2026 CVEs (page 624)
Page 624 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2490 | Medium | 5.5 | 2026-02-20 | RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive… |
CVE-2026-2048 | High | 7.8 | 2026-02-20 | GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2026-2047 | High | 7.8 | 2026-02-20 | GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-2045 | High | 7.3 | 2026-02-20 | GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2026-2044 | High | 8.8 | 2026-02-20 | GIMP PGM File Parsing Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2026-2043 | High | 8.8 | 2026-02-20 | Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2026-2042 | High | 8.8 | 2026-02-20 | Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2026-2041 | High | 8.8 | 2026-02-20 | Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2026-2040 | High | 7.3 | 2026-02-20 | PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escala… |
CVE-2026-2039 | Critical | 9.8 | 2026-02-20 | GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affec… |
CVE-2026-2038 | Critical | 9.8 | 2026-02-20 | GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affect… |
CVE-2026-2037 | High | 8.8 | 2026-02-20 | GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2026-2036 | High | 8.8 | 2026-02-20 | GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2026-2035 | Medium | 6.8 | 2026-02-20 | Deciso OPNsense diag_backup.php filename Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute… |
CVE-2026-2034 | High | 7.8 | 2026-02-20 | Sante DICOM Viewer Pro DCM File Parsing Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2026-2033 | High | 7.3 | 2026-02-20 | MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2026-27133 | Medium | 5.9 | 2026-02-20 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a cha… |
CVE-2026-27125 | Medium | 6.8 | 2026-02-20 | svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inheri… |
CVE-2026-27122 | Medium | 5.4 | 2026-02-20 | svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not valid… |
CVE-2026-27121 | Medium | 5.4 | 2026-02-20 | svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When u… |
CVE-2026-27119 | Medium | 5.4 | 2026-02-20 | svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an <option> element does not pr… |
CVE-2026-2858 | Low | 3.3 | 2026-02-20 | A vulnerability was identified in wren-lang wren up to 0.4.0. This affects the function peekChar of the file src/vm/wren_compiler.c of the component Source Fil… |
CVE-2026-27120 | Medium | 6.1 | 2026-02-20 | Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended g… |
CVE-2026-27118 | | 2026-02-20 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulne… | |
CVE-2026-27113 | Medium | 6.3 | 2026-02-20 | Liquid Prompt is an adaptive prompt for Bash and Zsh. Starting in commit cf3441250bb5d8b45f6f8b389fcdf427a99ac28a and prior to commit a4f6b8d8c90b3eaa33d13dfd1… |
CVE-2026-27112 | Critical | 9.9 | 2026-02-20 | Kargo manages and automates the promotion of software artifacts. From 1.7.0 to before v1.7.8, v1.8.11, and v1.9.3, the batch resource creation endpoints of bot… |
CVE-2026-27111 | Medium | 5.0 | 2026-02-20 | Kargo manages and automates the promotion of software artifacts. From v1.9.0 to v1.9.2, Kargo's authorization model includes a promote verb -- a non-standard K… |
CVE-2026-27026 | Medium | 5.5 | 2026-02-20 | pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes… |
CVE-2026-27025 | Medium | 5.5 | 2026-02-20 | pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes a… |
CVE-2026-27024 | Medium | 5.5 | 2026-02-20 | pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loo… |
CVE-2026-27022 | Medium | 6.5 | 2026-02-20 | @langchain/langgraph-checkpoint-redis is the Redis checkpoint and store implementation for LangGraph. A query injection vulnerability exists in the @langchain/… |
CVE-2026-0797 | High | 8.8 | 2026-02-20 | GIMP ICO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-0777 | High | 7.8 | 2026-02-20 | Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2026-2857 | High | 8.8 | 2026-02-20 | A vulnerability was determined in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_423E00 of the file /boafrm/formPortFw of the component Po… |
CVE-2026-2856 | High | 8.8 | 2026-02-20 | A vulnerability was found in D-Link DWR-M960 1.01.07. Affected by this vulnerability is the function sub_424AFC of the file /boafrm/formFilter of the component… |
CVE-2026-27190 | High | 8.1 | 2026-02-20 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.6.8, a command injection vulnerability exists in Deno's node:child_process implementation… |
CVE-2026-27020 | | 2026-02-20 | Photobooth prior to 1.0.1 has a cross-site scripting (XSS) vulnerability in user input fields. Malicious users could inject scripts through unvalidated form in… | |
CVE-2026-25896 | Critical | 9.3 | 2026-02-20 | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to b… |
CVE-2026-24892 | High | 7.5 | 2026-02-20 | openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. openITCOCKPIT Community Edition 5.3… |
CVE-2026-2855 | High | 8.8 | 2026-02-20 | A vulnerability has been found in D-Link DWR-M960 1.01.07. Affected is the function sub_4648F0 of the file /boafrm/formDdns of the component DDNS Settings Hand… |
CVE-2026-2854 | High | 8.8 | 2026-02-20 | A flaw has been found in D-Link DWR-M960 1.01.07. This impacts the function sub_4611CC of the file /boafrm/formNtp of the component NTP Configuration Endpoint… |
CVE-2026-2853 | High | 8.8 | 2026-02-20 | A vulnerability was detected in D-Link DWR-M960 1.01.07. This affects the function sub_462E14 of the file /boafrm/formSysLog of the component System Log Config… |
CVE-2026-2473 | | 2026-02-20 | Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform all… | |
CVE-2026-2472 | High | 8.1 | 2026-02-20 | Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up… |
CVE-2026-2852 | Medium | 6.3 | 2026-02-20 | A vulnerability was identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects the function addSales/updateSales/deleteS… |
CVE-2026-2851 | Medium | 6.3 | 2026-02-20 | A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This vulnerability affects the function addInport/updateInpo… |
CVE-2026-2850 | Medium | 6.3 | 2026-02-20 | A vulnerability was found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function addCustomer/updateCustomer/deleteCustom… |
CVE-2026-2832 | | 2026-02-20 | Certain Samsung MultiXpress Multifunction Printers may be vulnerable to information disclosure, potentially exposing address book entries and other device conf… | |
CVE-2026-27115 | High | 7.1 | 2026-02-20 | ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below have an unvalidated command-line argument that allows any user to trigger recursiv… |
CVE-2026-24891 | High | 7.5 | 2026-02-20 | openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. Versions 5.3.1 and below contain an… |
CVE-2026-2849 | Medium | 5.4 | 2026-02-20 | A vulnerability has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this issue is the function deleteCache/removeAll… |
CVE-2026-2848 | High | 7.3 | 2026-02-20 | A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/… |
CVE-2026-2818 | High | 8.2 | 2026-02-20 | A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction di… |
CVE-2026-2333 | Critical | 9.8 | 2026-02-20 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request. |
CVE-2026-27506 | Medium | 6.1 | 2026-02-20 | SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user profile update workflow (user_settings.php submitting to admin/… |
CVE-2026-27505 | Medium | 6.1 | 2026-02-20 | SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user registration workflow (index.php submitting to admin/user_actio… |
CVE-2026-27504 | Medium | 6.1 | 2026-02-20 | SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in radiomobile_front.php via the stationid query parameter. When an auth… |
CVE-2026-27503 | Medium | 6.1 | 2026-02-20 | SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in admin/log.php via the search query parameter. When an authenticated a… |
CVE-2026-27502 | Medium | 6.1 | 2026-02-20 | SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the un… |
CVE-2026-26747 | Critical | 9.1 | 2026-02-20 | A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined… |
CVE-2026-26746 | High | 8.8 | 2026-02-20 | OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the we… |
CVE-2026-26745 | Medium | 5.3 | 2026-02-20 | OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially… |
CVE-2026-26725 | Critical | 9.8 | 2026-02-20 | An issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 (fixed in 19.76) allows a remote attacker to escalate privileges via the AccessID parameter. |
CVE-2026-26724 | High | 7.6 | 2026-02-20 | Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via… |
CVE-2026-26723 | High | 8.2 | 2026-02-20 | Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via… |
CVE-2026-26722 | Critical | 9.4 | 2026-02-20 | An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to escalate privileges via PIN component of the login fu… |
CVE-2026-26721 | High | 7.1 | 2026-02-20 | An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via the sid query parame… |
CVE-2026-26102 | High | 7.8 | 2026-02-20 | Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request. |
CVE-2026-26101 | High | 7.8 | 2026-02-20 | Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request. |
CVE-2026-26100 | Medium | 5.5 | 2026-02-20 | Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request. |
CVE-2026-26099 | Medium | 5.5 | 2026-02-20 | Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request. |
CVE-2026-26098 | Medium | 5.5 | 2026-02-20 | Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request. |
CVE-2026-26097 | Medium | 5.5 | 2026-02-20 | Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request. |
CVE-2026-26096 | Medium | 5.5 | 2026-02-20 | Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request. |
CVE-2026-26095 | Medium | 5.5 | 2026-02-20 | Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request. |
CVE-2026-26093 | Critical | 9.8 | 2026-02-20 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request. |
CVE-2026-26049 | Medium | 5.7 | 2026-02-20 | The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access t… |
CVE-2026-26048 | High | 7.5 | 2026-02-20 | The Wi-Fi router is vulnerable to de-authentication attacks due to the absence of management frame protection, allowing forged deauthentication and disassoci… |
CVE-2026-25715 | Critical | 9.8 | 2026-02-20 | The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authent… |
CVE-2026-24790 | High | 8.2 | 2026-02-20 | The underlying PLC of the device can be remotely influenced, without proper safeguards or authentication. |
CVE-2026-24455 | High | 7.5 | 2026-02-20 | The embedded web interface of the device does not support HTTPS/TLS for authentication and uses HTTP Basic Authentication. Traffic is encoded but not encrypt… |
CVE-2026-1842 | | 2026-02-20 | HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and failed to invalidate previously issued ac… | |
CVE-2026-2847 | High | 7.2 | 2026-02-20 | A vulnerability was detected in UTT HiPER 520 1.7.7-160105. Affected is the function sub_44EFB4 of the file /goform/formReleaseConnect of the component Web Man… |
CVE-2026-2846 | High | 7.2 | 2026-02-20 | A security vulnerability has been detected in UTT HiPER 520 1.7.7-160105. This impacts the function sub_44D264 of the file /goform/formPdbUpConfig of the compo… |
CVE-2026-27072 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Mana… |
CVE-2026-24959 | High | 8.5 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL I… |
CVE-2026-24956 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada Download Manager Addons for Elementor wpdm-eleme… |
CVE-2026-24955 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Whizz Plugins whizz-plugins allows Reflected X… |
CVE-2026-24953 | Medium | 6.5 | 2026-02-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path T… |
CVE-2026-24950 | High | 7.5 | 2026-02-20 | Authorization Bypass Through User-Controlled Key vulnerability in themeplugs Authorsy authorsy allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-24949 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods PhotoMe photome allows DOM-Based XSS.This issu… |
CVE-2026-24948 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Reflector reflector-plugins allows Reflected X… |
CVE-2026-24946 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly C… |
CVE-2026-24944 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in weDevs Subscribe2 subscribe2 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-24943 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference grandconference allows Reflec… |
CVE-2026-24941 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-22885 | Low | 3.7 | 2026-02-20 | A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to s… |
CVE-2026-22384 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in leafcolor Applay - Shortcodes applay-shortcodes allows Object Injection.This issue affects Applay - Shortcod… |
CVE-2026-22383 | High | 7.5 | 2026-02-20 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Exploiti… |
CVE-2026-22381 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes PawFriends - Pet Shop an… |