2026 CVEs (page 597)
Page 597 of 665 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-31890 | Medium | 5.5 | 2026-03-12 | Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. Prior to 0.50.1… |
CVE-2026-31873 | Unrated | | 2026-03-12 | Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe (safe.ts) uses String.includes(), which is case-sensitive… |
CVE-2026-31860 | Medium | 6.1 | 2026-03-12 | Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, i… |
CVE-2026-28256 | Critical | 9.8 | 2026-03-12 | A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensiti… |
CVE-2026-28255 | Critical | 9.8 | 2026-03-12 | A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information an… |
CVE-2026-28254 | High | 7.5 | 2026-03-12 | A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive informat… |
CVE-2026-28253 | High | 7.5 | 2026-03-12 | A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to cau… |
CVE-2026-28252 | Critical | 9.8 | 2026-03-12 | A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authent… |
CVE-2026-26795 | Critical | 9.8 | 2026-03-12 | GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log function. This vulnera… |
CVE-2026-26794 | High | 8.8 | 2026-03-12 | GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows attackers to execut… |
CVE-2026-26792 | Critical | 9.8 | 2026-03-12 | GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version… |
CVE-2026-26791 | Critical | 9.8 | 2026-03-12 | GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_server function. This… |
CVE-2026-4045 | Low | 3.7 | 2026-03-12 | A flaw has been found in projectsend up to r1945. This impacts an unknown function of the file includes/Classes/Auth.php. Executing a manipulation of the argum… |
CVE-2026-31841 | Medium | 6.5 | 2026-03-12 | Hyperterse is a tool-first MCP framework for building AI-ready backend surfaces from declarative config. Prior to v2.2.0, the search tool allows LLMs to search… |
CVE-2026-29066 | Medium | 6.2 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's bu… |
CVE-2026-28793 | High | 8.4 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal… |
CVE-2026-28792 | Critical | 9.6 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin… |
CVE-2026-28791 | High | 7.4 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.7, a path traversal vulnerability exists in the TinaCMS development server's media upload handler. T… |
CVE-2026-28356 | High | 7.5 | 2026-03-12 | multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regu… |
CVE-2026-27940 | High | 7.8 | 2026-03-12 | llama.cpp is an inference of several LLM models in C/C++. Prior to b8146, the gguf_init_from_file_impl() in gguf.cpp is vulnerable to an Integer overflow, lead… |
CVE-2026-25529 | High | 8.1 | 2026-03-12 | Postal is an open source SMTP server. Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed unescaped data to be included in the admi… |
CVE-2026-24125 | Medium | 6.3 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using relative file paths (r… |
CVE-2026-21887 | High | 7.7 | 2026-03-12 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion fea… |
CVE-2026-21708 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user. |
CVE-2026-21672 | High | 8.8 | 2026-03-12 | A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers. |
CVE-2026-4044 | Low | 3.8 | 2026-03-12 | A vulnerability was detected in projectsend up to r1945. This affects the function realpath of the file /import-orphans.php of the component Delete Handler. Pe… |
CVE-2026-4043 | High | 8.8 | 2026-03-12 | A security vulnerability has been detected in Tenda i12 1.0.0.6(2204). The impacted element is the function formwrlSSIDget of the file /goform/wifiSSIDget. Suc… |
CVE-2026-4042 | High | 8.8 | 2026-03-12 | A weakness has been identified in Tenda i12 1.0.0.6(2204). The affected element is the function formWifiMacFilterGet of the file /goform/WifiMacFilterGet. This… |
CVE-2026-4041 | High | 8.8 | 2026-03-12 | A security flaw has been discovered in Tenda i12 1.0.0.6(2204). Impacted is the function vos_strcpy of the file /goform/exeCommand. The manipulation of the arg… |
CVE-2026-28384 | Critical | 9.9 | 2026-03-12 | An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daem… |
CVE-2026-21671 | Critical | 9.1 | 2026-03-12 | A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments… |
CVE-2026-21670 | High | 7.7 | 2026-03-12 | A vulnerability allowing a low-privileged user to extract saved SSH credentials. |
CVE-2026-21669 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. |
CVE-2026-21668 | High | 8.8 | 2026-03-12 | A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository. |
CVE-2026-21667 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. |
CVE-2026-21666 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. |
CVE-2026-3099 | Medium | 5.8 | 2026-03-12 | A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or en… |
CVE-2026-2987 | Medium | 6.1 | 2026-03-12 | The Simple Ajax Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'c' parameter in versions up to, and including, 20260217 due to… |
CVE-2026-2514 | Medium | 6.1 | 2026-03-12 | In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft mali… |
CVE-2026-2513 | Medium | 6.1 | 2026-03-12 | A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacke… |
CVE-2026-0809 | | 2026-03-12 | Use of a custom token encoding algorithm in Streamsoft Prestiż software allows the value of the KSeF (Krajowy System e-Faktur) token to be guessed after analyz… | |
CVE-2026-4040 | Low | 3.3 | 2026-03-12 | A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The ma… |
CVE-2026-4039 | Medium | 6.3 | 2026-03-12 | A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler… |
CVE-2026-3989 | High | 7.8 | 2026-03-12 | SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by pr… |
CVE-2026-3060 | Critical | 9.8 | 2026-03-12 | SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes unt… |
CVE-2026-3059 | Critical | 9.8 | 2026-03-12 | SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pi… |
CVE-2026-3234 | Medium | 4.3 | 2026-03-12 | A flaw was found in mod_proxy_cluster. This vulnerability, a Carriage Return Line Feed (CRLF) injection in the decodeenc() function, allows a remote attacker… |
CVE-2026-2366 | Low | 3.1 | 2026-03-12 | A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative… |
CVE-2026-4016 | Medium | 5.3 | 2026-03-12 | A security vulnerability has been detected in GPAC 26.03-DEV. Affected by this vulnerability is the function svgin_process of the file src/filters/load_svg.c o… |
CVE-2026-4015 | Medium | 5.3 | 2026-03-12 | A weakness has been identified in GPAC 26.03-DEV. Affected is the function txtin_process_texml of the file src/filters/load_text.c of the component TeXML File… |
CVE-2026-4014 | High | 7.3 | 2026-03-12 | A security flaw has been discovered in itsourcecode Cafe Reservation System 1.0. This impacts an unknown function of the file /curvus2/signup.php of the compon… |
CVE-2026-4013 | Medium | 6.3 | 2026-03-12 | A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown function of the file add_admin.php… |
CVE-2026-4012 | Low | 3.3 | 2026-03-12 | A vulnerability was determined in rxi fe up to ed4cda96bd582cbb08520964ba627efb40f3dd91. The impacted element is the function read_ of the file src/fe.c. This… |
CVE-2026-4010 | Low | 3.3 | 2026-03-12 | A vulnerability was found in ThakeeNathees pocketlang up to cc73ca61b113d48ee130d837a7a8b145e41de5ce. The affected element is the function pkByteBufferAddStrin… |
CVE-2026-4009 | Low | 3.3 | 2026-03-12 | A vulnerability has been found in jarikomppa soloud up to 20200207. Impacted is the function drwav_read_pcm_frames_s16__msadpcm in the library src/audiosource/… |
CVE-2026-4008 | High | 8.8 | 2026-03-12 | A flaw has been found in Tenda W3 1.0.0.3(2204). This issue affects some unknown processing of the file /goform/wifiSSIDset of the component POST Parameter Han… |
CVE-2026-4007 | High | 8.8 | 2026-03-12 | A vulnerability was detected in Tenda W3 1.0.0.3(2204). This vulnerability affects unknown code of the file /goform/wifiSSIDget of the component POST Parameter… |
CVE-2026-3994 | Medium | 5.3 | 2026-03-12 | A vulnerability was detected in rui314 mold up to 2.40.4. This issue affects the function mold::ObjectFilemold::X86_64::initialize_sections of the file src/inp… |
CVE-2026-3993 | Medium | 4.3 | 2026-03-12 | A security vulnerability has been detected in itsourcecode Payroll Management System 1.0. This vulnerability affects unknown code of the file /manage_employee_… |
CVE-2026-3992 | Medium | 6.3 | 2026-03-12 | A weakness has been identified in CodeGenieApp serverless-express up to 4.17.1. This affects an unknown part of the file utils/dynamodb.ts of the component Use… |
CVE-2026-3990 | Medium | 4.3 | 2026-03-12 | A security flaw has been discovered in CesiumGS CesiumJS up to 1.137.0. Affected by this issue is some unknown functionality of the file Apps/Sandcastle/standa… |
CVE-2026-3984 | Low | 3.5 | 2026-03-12 | A weakness has been identified in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This vulnerability affects unknown code of the file… |
CVE-2026-3983 | Low | 3.5 | 2026-03-12 | A security flaw has been discovered in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This affects an unknown part of the file save-g… |
CVE-2026-2687 | Medium | 4.3 | 2026-03-12 | The Reading progressbar WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2026-3982 | Medium | 4.3 | 2026-03-12 | A vulnerability was determined in itsourcecode University Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_r… |
CVE-2026-3981 | High | 7.3 | 2026-03-12 | A vulnerability was found in itsourcecode Online Doctor Appointment System 1.0. Affected is an unknown function of the file /admin/doctor_action.php. Performin… |
CVE-2026-3980 | High | 7.3 | 2026-03-12 | A vulnerability has been found in itsourcecode Online Doctor Appointment System 1.0. This impacts an unknown function of the file /admin/patient_action.php. Su… |
CVE-2026-3979 | Medium | 5.3 | 2026-03-12 | A flaw has been found in quickjs-ng quickjs up to 0.12.1. This affects the function js_iterator_concat_return of the file quickjs.c. This manipulation causes u… |
CVE-2026-3978 | High | 8.8 | 2026-03-12 | A vulnerability was detected in D-Link DIR-513 1.10. The impacted element is an unknown function of the file /goform/formEasySetupWizard3. The manipulation of… |
CVE-2026-3977 | Medium | 6.3 | 2026-03-12 | A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipul… |
CVE-2026-3976 | High | 8.8 | 2026-03-12 | A weakness has been identified in Tenda W3 1.0.0.3(2204). Impacted is the function formWifiMacFilterSet of the file /goform/WifiMacFilterSet of the component P… |
CVE-2026-3975 | High | 8.8 | 2026-03-12 | A security flaw has been discovered in Tenda W3 1.0.0.3(2204). This issue affects the function formWifiMacFilterGet of the file /goform/WifiMacFilterGet of the… |
CVE-2026-3974 | High | 8.8 | 2026-03-12 | A vulnerability was identified in Tenda W3 1.0.0.3(2204). This vulnerability affects the function formexeCommand of the file /goform/exeCommand of the componen… |
CVE-2026-3657 | High | 7.5 | 2026-03-12 | The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX action in all versions up to, and including… |
CVE-2026-3226 | Medium | 4.3 | 2026-03-12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all… |
CVE-2026-1878 | | 2026-03-12 | An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM. The vulnerab… | |
CVE-2026-3973 | High | 8.8 | 2026-03-12 | A vulnerability was determined in Tenda W3 1.0.0.3(2204). This affects the function formSetAutoPing of the file /goform/setAutoPing of the component POST Param… |
CVE-2026-3972 | High | 8.8 | 2026-03-12 | A vulnerability was found in Tenda W3 1.0.0.3(2204). Affected by this issue is the function formSetCfm of the file /goform/setcfm of the component HTTP Handler… |
CVE-2026-1182 | Medium | 4.3 | 2026-03-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allow… |
CVE-2026-3971 | High | 8.8 | 2026-03-12 | A vulnerability has been found in Tenda i3 1.0.0.6(2204). Affected by this vulnerability is the function formwrlSSIDset of the file /goform/wifiSSIDset. The ma… |
CVE-2026-3970 | High | 8.8 | 2026-03-12 | A flaw has been found in Tenda i3 1.0.0.6(2204). Affected is the function formwrlSSIDget of the file /goform/wifiSSIDget. Executing a manipulation of the argum… |
CVE-2026-3969 | High | 7.3 | 2026-03-12 | A vulnerability was detected in FeMiner wms up to 1.0. This impacts an unknown function of the file /wms-master/src/basic/depart/depart_add_bg.php of the compo… |
CVE-2026-3968 | Medium | 6.3 | 2026-03-12 | A vulnerability has been found in AutohomeCorp frostmourne up to 1.0. This affects the function scriptEngine.eval of the file ExpressionRule.java of the compon… |
CVE-2026-3967 | Medium | 6.3 | 2026-03-12 | A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-co… |
CVE-2026-3966 | Medium | 6.3 | 2026-03-12 | A vulnerability was detected in 648540858 wvp-GB28181-pro up to 2.7.4-20260107. Affected by this vulnerability is the function getDownloadFilePath of the file… |
CVE-2026-3965 | Medium | 6.3 | 2026-03-12 | A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the componen… |
CVE-2026-2808 | Medium | 6.8 | 2026-03-12 | HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. T… |
CVE-2026-3964 | Medium | 5.3 | 2026-03-11 | A weakness has been identified in OpenAkita up to 1.24.3. This impacts the function run of the file src/openakita/tools/shell.py of the component Chat API Endp… |
CVE-2026-3963 | Low | 3.7 | 2026-03-11 | A security flaw has been discovered in perfree go-fastdfs-web up to 1.3.7. This affects the function rememberMeManager of the file src/main/java/com/perfree/co… |
CVE-2026-3962 | Medium | 4.3 | 2026-03-11 | A vulnerability was identified in Jcharis Machine-Learning-Web-Apps up to a6996b634d98ccec4701ac8934016e8175b60eb5. The impacted element is the function render… |
CVE-2026-31988 | Medium | 5.3 | 2026-03-11 | yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLa… |
CVE-2026-3961 | Medium | 6.3 | 2026-03-11 | A vulnerability was determined in zyddnys manga-image-translator up to beta-0.3. The affected element is the function to_pil_image of the file manga-image-tran… |
CVE-2026-3959 | Medium | 5.3 | 2026-03-11 | A vulnerability was found in 0xKoda WireMCP up to 7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e. Impacted is the function server.tool of the file index.js of the co… |
CVE-2026-3958 | Medium | 6.3 | 2026-03-11 | A vulnerability has been found in Woahai321 ListSync up to 0.6.6. This issue affects the function requests.post of the file list-sync-main/api_server.py of the… |
CVE-2026-3942 | Medium | 4.3 | 2026-03-11 | Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-3941 | Medium | 4.3 | 2026-03-11 | Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2026-3940 | Medium | 5.3 | 2026-03-11 | Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2026-3939 | Medium | 5.3 | 2026-03-11 | Insufficient policy enforcement in PDF in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted PDF fi… |
CVE-2026-3938 | Medium | 4.3 | 2026-03-11 | Insufficient policy enforcement in Clipboard in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the renderer process to leak… |
CVE-2026-3937 | Medium | 6.5 | 2026-03-11 | Incorrect security UI in Downloads in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page… |