2026 CVEs (page 615)
Page 615 of 664 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20438 | Medium | 6.4 | 2026-03-02 | In MAE, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2026-20437 | Medium | 4.4 | 2026-03-02 | In MAE, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System… |
CVE-2026-20436 | Medium | 6.7 | 2026-03-02 | In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious… |
CVE-2026-20435 | Medium | 4.6 | 2026-03-02 | In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has p… |
CVE-2026-20434 | High | 7.5 | 2026-03-02 | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a… |
CVE-2026-20430 | High | 8.8 | 2026-03-02 | In wlan AP FW, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege… |
CVE-2026-20429 | Medium | 4.4 | 2026-03-02 | In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has alre… |
CVE-2026-20428 | Medium | 6.7 | 2026-03-02 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2026-20427 | Medium | 6.7 | 2026-03-02 | In display, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor ha… |
CVE-2026-20426 | Medium | 6.7 | 2026-03-02 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2026-20425 | Medium | 6.7 | 2026-03-02 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2026-20424 | Medium | 4.4 | 2026-03-02 | In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has alre… |
CVE-2026-20423 | High | 7.8 | 2026-03-02 | In wlan STA driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with User execution… |
CVE-2026-20416 | High | 7.2 | 2026-03-02 | In pcie, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alrea… |
CVE-2026-3422 | Critical | 9.8 | 2026-03-02 | U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on t… |
CVE-2026-3413 | High | 7.3 | 2026-03-02 | A flaw has been found in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /admin_single_student.php. This man… |
CVE-2026-3000 | Critical | 9.8 | 2026-03-02 | IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to… |
CVE-2026-2999 | Critical | 9.8 | 2026-03-02 | IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to… |
CVE-2026-3412 | Medium | 4.3 | 2026-03-02 | A vulnerability was detected in itsourcecode University Management System 1.0. This affects an unknown part of the file /att_single_view.php. The manipulation… |
CVE-2026-3411 | High | 7.3 | 2026-03-02 | A security vulnerability has been detected in itsourcecode University Management System 1.0. Affected by this issue is some unknown functionality of the file /… |
CVE-2026-3410 | High | 7.3 | 2026-03-02 | A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/che… |
CVE-2026-3409 | High | 7.3 | 2026-03-02 | A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFileLoader.exec_module of the file /api/v1… |
CVE-2026-3408 | Medium | 4.3 | 2026-03-02 | A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML… |
CVE-2026-3407 | Low | 3.3 | 2026-03-02 | A vulnerability was determined in YosysHQ yosys up to 0.62. This affects the function Yosys::RTLIL::Const::set of the file kernel/rtlil.h of the component BLIF… |
CVE-2026-3406 | High | 7.3 | 2026-03-02 | A vulnerability was found in projectworlds Online Art Gallery Shop 1.0. The impacted element is an unknown function of the file /admin/registration.php of the… |
CVE-2026-3405 | Low | 3.1 | 2026-03-02 | A vulnerability has been found in thinkgem JeeSite up to 5.15.1. The affected element is an unknown function of the component Connection Handler. The manipulat… |
CVE-2026-3404 | Medium | 5.0 | 2026-03-02 | A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the com… |
CVE-2026-3403 | Low | 2.4 | 2026-03-02 | A vulnerability was detected in PHPGurukul Student Record Management System 1.0. This issue affects some unknown processing of the file /edit-subject.php. Perf… |
CVE-2026-3402 | Low | 2.4 | 2026-03-02 | A security vulnerability has been detected in PHPGurukul Student Record Management System up to 1.0. This vulnerability affects unknown code of the file /edit-… |
CVE-2026-3401 | Low | 3.1 | 2026-03-02 | A weakness has been identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part. This manipulation causes sessi… |
CVE-2026-3400 | High | 8.8 | 2026-03-02 | A security flaw has been discovered in Tenda AC15 up to 15.13.07.13. Affected by this issue is some unknown functionality of the file /goform/TextEditingConver… |
CVE-2026-3399 | High | 8.8 | 2026-03-01 | A vulnerability was identified in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer of the… |
CVE-2026-3398 | High | 8.8 | 2026-03-01 | A vulnerability was determined in Tenda F453 1.0.0.3. Affected is the function fromAdvSetWan of the file /goform/AdvSetWan of the component httpd. Executing a… |
CVE-2026-3395 | High | 7.3 | 2026-03-01 | A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php… |
CVE-2026-3394 | Low | 3.3 | 2026-03-01 | A vulnerability was detected in jarikomppa soloud up to 20200207. This affects the function SoLoud::Wav::loadwav of the file src/audiosource/wav/soloud_wav.cpp… |
CVE-2026-3393 | Low | 3.3 | 2026-03-01 | A security vulnerability has been detected in jarikomppa soloud up to 20200207. The impacted element is the function SoLoud::Wav::loadflac of the file src/audi… |
CVE-2026-3392 | Low | 3.3 | 2026-03-01 | A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulatio… |
CVE-2026-3391 | Low | 3.3 | 2026-03-01 | A security flaw has been discovered in FascinatedBox lily up to 2.3. Impacted is the function clear_storages of the file src/lily_emitter.c. The manipulation r… |
CVE-2026-3390 | Low | 3.3 | 2026-03-01 | A vulnerability was identified in FascinatedBox lily up to 2.3. This issue affects the function patch_line_end of the file src/lily_build_error.c of the compon… |
CVE-2026-3389 | Low | 3.3 | 2026-03-01 | A vulnerability was determined in Squirrel up to 3.2. This vulnerability affects the function sqstd_rex_newnode in the library sqstdlib/sqstdrex.cpp. Executing… |
CVE-2026-3388 | Low | 3.3 | 2026-03-01 | A vulnerability was found in Squirrel up to 3.2. This affects the function SQCompiler::Factor/SQCompiler::UnaryOP of the file squirrel/sqcompiler.cpp. Performi… |
CVE-2026-3387 | Low | 3.3 | 2026-03-01 | A vulnerability has been found in wren-lang wren up to 0.4.0. Affected by this issue is the function getByteCountForArguments of the file src/vm/wren_compiler… |
CVE-2026-3386 | Low | 3.3 | 2026-03-01 | A flaw has been found in wren-lang wren up to 0.4.0. Affected by this vulnerability is the function emitOp of the file src/vm/wren_compiler.c. This manipulatio… |
CVE-2026-3385 | Low | 3.3 | 2026-03-01 | A vulnerability was detected in wren-lang wren up to 0.4.0. Affected is the function resolveLocal of the file src/vm/wren_compiler.c. The manipulation results… |
CVE-2026-3384 | Low | 3.3 | 2026-03-01 | A security vulnerability has been detected in ChaiScript up to 6.1.0. This impacts the function chaiscript::eval::AST_Node_Impl::eval/chaiscript::eval::Functio… |
CVE-2026-3383 | Low | 3.3 | 2026-03-01 | A weakness has been identified in ChaiScript up to 6.1.0. This affects the function chaiscript::Boxed_Number::go of the file include/chaiscript/dispatchkit/box… |
CVE-2026-3382 | Low | 3.3 | 2026-03-01 | A security flaw has been discovered in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::Boxed_Number::get_as of the file include/chaisc… |
CVE-2026-3380 | High | 8.8 | 2026-03-01 | A vulnerability was found in Tenda F453 1.0.0.3. This issue affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page re… |
CVE-2026-3379 | High | 8.8 | 2026-03-01 | A vulnerability has been found in Tenda F453 1.0.0.3. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of… |
CVE-2026-3378 | High | 8.8 | 2026-03-01 | A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromqossetting of the file /goform/qossetting. Executing a manipulation of the argument… |
CVE-2026-3377 | High | 8.8 | 2026-03-01 | A vulnerability was detected in Tenda F453 1.0.0.3. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Performing a ma… |
CVE-2026-3376 | High | 8.8 | 2026-02-28 | A security vulnerability has been detected in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromSafeMacFilter of the file /goform/SafeMacF… |
CVE-2026-28562 | High | 8.2 | 2026-02-28 | wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitiz… |
CVE-2026-28561 | Medium | 5.5 | 2026-02-28 | wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description field… |
CVE-2026-28560 | Medium | 5.5 | 2026-02-28 | wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block usi… |
CVE-2026-28559 | Medium | 5.3 | 2026-02-28 | wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the… |
CVE-2026-28558 | Medium | 6.4 | 2026-02-28 | wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through t… |
CVE-2026-28557 | Medium | 6.5 | 2026-02-28 | wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpf… |
CVE-2026-28556 | Medium | 5.4 | 2026-02-28 | wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic… |
CVE-2026-28555 | Medium | 4.3 | 2026-02-28 | wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_clos… |
CVE-2026-28554 | Medium | 4.3 | 2026-02-28 | wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_… |
CVE-2026-3010 | Medium | 6.1 | 2026-02-28 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for Infor… |
CVE-2026-2844 | High | 7.5 | 2026-02-28 | Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra… |
CVE-2026-2471 | High | 7.5 | 2026-02-28 | The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted in… |
CVE-2026-1542 | Medium | 6.5 | 2026-02-28 | The Super Stage WP WordPress plugin through 1.0.1 unserializes user input via REQUEST, which could allow unauthenticated users to perform PHP Object Injection… |
CVE-2026-28517 | Critical | 9.8 | 2026-02-27 | openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot'… |
CVE-2026-28516 | High | 8.8 | 2026-02-27 | openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php h… |
CVE-2026-28515 | High | 8.8 | 2026-02-27 | openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upg… |
CVE-2026-28426 | High | 8.7 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related c… |
CVE-2026-28425 | High | 8.0 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated control panel user with access to… |
CVE-2026-28424 | Medium | 6.5 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses fr… |
CVE-2026-28423 | Medium | 6.8 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure… |
CVE-2026-27759 | | 2026-02-27 | Featured Image from Content (featured-image-from-content) WordPress plugin versions prior to 1.7 contain an authenticated server-side request forgery vulnerabi… | |
CVE-2026-28422 | Low | 2.2 | 2026-02-27 | Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in `build_stl_str_hl()` when rendering a statusline… |
CVE-2026-28421 | Medium | 5.3 | 2026-02-27 | Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap fil… |
CVE-2026-28420 | Medium | 4.4 | 2026-02-27 | Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's termina… |
CVE-2026-28419 | Medium | 5.3 | 2026-02-27 | Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic… |
CVE-2026-28418 | Medium | 4.4 | 2026-02-27 | Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags fi… |
CVE-2026-28417 | Medium | 4.4 | 2026-02-27 | Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled… |
CVE-2026-28416 | High | 8.2 | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio al… |
CVE-2026-28415 | Medium | 4.3 | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accep… |
CVE-2026-28414 | High | 7.5 | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to… |
CVE-2026-28411 | Critical | 9.8 | 2026-02-27 | WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an… |
CVE-2026-28409 | Critical | 10.0 | 2026-02-27 | WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA applicatio… |
CVE-2026-28408 | Critical | 9.8 | 2026-02-27 | WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's ce… |
CVE-2026-28407 | Medium | 5.3 | 2026-02-27 | malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would rem… |
CVE-2026-28406 | High | 8.2 | 2026-02-27 | kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10… |
CVE-2026-28402 | High | 7.1 | 2026-02-27 | nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.2.2, a mal… |
CVE-2026-28400 | High | 7.5 | 2026-02-27 | Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST `/engines/_configure` en… |
CVE-2026-27939 | High | 8.8 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users… |
CVE-2026-27167 | Unrated | | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outs… |
CVE-2026-28355 | | 2026-02-27 | Canarytokens help track activity and actions on a network. Versions prior to `sha-7ff0e12` have a Self Cross-Site Scripting vulnerability in the "PWA" Canaryto… | |
CVE-2026-28352 | Medium | 6.5 | 2026-02-27 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint… |
CVE-2026-28351 | Medium | 5.3 | 2026-02-27 | pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large m… |
CVE-2026-28338 | Medium | 6.8 | 2026-02-27 | PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages int… |
CVE-2026-28288 | Medium | 5.3 | 2026-02-27 | Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an atta… |
CVE-2026-28272 | High | 8.1 | 2026-02-27 | Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to… |
CVE-2026-28271 | Medium | 6.5 | 2026-02-27 | Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protection… |
CVE-2026-28270 | Medium | 4.9 | 2026-02-27 | Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without prope… |
CVE-2026-28268 | Critical | 9.8 | 2026-02-27 | Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechan… |