2026 CVEs (page 587)
Page 587 of 665 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33013 | High | 7.5 | 2026-03-20 | Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 an… |
CVE-2026-33012 | High | 7.5 | 2026-03-20 | Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions 4.7.0 through 4.10.16 u… |
CVE-2026-33011 | High | 7.5 | 2026-03-20 | Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify… |
CVE-2026-32954 | High | 7.1 | 2026-03-20 | ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and… |
CVE-2026-32953 | Medium | 4.6 | 2026-03-20 | Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out… |
CVE-2026-32950 | High | 8.8 | 2026-03-20 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a critical SQL Injection vulnerability in t… |
CVE-2026-32949 | High | 7.5 | 2026-03-20 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery (SSRF) vulner… |
CVE-2026-32947 | Medium | 4.9 | 2026-03-20 | Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, a DNS over HTTPS (DoH) vulnerability a… |
CVE-2026-4468 | Medium | 4.7 | 2026-03-20 | A vulnerability was determined in Comfast CF-AC100 2.6.0.8. Affected is an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=update_interfac… |
CVE-2026-4136 | Medium | 4.3 | 2026-03-20 | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.2.24. This is due t… |
CVE-2026-4038 | Critical | 9.8 | 2026-03-20 | The Aimogen Pro plugin for WordPress is vulnerable to Arbitrary Function Call that can lead to privilege escalation due to a missing capability check on the 'a… |
CVE-2026-32946 | Low | 2.7 | 2026-03-20 | Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, the Harden-Runner that allows bypass o… |
CVE-2026-32945 | Critical | 9.8 | 2026-03-20 | PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a Heap-based Buffer Overflowvulnerability in the DN… |
CVE-2026-32942 | High | 8.1 | 2026-03-20 | PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a heap use-after-free vulnerability in the ICE… |
CVE-2026-32941 | Medium | 6.5 | 2026-03-20 | Sliver is a command and control framework that uses a custom Wireguard netstack. Versions 1.7.3 and below contain a Remote OOM (Out-of-Memory) vulnerability in… |
CVE-2026-32940 | Critical | 9.3 | 2026-03-20 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, SanitizeSVG has an incomplete blocklist — it blocks data:text/html and data:imag… |
CVE-2026-32939 | High | 8.1 | 2026-03-20 | DataEase is an open source data visualization analysis tool. Versions 2.10.19 and below have inconsistent Locale handling between the JDBC URL validation logic… |
CVE-2026-32938 | Critical | 9.9 | 2026-03-20 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by file… |
CVE-2026-32114 | Medium | 4.3 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, there is an Insecure Direct Object Reference (IDO… |
CVE-2026-4467 | Medium | 4.7 | 2026-03-20 | A vulnerability was found in Comfast CF-AC100 2.6.0.8. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=wireless_device_dis… |
CVE-2026-33063 | High | 7.5 | 2026-03-20 | free5GC is an open source 5G core network. free5GC AUSF prior to version 1.4.2 has is an Improper Null Check vulnerability leading to Denial of Service. All de… |
CVE-2026-33062 | High | 7.5 | 2026-03-20 | free5GC is an open source 5G core network. free5GC NRF prior to version 1.4.2 has an Improper Input Validation vulnerability leading to Denial of Service. All… |
CVE-2026-32937 | Medium | 6.5 | 2026-03-20 | free5GC is an open source 5G core network. free5GC CHF prior to version 1.2.2 has an out-of-bounds slice access vulnerability in the CHF `nchf-convergedchargin… |
CVE-2026-32935 | Medium | 5.9 | 2026-03-20 | phpseclib is a PHP secure communications library. Projects using versions 0.1.1 through 1.0.26, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable t… |
CVE-2026-32933 | High | 7.5 | 2026-03-20 | AutoMapper is a convention-based object-object mapper in .NET. Versions prior to 15.1.1 and 16.1.1 are vulnerable to a Denial of Service (DoS) attack. When map… |
CVE-2026-32891 | Critical | 9.0 | 2026-03-20 | Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contai… |
CVE-2026-32890 | Critical | 9.6 | 2026-03-20 | Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. In versions 1.4.1 and below, a… |
CVE-2026-32889 | Medium | 6.5 | 2026-03-20 | tinytag is a Python library for reading audio file metadata. Version 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating… |
CVE-2026-32888 | High | 8.8 | 2026-03-20 | Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items s… |
CVE-2026-31869 | Medium | 4.3 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ComposerController#mentions endpoint reveals… |
CVE-2026-31805 | Medium | 5.3 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authorization bypass in the poll plugin allowe… |
CVE-2026-30891 | Medium | 6.5 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a user could access another user's private activi… |
CVE-2026-30889 | Medium | 4.9 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a moderator could exploit insufficient authorizat… |
CVE-2026-30888 | Low | 2.2 | 2026-03-20 | Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 allow a moderator to edit site policy documents (T… |
CVE-2026-21992 | Critical | 9.8 | 2026-03-20 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracl… |
CVE-2026-4466 | Medium | 4.7 | 2026-03-20 | A vulnerability has been found in Comfast CF-AC100 2.6.0.8. This affects an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone… |
CVE-2026-4465 | Medium | 6.3 | 2026-03-20 | A flaw has been found in D-Link DIR-513 1.10. The impacted element is an unknown function of the file /goform/formSysCmd. Executing a manipulation of the argum… |
CVE-2026-4464 | High | 8.8 | 2026-03-20 | Integer overflow in ANGLE in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2026-4463 | High | 8.8 | 2026-03-20 | Heap buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2026-4462 | High | 8.8 | 2026-03-20 | Out of bounds read in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2026-4461 | High | 8.8 | 2026-03-20 | Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2026-4460 | High | 8.8 | 2026-03-20 | Out of bounds read in Skia in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2026-4459 | High | 8.8 | 2026-03-20 | Out of bounds read and write in WebAudio in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2026-4458 | High | 8.8 | 2026-03-20 | Use after free in Extensions in Google Chrome prior to 146.0.7680.153 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2026-4457 | High | 8.8 | 2026-03-20 | Type Confusion in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2026-4456 | High | 8.8 | 2026-03-20 | Use after free in Digital Credentials API in Google Chrome prior to 146.0.7680.153 allowed a remote attacker who had compromised the renderer process to potent… |
CVE-2026-4455 | High | 8.8 | 2026-03-20 | Heap buffer overflow in PDFium in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file… |
CVE-2026-4454 | High | 8.8 | 2026-03-20 | Use after free in Network in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2026-4453 | Medium | 4.3 | 2026-03-20 | Integer overflow in Dawn in Google Chrome on Mac prior to 146.0.7680.153 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-4452 | High | 8.8 | 2026-03-20 | Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2026-4451 | High | 8.8 | 2026-03-20 | Insufficient validation of untrusted input in Navigation in Google Chrome prior to 146.0.7680.153 allowed a remote attacker who had compromised the renderer pr… |
CVE-2026-4450 | High | 8.8 | 2026-03-20 | Out of bounds write in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2026-4449 | High | 8.8 | 2026-03-20 | Use after free in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2026-4448 | High | 8.8 | 2026-03-20 | Heap buffer overflow in ANGLE in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-4447 | High | 8.8 | 2026-03-20 | Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-4446 | High | 8.8 | 2026-03-20 | Use after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2026-4445 | High | 8.8 | 2026-03-20 | Use after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2026-4444 | High | 8.8 | 2026-03-20 | Stack buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML p… |
CVE-2026-4443 | High | 8.8 | 2026-03-20 | Heap buffer overflow in WebAudio in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HT… |
CVE-2026-4442 | High | 8.8 | 2026-03-20 | Heap buffer overflow in CSS in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-4441 | High | 8.8 | 2026-03-20 | Use after free in Base in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2026-4440 | High | 8.8 | 2026-03-20 | Out of bounds read and write in WebGL in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pag… |
CVE-2026-4439 | High | 8.8 | 2026-03-20 | Out of bounds memory access in WebGL in Google Chrome on Android prior to 146.0.7680.153 allowed a remote attacker to potentially perform a sandbox escape via… |
CVE-2026-32881 | Medium | 5.3 | 2026-03-20 | ewe is a Gleam web server. ewe is a Gleam web server. Versions 0.6.0 through 3.0.4 are vulnerable to authentication bypass or spoofed proxy-trust headers. Chun… |
CVE-2026-32880 | Medium | 6.4 | 2026-03-20 | ChurchCRM is an open-source church management system. Versions prior to 7.0.2 allow an admin user to edit JSON type system settings to store a JavaScript paylo… |
CVE-2026-32875 | High | 7.5 | 2026-03-20 | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or… |
CVE-2026-32874 | High | 7.5 | 2026-03-20 | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak… |
CVE-2026-32873 | High | 7.5 | 2026-03-20 | ewe is a Gleam web server. Versions 0.8.0 through 3.0.4 contain a bug in the handle_trailers function where rejected trailer headers (forbidden or undeclared)… |
CVE-2026-32817 | Critical | 9.1 | 2026-03-20 | Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the current user ha… |
CVE-2026-32813 | High | 8.0 | 2026-03-20 | Admidio is an open-source user management solution. Versions 5.0.6 and below are vulnerable to arbitrary SQL Injection through the MyList configuration feature… |
CVE-2026-32812 | Medium | 6.8 | 2026-03-20 | Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO Metadata API can result in SSRF and loca… |
CVE-2026-32811 | High | 8.2 | 2026-03-20 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. When using Heimdall in envoy gRPC decision API mode with versions 0.7.0-al… |
CVE-2026-32808 | High | 8.1 | 2026-03-20 | pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verificatio… |
CVE-2026-32711 | High | 7.8 | 2026-03-20 | pydicom is a pure Python package for working with DICOM files. Versions 2.0.0-rc.1 through 3.0.1 are vulnerable to Path Traversal through a maliciously crafted… |
CVE-2026-32829 | High | 7.5 | 2026-03-20 | lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sen… |
CVE-2026-32828 | Medium | 4.9 | 2026-03-20 | Kargo manages and automates the promotion of software artifacts. In versions 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7.8, 1.8.0-rc.1 through 1.8.11, and 1.9… |
CVE-2026-32771 | Critical | 9.8 | 2026-03-20 | The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). In versio… |
CVE-2026-32769 | Critical | 9.8 | 2026-03-20 | Fullchain is an umbrella project for deploying a ready-to-use CTF platform. In versions prior to 0.1.1, due to a mis-written NetworkPolicy, a malicious actor… |
CVE-2026-32767 | Critical | 9.8 | 2026-03-20 | SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextSearchBlock… |
CVE-2026-33289 | High | 8.8 | 2026-03-20 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an LDAP Injection… |
CVE-2026-33288 | High | 8.8 | 2026-03-20 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, a SQL Injection v… |
CVE-2026-32985 | Critical | 9.8 | 2026-03-20 | Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows… |
CVE-2026-32766 | Medium | 5.3 | 2026-03-20 | astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when pa… |
CVE-2026-32763 | High | 8.2 | 2026-03-20 | Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL a… |
CVE-2026-32761 | Medium | 6.5 | 2026-03-20 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.0 and be… |
CVE-2026-32760 | Critical | 9.8 | 2026-03-20 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions 2.61.2 and… |
CVE-2026-32759 | High | 8.1 | 2026-03-20 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions on the 2.x… |
CVE-2026-32758 | Medium | 6.5 | 2026-03-20 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.2 and be… |
CVE-2026-32757 | Medium | 5.4 | 2026-03-20 | Admidio is an open-source user management solution. In versions 5.0.6 and below, the eCard send handler uses a raw $_POST['ecard_message'] value instead of the… |
CVE-2026-32756 | High | 8.8 | 2026-03-20 | Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documents & Files… |
CVE-2026-32697 | Medium | 6.5 | 2026-03-20 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, the `RecordHandler::getRecor… |
CVE-2026-29189 | High | 8.1 | 2026-03-20 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the SuiteCRM REST… |
CVE-2026-29109 | High | 7.2 | 2026-03-20 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions up to and including 8.9.2 contain an unsafe… |
CVE-2026-29108 | Medium | 6.5 | 2026-03-20 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, an authenticated API endpoin… |
CVE-2026-22737 | Medium | 5.9 | 2026-03-20 | Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from… |
CVE-2026-22735 | Low | 2.6 | 2026-03-20 | Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 t… |
CVE-2026-22733 | High | 8.2 | 2026-03-20 | Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication… |
CVE-2026-33408 | Low | 2.2 | 2026-03-19 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, moderators were able to see the first 40 characte… |
CVE-2026-33395 | Medium | 4.4 | 2026-03-19 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the discourse-graphviz plugin contains a stored c… |
CVE-2026-32818 | Medium | 6.5 | 2026-03-19 | Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the forum module in Admidio does not verify whether the current user has p… |