2026 CVEs (page 601)
Page 601 of 665 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-30965 | Critical | 9.1 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.8 and 8.6.21, a vulnerability in P… |
CVE-2026-30962 | Medium | 6.5 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.6 and 8.6.19, the validation for p… |
CVE-2026-30954 | Medium | 4.3 | 2026-03-10 | LinkAce is a self-hosted archive to collect website links. In 2.1.0 and earlier, the processTaxonomy() method in LinkRepository.php allows authenticated users… |
CVE-2026-30953 | High | 7.7 | 2026-03-10 | LinkAce is a self-hosted archive to collect website links. When a user creates a link via POST /links, the server fetches HTML metadata from the provided URL (… |
CVE-2026-30952 | High | 7.5 | 2026-03-10 | liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file… |
CVE-2026-30951 | High | 7.5 | 2026-03-10 | Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() fun… |
CVE-2026-30949 | High | 8.8 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.5 and 8.6.18, the Keycloak authent… |
CVE-2026-30948 | Medium | 5.4 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.4 and 8.6.17, a stored cross-site… |
CVE-2026-30947 | High | 7.5 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.3 and 8.6.16, class-level permissi… |
CVE-2026-30946 | High | 7.5 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated atta… |
CVE-2026-30837 | High | 7.5 | 2026-03-10 | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Prior to 1.4.26 , t.String({ fo… |
CVE-2026-0124 | High | 7.8 | 2026-03-10 | There is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges… |
CVE-2026-0123 | High | 8.4 | 2026-03-10 | In EfwApTransport::ProcessRxRing of efw_ap_transport.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escala… |
CVE-2026-0122 | High | 8.4 | 2026-03-10 | In multiple places, there is a possible out of bounds write due to memory corruption. This could lead to remote code execution with no additional execution pri… |
CVE-2026-0121 | Low | 2.9 | 2026-03-10 | In VPU, there is a possible use-after-free read due to a race condition. This could lead to local information disclosure with no additional execution privilege… |
CVE-2026-0120 | Critical | 9.8 | 2026-03-10 | In modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privi… |
CVE-2026-0119 | Medium | 6.8 | 2026-03-10 | In usim_SendMCCMNCIndMsg of usim_Registration.c, there is a possible out of bounds write due to memory corruption. This could lead to physical escalation of pr… |
CVE-2026-0118 | High | 8.4 | 2026-03-10 | In oobconfig, there is a possible bypass of carrier restrictions due to a logic error. This could lead to local escalation of privilege with no additional exec… |
CVE-2026-0117 | High | 8.4 | 2026-03-10 | In mfc_dec_dqbuf of mfc_dec_v4l2.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege… |
CVE-2026-0116 | Critical | 9.8 | 2026-03-10 | In __mfc_handle_released_buf of mfc_core_isr.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution… |
CVE-2026-0115 | Low | 2.1 | 2026-03-10 | In Trusted Execution Environment, there is a possible key leak due to side channel information disclosure. This could lead to physical information disclosure w… |
CVE-2026-0114 | Critical | 9.8 | 2026-03-10 | In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privi… |
CVE-2026-0113 | Critical | 9.8 | 2026-03-10 | In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of pri… |
CVE-2026-0112 | High | 7.4 | 2026-03-10 | In vpu_open_inst of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additiona… |
CVE-2026-0111 | Critical | 9.8 | 2026-03-10 | In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of pri… |
CVE-2026-0110 | Critical | 9.8 | 2026-03-10 | In MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp, there is a possible EoP due to memory corruption. This could lead to remote escalation of privilege with no additio… |
CVE-2026-0109 | High | 7.5 | 2026-03-10 | In dhd_tcpdata_info_get of dhd_ip.c, there is a possible Denial of Service due to a precondition check failure. This could lead to remote denial of service wit… |
CVE-2026-0108 | Medium | 4.0 | 2026-03-10 | The register protection of the PowerVR GPU is incorrectly configured. This could lead to local information disclosure with no additional execution privileges n… |
CVE-2026-0107 | High | 8.4 | 2026-03-10 | In gmc_ddr_handle_mba_mr_req of gmc_mba_ddr.c, there is a possible escalation of privileges due to a confused deputy. This could lead to local escalation of pr… |
CVE-2026-3582 | Medium | 4.3 | 2026-03-10 | An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PA… |
CVE-2026-2713 | High | 7.4 | 2026-03-10 | IBM Trusteer Rapport installer 3.5.2309.290 IBM Trusteer Rapport could allow a local attacker to execute arbitrary code on the system, caused by DLL uncontroll… |
CVE-2026-2266 | Medium | 5.4 | 2026-03-10 | An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed DOM-based cross-site scripting via task list content… |
CVE-2026-29793 | Critical | 9.8 | 2026-03-10 | Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can s… |
CVE-2026-29792 | Critical | 9.8 | 2026-03-10 | Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attac… |
CVE-2026-29177 | Medium | 5.4 | 2026-03-10 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerc… |
CVE-2026-29176 | Medium | 4.8 | 2026-03-10 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, A stored XSS vulnerability exists in the Commerce Settings - Inventory Locations page. T… |
CVE-2026-29175 | Medium | 5.4 | 2026-03-10 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product Title, Vari… |
CVE-2026-29174 | High | 8.8 | 2026-03-10 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levels table data endpoin… |
CVE-2026-29173 | Medium | 4.8 | 2026-03-10 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Statu… |
CVE-2026-29172 | High | 8.8 | 2026-03-10 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpo… |
CVE-2026-29113 | Medium | 4.3 | 2026-03-10 | Craft is a content management system (CMS). Prior to 4.17.3 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-toke… |
CVE-2026-28495 | Critical | 9.6 | 2026-03-10 | GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to ov… |
CVE-2026-27825 | Critical | 9.0 | 2026-03-10 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, the `confluence_download_attachme… |
CVE-2026-26330 | Medium | 5.3 | 2026-03-10 | Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At the rate limit filter, if the response phase limit with… |
CVE-2026-26311 | Medium | 5.9 | 2026-03-10 | Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a logic vulnerability in Envoy's HTTP connection manager (… |
CVE-2026-26310 | Medium | 5.9 | 2026-03-10 | Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, calling Utility::getAddressWithPort with a scoped IPv6 add… |
CVE-2026-26309 | Medium | 5.3 | 2026-03-10 | Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, an off-by-one write in Envoy::JsonEscaper::escapeString()… |
CVE-2026-26308 | High | 7.5 | 2026-03-10 | Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains… |
CVE-2026-26123 | Medium | 5.5 | 2026-03-10 | Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally. |
CVE-2026-23868 | Medium | 5.1 | 2026-03-10 | Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to tr… |
CVE-2026-28292 | Critical | 9.8 | 2026-03-10 | `simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypas… |
CVE-2026-27826 | High | 8.2 | 2026-03-10 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, an unauthenticated attacker who c… |
CVE-2026-27281 | Medium | 5.5 | 2026-03-10 | DNG SDK versions 1.7.1 2471 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An at… |
CVE-2026-27280 | High | 7.8 | 2026-03-10 | DNG SDK versions 1.7.1 2471 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-27279 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-27277 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-27276 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-27275 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-27274 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-27273 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-27269 | High | 7.8 | 2026-03-10 | Premiere Pro versions 25.5 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the e… |
CVE-2026-27219 | Medium | 5.5 | 2026-03-10 | Substance3D - Painter versions 11.1.2 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could lev… |
CVE-2026-27218 | Medium | 5.5 | 2026-03-10 | Substance3D - Painter versions 11.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An… |
CVE-2026-27217 | Medium | 5.5 | 2026-03-10 | Substance3D - Painter versions 11.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An… |
CVE-2026-27216 | Medium | 5.5 | 2026-03-10 | Substance3D - Painter versions 11.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could lev… |
CVE-2026-27215 | Medium | 5.5 | 2026-03-10 | Substance3D - Painter versions 11.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An… |
CVE-2026-27214 | Medium | 5.5 | 2026-03-10 | Substance3D - Painter versions 11.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An… |
CVE-2026-26801 | High | 7.5 | 2026-03-10 | Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via th… |
CVE-2026-26742 | High | 8.1 | 2026-03-10 | PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the "Re-arm Grace Period" logic. The system incorrectly applies the in-a… |
CVE-2026-26741 | High | 8.1 | 2026-03-10 | PX4 Autopilot versions 1.12.x through 1.15.x contain a logic flaw in the mode switching mechanism. When switching from Auto mode to Manual mode while the drone… |
CVE-2026-21365 | Medium | 5.5 | 2026-03-10 | Substance3D - Painter versions 11.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could lev… |
CVE-2026-21364 | Medium | 5.5 | 2026-03-10 | Substance3D - Painter versions 11.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An… |
CVE-2026-21363 | Medium | 5.5 | 2026-03-10 | Substance3D - Painter versions 11.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An… |
CVE-2026-3862 | Medium | 4.8 | 2026-03-10 | Cross-site Scripting (XSS) allows an attacker to submit specially crafted data to the application which is returned unaltered in the resulting web page. |
CVE-2026-3854 | High | 8.8 | 2026-03-10 | An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a reposito… |
CVE-2026-3847 | High | 8.8 | 2026-03-10 | Memory safety bugs present in Firefox 148.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these cou… |
CVE-2026-3846 | Medium | 6.5 | 2026-03-10 | Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 148.0.2. |
CVE-2026-3845 | High | 8.8 | 2026-03-10 | Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android. This vulnerability was fixed in Firefox 148.0.2. |
CVE-2026-3843 | Critical | 9.8 | 2026-03-10 | Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module… |
CVE-2026-3483 | High | 7.8 | 2026-03-10 | An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges. |
CVE-2026-3315 | High | 7.8 | 2026-03-10 | Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Vis… |
CVE-2026-3306 | Medium | 4.3 | 2026-03-10 | An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a p… |
CVE-2026-3228 | Medium | 6.4 | 2026-03-10 | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[nxs_fbembed]` shortcode in all version… |
CVE-2026-31797 | Medium | 6.1 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CTiffImg… |
CVE-2026-31796 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow in icCurve… |
CVE-2026-31795 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow write in CIccXf… |
CVE-2026-31794 | Medium | 5.5 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a segmentation fault from invalid/wild… |
CVE-2026-31793 | Medium | 5.5 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a segmentation fault due to invalid/wil… |
CVE-2026-31792 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a null pointer dereference in CIccTagXm… |
CVE-2026-30987 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow in CIccTagNum<>… |
CVE-2026-30986 | Medium | 5.5 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow write in C… |
CVE-2026-30985 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow write in C… |
CVE-2026-30984 | Medium | 6.1 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CIccCalcul… |
CVE-2026-30983 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow in icFixXml() (… |
CVE-2026-30982 | Medium | 6.1 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CIccPcsXfo… |
CVE-2026-30981 | Medium | 6.1 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-buffer-overflow read in CIccXmlA… |
CVE-2026-30980 | Medium | 5.5 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack overflow in CIccBasicStructFact… |
CVE-2026-30979 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow in CIccCal… |
CVE-2026-30978 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-use-after-free in CIccCmm::AddXf… |
CVE-2026-30977 | | 2026-03-10 | RenderBlocking is a MediaWiki extension that allows interface administrators to specify render-blocking CSS and JavaScript. Prior to 0.1.1, there is Stored XSS… |