2026 CVEs (page 629)
Page 629 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20138 | Medium | 6.8 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with acc… |
CVE-2026-20137 | Low | 3.5 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, a… |
CVE-2026-2657 | Low | 3.3 | 2026-02-18 | A vulnerability has been found in wren-lang wren up to 0.4.0. This impacts the function printError of the file src/vm/wren_compiler.c of the component Error Me… |
CVE-2026-2507 | High | 7.5 | 2026-02-18 | When BIG-IP AFM or BIG-IP DDoS is provisioned, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Sup… |
CVE-2026-2230 | Medium | 4.3 | 2026-02-18 | The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 via the handle_ajax_… |
CVE-2026-23230 | High | 8.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease… |
CVE-2026-23229 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - Add spinlock protection with virtqueue notification When VM boots with o… |
CVE-2026-23228 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() On kthread_run() f… |
CVE-2026-23227 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to… |
CVE-2026-23226 | High | 8.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock to protect ksmbd_chann_list xarray ksmbd_chann_list xarray lacks sy… |
CVE-2026-23225 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Don't assume CID is CPU owned on mode switch Shinichiro reported a KASAN UAF… |
CVE-2026-23224 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue for file-backed mounts w/ directio option [ 9.269940][ T3222] Cal… |
CVE-2026-23223 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in xchk_btree_check_block_owner We cannot dereference bs->cur when trying to… |
CVE-2026-23222 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly The existing alloca… |
CVE-2026-23221 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix use-after-free in driver_override_show() The driver_override_show() func… |
CVE-2026-23220 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths The problem… |
CVE-2026-2656 | Low | 2.5 | 2026-02-18 | A flaw has been found in ChaiScript up to 6.1.0. This affects the function chaiscript::Type_Info::bare_equal of the file include/chaiscript/dispatchkit/type_in… |
CVE-2026-2329 | Critical | 9.8 | 2026-02-18 | An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulne… |
CVE-2026-27100 | Medium | 4.3 | 2026-02-18 | Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, all… |
CVE-2026-27099 | High | 8.0 | 2026-02-18 | Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporari… |
CVE-2026-23219 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single When CONFIG_MEM_AL… |
CVE-2026-23218 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc() Fix incorrect NULL ch… |
CVE-2026-23217 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: riscv: trace: fix snapshot deadlock with sbi ecall If sbi_ecall.c's functions are traceab… |
CVE-2026-23216 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_co… |
CVE-2026-23215 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: x86/vmware: Fix hypercall clobbers Fedora QA reported the following panic: BUG: unable… |
CVE-2026-23214 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: btrfs: reject new transactions if the fs is fully read-only [BUG] There is a bug report w… |
CVE-2026-23213 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Disable MMIO access during SMU Mode 1 reset During Mode 1 reset, the ASIC und… |
CVE-2026-23212 | Medium | 4.7 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: bonding: annotate data-races around slave->last_rx slave->last_rx and slave->target_last_… |
CVE-2026-23211 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: mm, swap: restore swap_space attr aviod kernel panic commit 8b47299a411a ("mm, swap: mark… |
CVE-2026-1426 | High | 8.8 | 2026-02-18 | The Advanced AJAX Product Filters plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.9.6 via deserialization… |
CVE-2026-1404 | Medium | 6.1 | 2026-02-18 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Reflec… |
CVE-2026-2655 | Low | 2.5 | 2026-02-18 | A vulnerability was detected in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::str_less::operator of the file include/chaiscript/chai… |
CVE-2026-2654 | Medium | 6.3 | 2026-02-18 | A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Exec… |
CVE-2026-2464 | | 2026-02-18 | Path traversal vulnerability in the AMR Printer Management 1.01 Beta web service, which allows remote attackers to read arbitrary files from the underlying Win… | |
CVE-2026-1441 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1440 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1439 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1438 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1437 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1436 | Medium | 6.5 | 2026-02-18 | Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other us… |
CVE-2026-1435 | Critical | 9.8 | 2026-02-18 | Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. T… |
CVE-2026-2386 | Medium | 4.3 | 2026-02-18 | The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Autho… |
CVE-2026-1582 | Low | 3.7 | 2026-02-18 | The WP All Export plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.14 via the export download end… |
CVE-2026-1317 | Medium | 6.5 | 2026-02-18 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 7.37. This is… |
CVE-2026-2653 | Medium | 5.3 | 2026-02-18 | A security flaw has been discovered in admesh up to 0.98.5. This issue affects the function stl_check_normal_vector of the file src/normals.c. Performing a man… |
CVE-2026-2426 | Medium | 6.5 | 2026-02-18 | The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'file' parameter in the file del… |
CVE-2026-1942 | Medium | 6.5 | 2026-02-18 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2026-2126 | Medium | 5.3 | 2026-02-18 | The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to… |
CVE-2026-2495 | High | 7.5 | 2026-02-18 | The WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin for WordPress is vulnerable to SQL Injection via the 'order' parame… |
CVE-2026-2127 | Medium | 5.4 | 2026-02-18 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to unauthorized arbitrary shortcode execution in all versions up to, and including, 1.70.4. Th… |
CVE-2026-1941 | Medium | 6.4 | 2026-02-18 | The WP Event Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_events' shortcode in all versions up to, and inc… |
CVE-2026-1656 | Medium | 5.3 | 2026-02-18 | The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6… |
CVE-2026-1649 | Medium | 4.4 | 2026-02-18 | The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ce_venue_name' parameter in all versions up to, and including… |
CVE-2026-2419 | Low | 2.7 | 2026-02-18 | The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'download_path' configuration pa… |
CVE-2026-2112 | Medium | 4.3 | 2026-02-18 | The Dam Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing nonce verific… |
CVE-2026-1943 | Medium | 4.4 | 2026-02-18 | The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including… |
CVE-2026-1938 | Medium | 5.3 | 2026-02-18 | The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized license key deletion due to a missing authorization check on the… |
CVE-2026-1860 | Medium | 4.3 | 2026-02-18 | The Kali Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.8. This is due to the `get_item… |
CVE-2026-1831 | Low | 2.7 | 2026-02-18 | The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized plugin installation and activation due to missing capability chec… |
CVE-2026-1655 | Medium | 4.3 | 2026-02-18 | The EventPrime plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization checks in all versions up to, and including, 4… |
CVE-2026-2644 | Low | 3.3 | 2026-02-18 | A weakness has been identified in niklasso minisat up to 2.2.0. This issue affects the function Solver::value in the library core/SolverTypes.h of the componen… |
CVE-2026-2642 | Low | 3.3 | 2026-02-18 | A security vulnerability has been detected in ggreer the_silver_searcher up to 2.2.0. The impacted element is the function search_stream of the file src/search… |
CVE-2026-2633 | Medium | 4.3 | 2026-02-18 | The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.1. This is due… |
CVE-2026-2296 | High | 7.2 | 2026-02-18 | The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Code Injection in all versions up to, and includi… |
CVE-2026-2281 | Medium | 4.4 | 2026-02-18 | The Private Comment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Label text' setting in all versions up to, and including, 0.0.4… |
CVE-2026-2019 | High | 7.2 | 2026-02-18 | The Cart All In One For WooCommerce plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.1.21. This is due to insuffici… |
CVE-2026-1937 | High | 7.2 | 2026-02-18 | The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to… |
CVE-2026-1857 | Medium | 4.3 | 2026-02-18 | The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.6.1. This… |
CVE-2026-1807 | Medium | 6.4 | 2026-02-18 | The InteractiveCalculator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'interactivecalculator' shortcode in… |
CVE-2026-1666 | Medium | 6.1 | 2026-02-18 | The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in all versions up to, and including… |
CVE-2026-1640 | Medium | 4.3 | 2026-02-18 | The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin… |
CVE-2026-2641 | Low | 3.3 | 2026-02-18 | A weakness has been identified in universal-ctags ctags up to 6.2.1. The affected element is the function parseExpression/parseExprList of the file parsers/v.c… |
CVE-2026-2023 | Medium | 4.3 | 2026-02-18 | The WP Plugin Info Card plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0. This is due to missing no… |
CVE-2026-1906 | Medium | 4.3 | 2026-02-18 | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5… |
CVE-2026-1639 | Medium | 6.5 | 2026-02-18 | The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' and 'sort… |
CVE-2026-1368 | High | 7.5 | 2026-02-18 | The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated… |
CVE-2026-1304 | Medium | 4.4 | 2026-02-18 | The Membership Plugin – Restrict Content for WordPress is vulnerable to Stored Cross-Site Scripting via multiple invoice settings fields in all versions up to… |
CVE-2026-1072 | Medium | 4.3 | 2026-02-18 | The Keybase.io Verification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.5. This is due to missin… |
CVE-2026-2576 | High | 7.5 | 2026-02-18 | The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'payment' paramet… |
CVE-2026-1931 | High | 7.2 | 2026-02-18 | The Rent Fetch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'keyword' parameter in all versions up to, and including, 0.32.4 due t… |
CVE-2026-1925 | Medium | 4.3 | 2026-02-18 | The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on… |
CVE-2026-1714 | High | 8.6 | 2026-02-18 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Email Relay Abuse in all… |
CVE-2026-1296 | Medium | 6.1 | 2026-02-18 | The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficien… |
CVE-2026-1277 | Medium | 4.7 | 2026-02-18 | The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redire… |
CVE-2026-27171 | Low | 2.9 | 2026-02-18 | zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination… |
CVE-2026-23599 | High | 7.8 | 2026-02-18 | A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking ClearPass OnGuard Software for Linux. Successful exploitation of thi… |
CVE-2026-22048 | High | 7.1 | 2026-02-18 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Microsoft Entra ID (form… |
CVE-2026-1344 | Medium | 6.5 | 2026-02-18 | Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal. |
CVE-2026-26119 | High | 8.8 | 2026-02-17 | Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network. |
CVE-2026-1670 | Critical | 9.8 | 2026-02-17 | The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery… |
CVE-2026-2629 | High | 7.3 | 2026-02-17 | A weakness has been identified in jishi node-sonos-http-api up to 3776f0ee2261c924c7b7204de121a38100a08ca7. Affected is the function Promise of the file lib/tt… |
CVE-2026-2627 | High | 7.8 | 2026-02-17 | A security flaw has been discovered in Softland FBackup up to 9.9. This impacts an unknown function in the library C:\Program Files\Common Files\microsoft shar… |
CVE-2026-2623 | Medium | 6.3 | 2026-02-17 | A flaw has been found in Blossom up to 1.17.1. This issue affects the function put of the file blossom-backend/common/common-iaas/src/main/java/com/blossom/com… |
CVE-2026-2622 | Low | 3.5 | 2026-02-17 | A vulnerability was detected in Blossom up to 1.17.1. This vulnerability affects the function content of the file blossom-backend/backend/src/main/java/com/blo… |
CVE-2026-2621 | High | 7.3 | 2026-02-17 | A security vulnerability has been detected in Sciyon Koyuan Thermoelectricity Heat Network Management System 3.0. This affects an unknown part of the file /SIS… |
CVE-2026-23598 | Medium | 6.5 | 2026-02-17 | Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive inf… |
CVE-2026-23597 | Medium | 6.5 | 2026-02-17 | Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive inf… |
CVE-2026-23596 | Medium | 6.5 | 2026-02-17 | A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitati… |
CVE-2026-23595 | High | 8.8 | 2026-02-17 | An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability… |
CVE-2026-2620 | High | 7.3 | 2026-02-17 | A weakness has been identified in Huace Monitoring and Early Warning System 2.2. Affected by this issue is some unknown functionality of the file /Web/SysManag… |