2026 CVEs (page 614)
Page 614 of 664 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2256 | Medium | 6.5 | 2026-03-02 | A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system co… |
CVE-2026-27631 | Medium | 5.3 | 2026-03-02 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaugh… |
CVE-2026-27596 | High | 7.5 | 2026-03-02 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-… |
CVE-2026-26713 | Critical | 9.8 | 2026-03-02 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/cancel-order.php. |
CVE-2026-26712 | Critical | 9.8 | 2026-03-02 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket-admin.php. |
CVE-2026-25884 | High | 8.1 | 2026-03-02 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-… |
CVE-2026-25477 | Medium | 6.1 | 2026-03-02 | AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.26.0, there is an Open Redirect vulnerability located at the /redire… |
CVE-2026-21882 | High | 8.4 | 2026-03-02 | theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping a… |
CVE-2026-26711 | Critical | 9.8 | 2026-03-02 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket.php. |
CVE-2026-26710 | Critical | 9.8 | 2026-03-02 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/edit-orders.php. |
CVE-2026-26709 | Critical | 9.8 | 2026-03-02 | code-projects Simple Gym Management System v1.0 is vulnerable to SQL Injection in /gym/trainer_search.php. |
CVE-2026-21853 | High | 8.8 | 2026-03-02 | AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.25.4, there is a one-click remote code execution vulnerability. This… |
CVE-2026-0047 | High | 8.4 | 2026-03-02 | In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This co… |
CVE-2026-0038 | High | 8.4 | 2026-03-02 | In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation… |
CVE-2026-0037 | High | 8.4 | 2026-03-02 | In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with n… |
CVE-2026-0035 | High | 8.4 | 2026-03-02 | In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing files due to a logic error in the code. Th… |
CVE-2026-0034 | High | 8.4 | 2026-03-02 | In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation. This could lead to lo… |
CVE-2026-0032 | High | 7.8 | 2026-03-02 | In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to local escalation of privil… |
CVE-2026-0031 | High | 8.4 | 2026-03-02 | In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege wi… |
CVE-2026-0030 | High | 8.4 | 2026-03-02 | In __host_check_page_state_range of mem_protect.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalatio… |
CVE-2026-0029 | High | 8.4 | 2026-03-02 | In __pkvm_init_vm of pkvm.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no a… |
CVE-2026-0028 | High | 8.4 | 2026-03-02 | In __pkvm_host_share_guest of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privile… |
CVE-2026-0027 | Medium | 6.7 | 2026-03-02 | In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with Sys… |
CVE-2026-0026 | High | 7.8 | 2026-03-02 | In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error in the code. This cou… |
CVE-2026-0025 | High | 8.4 | 2026-03-02 | In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass. This could lead to local escalation o… |
CVE-2026-0024 | Medium | 4.0 | 2026-03-02 | In isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of media due to a missing permission check… |
CVE-2026-0023 | High | 7.8 | 2026-03-02 | In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This co… |
CVE-2026-0021 | High | 8.4 | 2026-03-02 | In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to loca… |
CVE-2026-0020 | High | 8.4 | 2026-03-02 | In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass. Th… |
CVE-2026-0017 | High | 7.7 | 2026-03-02 | In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalatio… |
CVE-2026-0015 | Medium | 6.2 | 2026-03-02 | In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial… |
CVE-2026-0014 | Medium | 6.2 | 2026-03-02 | In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local den… |
CVE-2026-0013 | High | 8.4 | 2026-03-02 | In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local esca… |
CVE-2026-0012 | Medium | 6.2 | 2026-03-02 | In setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error in the code. This could lead to local inf… |
CVE-2026-0011 | High | 8.4 | 2026-03-02 | In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead t… |
CVE-2026-0010 | High | 8.4 | 2026-03-02 | In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privileg… |
CVE-2026-0008 | High | 8.4 | 2026-03-02 | In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy. This could lead to local escalation of privilege wit… |
CVE-2026-0007 | High | 8.6 | 2026-03-02 | In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to… |
CVE-2026-0006 | Critical | 9.8 | 2026-03-02 | In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead to remote code execution with no additio… |
CVE-2026-0005 | Medium | 6.2 | 2026-03-02 | In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps withou… |
CVE-2026-3180 | High | 7.5 | 2026-03-02 | The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordE… |
CVE-2026-3132 | High | 8.8 | 2026-03-02 | The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.3 via the 'JLTMA_… |
CVE-2026-26707 | Critical | 9.8 | 2026-03-02 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_supplier.php. |
CVE-2026-26706 | Critical | 9.8 | 2026-03-02 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_receipt.php. |
CVE-2026-26705 | Critical | 9.8 | 2026-03-02 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_product.php. |
CVE-2026-26704 | Critical | 9.8 | 2026-03-02 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_category.php. |
CVE-2026-0655 | High | 8.0 | 2026-03-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjac… |
CVE-2026-0654 | High | 8.0 | 2026-03-02 | Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authent… |
CVE-2026-28401 | Medium | 5.4 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization enables st… |
CVE-2026-28399 | High | 8.8 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the D… |
CVE-2026-28398 | Medium | 5.4 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, user-controlled content in comments and rich text cells was rendered via v… |
CVE-2026-28397 | Medium | 5.4 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, comments rendered via v-html without sanitization enable stored XSS. This… |
CVE-2026-28396 | Medium | 6.5 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing a… |
CVE-2026-28361 | Medium | 6.3 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not validate token ownership, allowing a Creator… |
CVE-2026-28360 | Medium | 5.3 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compare… |
CVE-2026-28359 | Medium | 5.4 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich… |
CVE-2026-28358 | Medium | 5.3 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered a… |
CVE-2026-28357 | Medium | 5.4 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula res… |
CVE-2026-28286 | High | 8.5 | 2026-03-02 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in… |
CVE-2026-26708 | Critical | 9.8 | 2026-03-02 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php. |
CVE-2026-26700 | Critical | 9.8 | 2026-03-02 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php. |
CVE-2026-24105 | Critical | 9.8 | 2026-03-02 | An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leading to a command in… |
CVE-2026-23865 | Medium | 5.3 | 2026-03-02 | An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read… |
CVE-2026-21385 | High | 7.8 | 2026-03-02 | Memory corruption while using alignments for memory allocation. |
CVE-2026-28412 | Medium | 6.5 | 2026-03-02 | Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server imposes no limit on concurrent connections. Combined w… |
CVE-2026-28403 | High | 7.6 | 2026-03-02 | Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server (`ws://127.0.0.1:<httpPort+1>`) accepts connections fr… |
CVE-2026-26720 | Critical | 9.8 | 2026-03-02 | An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module. |
CVE-2026-26701 | Critical | 9.8 | 2026-03-02 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user.php. |
CVE-2026-26699 | High | 7.2 | 2026-03-02 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/admin_change_picture.php. |
CVE-2026-24112 | Critical | 9.8 | 2026-03-02 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of `userInfo`. When `userInfo` is pass… |
CVE-2026-24110 | Critical | 9.8 | 2026-03-02 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may send overly long `addDhcpRules` data. When these rules enter the `addDhcpRule` function… |
CVE-2026-24101 | Critical | 9.8 | 2026-03-02 | An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi. When the condition is met, `s1_1` will be passed into sub_B0488, concatenat… |
CVE-2026-0689 | Medium | 4.9 | 2026-03-02 | In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retr… |
CVE-2026-26703 | Critical | 9.8 | 2026-03-02 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/advance_search.php. |
CVE-2026-26702 | Critical | 9.8 | 2026-03-02 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/myitem_reuse.php. |
CVE-2026-26696 | Critical | 9.8 | 2026-03-02 | code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_edit.php. |
CVE-2026-26695 | Critical | 9.8 | 2026-03-02 | code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordstudent_edit.php. |
CVE-2026-26694 | Critical | 9.8 | 2026-03-02 | code-projects Simple Student Alumni System v1.0 is vulnerale to SQL Injection in /TracerStudy/modal_view.php. |
CVE-2026-24115 | Critical | 9.8 | 2026-03-02 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the sizes of `gstup` and `gstdwn` before concatenating them into `gstruleQos` may… |
CVE-2026-24114 | Critical | 9.8 | 2026-03-02 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate `pPortMapIndex` may lead to buffer overflows when using `strcpy`. |
CVE-2026-24113 | Critical | 9.8 | 2026-03-02 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed… |
CVE-2026-24111 | Critical | 9.8 | 2026-03-02 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of `userInfo`. When `userInfo` is pass… |
CVE-2026-24109 | Critical | 9.8 | 2026-03-02 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `picName`. When this value is used… |
CVE-2026-24108 | Critical | 9.8 | 2026-03-02 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed… |
CVE-2026-24107 | Critical | 9.8 | 2026-03-02 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the value of `usbPartitionName`, which is directly used in `doSystemCmd`, may lead… |
CVE-2026-23600 | Critical | 9.8 | 2026-03-02 | A remote authentication bypass vulnerability exists in HPE AutoPass License Server (APLS). |
CVE-2026-0995 | Low | 3.6 | 2026-03-02 | An issue has been identified in Arm C1-Pro before r1p2-50eac0, where, under certain conditions, a TLBI+DSB might fail to ensure the completion of memory access… |
CVE-2026-26698 | Medium | 4.9 | 2026-03-02 | code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/modal_edit.php. |
CVE-2026-26697 | Medium | 4.9 | 2026-03-02 | code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_view.php?teacherID=. |
CVE-2026-1628 | Medium | 4.6 | 2026-03-02 | Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious s… |
CVE-2026-3432 | Critical | 9.1 | 2026-03-02 | On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `cred… |
CVE-2026-3431 | Critical | 9.8 | 2026-03-02 | On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrict… |
CVE-2026-2584 | | 2026-03-02 | A critical SQL Injection (SQLi) vulnerability has been identified in the authentication module of the system. An unauthenticated, remote attacker (AV:N/PR:N) c… | |
CVE-2026-20445 | Medium | 4.4 | 2026-03-02 | In MDDP, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained the Sys… |
CVE-2026-20444 | Medium | 6.7 | 2026-03-02 | In display, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alre… |
CVE-2026-20443 | Medium | 6.7 | 2026-03-02 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2026-20442 | Medium | 4.4 | 2026-03-02 | In display, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the Sy… |
CVE-2026-20441 | Medium | 6.7 | 2026-03-02 | In MAE, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alread… |
CVE-2026-20440 | Medium | 6.7 | 2026-03-02 | In MAE, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alread… |
CVE-2026-20439 | Medium | 4.4 | 2026-03-02 | In imgsys, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the Sys… |