorpage' fun… |
CVE-2026-5325 | Low | 3.5 | 2026-04-02 | A vulnerability was determined in SourceCodester Simple Customer Relationship Management System 1.0. This issue affects some unknown processing of the file /cr… |
CVE-2026-5323 | Medium | 5.3 | 2026-04-02 | A vulnerability was found in priyankark a11y-mcp up to 1.0.5. This vulnerability affects the function A11yServer of the file src/index.js. The manipulation res… |
CVE-2026-5322 | High | 7.3 | 2026-04-02 | A vulnerability has been found in AlejandroArciniegas mcp-data-vis bc597e391f184d2187062fd567599a3cb72adf51/de5a51525a69822290eaee569a1ab447b490746d. This affe… |
CVE-2026-4347 | High | 8.1 | 2026-04-02 | The MW WP Form plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the 'generate_user_filepath' function a… |
CVE-2026-1540 | High | 7.2 | 2026-04-02 | The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows logging to a PHP file, which could allow an attacker with editor access to achieve Re… |
CVE-2026-5321 | Medium | 4.3 | 2026-04-02 | A flaw has been found in vanna-ai vanna up to 2.0.2. Affected by this issue is some unknown functionality of the component FastAPI/Flask Server. Executing a ma… |
CVE-2026-5320 | High | 7.3 | 2026-04-02 | A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is an unknown functionality of the file /api/vanna/v2/ of the compon… |
CVE-2026-5319 | Medium | 4.3 | 2026-04-02 | A security vulnerability has been detected in itsourcecode Payroll Management System up to 1.0. Affected is an unknown function of the file /navbar.php. Such m… |
CVE-2026-5318 | Medium | 4.3 | 2026-04-02 | A weakness has been identified in LibRaw up to 0.22.0. This impacts the function HuffTable::initval of the file src/decompressors/losslessjpeg.cpp of the compo… |
CVE-2026-5317 | Medium | 6.3 | 2026-04-02 | A security flaw has been discovered in Nothings stb up to 1.22. This affects the function start_decoder of the file stb_vorbis.c. The manipulation results in o… |
CVE-2026-1243 | Medium | 5.4 | 2026-04-02 | IBM Content Navigator 3.0.15, 3.1.0, and 3.2.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaSc… |
CVE-2026-5316 | Medium | 4.3 | 2026-04-02 | A vulnerability was identified in Nothings stb up to 1.22. The impacted element is the function setup_free of the file stb_vorbis.c. The manipulation leads to… |
CVE-2026-5315 | Medium | 4.3 | 2026-04-02 | A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library stb_truetype.h of the component… |
CVE-2026-21767 | Medium | 4.0 | 2026-04-02 | HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive areas of the application without proper… |
CVE-2026-21765 | High | 8.8 | 2026-04-02 | HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might… |
CVE-2026-5314 | Medium | 4.3 | 2026-04-01 | A vulnerability was found in Nothings stb up to 1.26. Impacted is the function stbtt_InitFont_internal in the library stb_truetype.h of the component TTF File… |
CVE-2026-32929 | High | 7.8 | 2026-04-01 | V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read in VS6ComFile!get_macro_mem_COM. Opening a crafted V7 file may lead to information disclosure f… |
CVE-2026-32928 | High | 7.8 | 2026-04-01 | V-SFT versions 6.2.10.0 and prior contain a stack-based buffer overflow in VS6ComFile!CSaveData::_conv_AnimationItem. Opening a crafted V7 file may lead to arb… |
CVE-2026-32927 | High | 7.8 | 2026-04-01 | V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to inform… |
CVE-2026-32926 | High | 7.8 | 2026-04-01 | V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6ComFile!load_link_inf. Opening a crafted V7 file may lead to information di… |
CVE-2026-32925 | High | 7.8 | 2026-04-01 | V-SFT versions 6.2.10.0 and prior contain a stack-based buffer overflow in VS6ComFile!CV7BaseMap::WriteV7DataToRom. Opening a crafted V7 file may lead to arbit… |
CVE-2026-5313 | Medium | 4.3 | 2026-04-01 | A vulnerability has been found in Nothings stb up to 2.30. This issue affects the function stbi__gif_load_next in the library stb_image.h of the component GIF… |
CVE-2026-3987 | High | 7.2 | 2026-04-01 | A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged authenticated remote attacker to execute arbitrar… |
CVE-2026-34572 | High | 8.8 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34571 | Critical | 9.9 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34570 | High | 8.8 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34569 | Critical | 9.9 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34568 | Critical | 9.1 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34567 | Critical | 9.1 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34566 | Critical | 9.1 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34565 | Critical | 9.1 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34564 | Critical | 9.1 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34563 | Critical | 9.1 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34562 | Medium | 4.7 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34561 | Medium | 4.7 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34560 | Critical | 9.1 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34559 | Critical | 9.1 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-5312 | Medium | 5.3 | 2026-04-01 | A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR… |
CVE-2026-4820 | Medium | 4.3 | 2026-04-01 | IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to ge… |
CVE-2026-4364 | Medium | 5.4 | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 thr… |
CVE-2026-4101 | High | 8.1 | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 thr… |
CVE-2026-34873 | Critical | 9.1 | 2026-04-01 | An issue was discovered in Mbed TLS 3.5.0 through 4.0.0. Client impersonation can occur while resuming a TLS 1.3 session. |
CVE-2026-34545 | High | 7.3 | 2026-04-01 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3… |
CVE-2026-34544 | High | 7.3 | 2026-04-01 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3… |