2026 CVEs (page 630)
Page 630 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-26357 | Medium | 5.4 | 2026-02-17 | Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabili… |
CVE-2026-22769 | Critical | 10.0 | 2026-02-17 | Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthen… |
CVE-2026-22762 | Medium | 6.5 | 2026-02-17 | Dell Avamar Server and Avamar Virtual Edition, versions prior to 19.10 SP1 with CHF338912, contain an Improper Limitation of a Pathname to a Restricted Directo… |
CVE-2026-22284 | Medium | 6.6 | 2026-02-17 | Dell SmartFabric OS10 Software, versions prior to 10.5.6.12, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vu… |
CVE-2026-0102 | Low | 3.1 | 2026-02-17 | Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consen… |
CVE-2026-2630 | High | 8.8 | 2026-02-17 | A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server where Tenable Security C… |
CVE-2026-26736 | High | 8.8 | 2026-02-17 | TOTOLINK A3002RU_V3 V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the static_ipv6 parameter in the formIpv6Setup function. |
CVE-2026-26732 | High | 8.8 | 2026-02-17 | TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the vpnUser or vpnPassword` parameters in the formFilter fun… |
CVE-2026-26731 | High | 8.8 | 2026-02-17 | TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the routernamer`parameter in the formDnsv6 function. |
CVE-2026-24734 | High | 7.5 | 2026-02-17 | Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomc… |
CVE-2026-24733 | Low | 3.7 | 2026-02-17 | Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured… |
CVE-2026-2618 | Low | 3.7 | 2026-02-17 | A vulnerability was determined in Beetel 777VR1 up to 01.00.09. This impacts an unknown function of the component SSH Service. This manipulation causes risky c… |
CVE-2026-23648 | High | 7.8 | 2026-02-17 | Glory RBG-100 recycler systems using the ISPK-08 software component contain multiple system binaries with overly permissive file permissions. Several binaries… |
CVE-2026-23647 | Critical | 9.8 | 2026-02-17 | Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authentication to the und… |
CVE-2026-2617 | Medium | 6.3 | 2026-02-17 | A vulnerability was found in Beetel 777VR1 up to 01.00.09. This affects an unknown function of the component Telnet Service/SSH Service. The manipulation resul… |
CVE-2026-2616 | High | 8.8 | 2026-02-17 | A vulnerability has been found in Beetel 777VR1 up to 01.00.09. The impacted element is an unknown function of the component Web Management Interface. The mani… |
CVE-2026-22208 | Critical | 9.6 | 2026-02-17 | OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter… |
CVE-2026-25087 | High | 7.0 | 2026-02-17 | Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IP… |
CVE-2026-23861 | Medium | 5.4 | 2026-02-17 | Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulner… |
CVE-2026-2615 | High | 7.2 | 2026-02-17 | A flaw has been found in Wavlink WL-NU516U1 up to 20251208. The affected element is the function singlePortForwardDelete of the file /cgi-bin/firewall.cgi. Exe… |
CVE-2026-2608 | Medium | 4.3 | 2026-02-17 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a… |
CVE-2026-2247 | | 2026-02-17 | SQL injection vulnerability (SQLi) in Clicldeu SaaS, specifically in the generation of reports, which occurs when a previously authenticated remote attacker ex… | |
CVE-2026-25903 | Medium | 6.6 | 2026-02-17 | Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permission… |
CVE-2026-1216 | High | 7.2 | 2026-02-17 | The RSS Aggregator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'template' parameter in all versions up to, and including, 5.0… |
CVE-2026-0829 | Medium | 5.8 | 2026-02-17 | The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This l… |
CVE-2026-1657 | Medium | 5.3 | 2026-02-17 | The EventPrime plugin for WordPress is vulnerable to unauthorized image file upload in all versions up to, and including, 4.2.8.4. This is due to the plugin re… |
CVE-2026-2592 | High | 7.7 | 2026-02-17 | The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including… |
CVE-2026-2002 | Medium | 4.4 | 2026-02-17 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form_name par… |
CVE-2026-26220 | | 2026-02-17 | LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD (prefill-decode) disaggregation mode. The PD master node… | |
CVE-2026-2439 | Critical | 9.8 | 2026-02-16 | Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defa… |
CVE-2026-2474 | High | 7.5 | 2026-02-16 | Crypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom(). The function does… |
CVE-2026-2001 | High | 8.8 | 2026-02-16 | The WowRevenue plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'Notice::install_activate_plugin… |
CVE-2026-2567 | High | 7.2 | 2026-02-16 | A vulnerability was detected in Wavlink WL-NU516U1 20251208. This vulnerability affects the function sub_401218 of the file /cgi-bin/nas.cgi. Performing a mani… |
CVE-2026-2566 | High | 7.2 | 2026-02-16 | A security vulnerability has been detected in Wavlink WL-NU516U1 up to 130/260. This affects the function sub_406194 of the file /cgi-bin/adm.cgi. Such manipul… |
CVE-2026-2565 | Medium | 6.6 | 2026-02-16 | A weakness has been identified in Wavlink WL-NU516U1 20251208. Affected by this issue is the function sub_40785C of the file /cgi-bin/adm.cgi. This manipulatio… |
CVE-2026-2564 | High | 8.1 | 2026-02-16 | A security flaw has been discovered in Intelbras VIP 3260 Z IA 2.840.00IB005.0.T. Affected by this vulnerability is an unknown functionality of the file /Outsi… |
CVE-2026-2101 | High | 8.7 | 2026-02-16 | A Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19… |
CVE-2026-26930 | High | 7.2 | 2026-02-16 | SmarterTools SmarterMail before 9526 allows XSS via MAPI requests. |
CVE-2026-2563 | Medium | 6.3 | 2026-02-16 | A vulnerability was identified in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. Affected is the function set_stcreenen_deabled_status/get_status of the file… |
CVE-2026-2562 | Medium | 6.3 | 2026-02-16 | A vulnerability was determined in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This impacts the function cast_streen of the file /jdcapi of the component jd… |
CVE-2026-2561 | Medium | 6.3 | 2026-02-16 | A vulnerability was found in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This affects the function web_get_ddns_uptime of the file /jdcapi of the component… |
CVE-2026-2447 | High | 8.8 | 2026-02-16 | Heap buffer overflow in libvpx. This vulnerability was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbir… |
CVE-2026-2032 | Medium | 4.3 | 2026-02-16 | Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof ar… |
CVE-2026-2560 | Medium | 6.3 | 2026-02-16 | A vulnerability has been found in kalcaddle kodbox up to 1.64.05. The impacted element is the function run of the file plugins/fileThumb/lib/VideoResize.class… |
CVE-2026-2558 | Medium | 6.3 | 2026-02-16 | A flaw has been found in GeekAI up to 4.2.4. The affected element is the function Download of the file api/handler/net_handler.go. This manipulation of the arg… |
CVE-2026-2557 | Low | 3.5 | 2026-02-16 | A vulnerability was detected in cskefu up to 8.0.1. Impacted is the function Upload of the file com/cskefu/cc/controller/resource/MediaController.java of the c… |
CVE-2026-1335 | High | 7.8 | 2026-02-16 | An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOL… |
CVE-2026-1334 | High | 7.8 | 2026-02-16 | An Out-Of-Bounds Read vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLI… |
CVE-2026-1333 | High | 7.8 | 2026-02-16 | A Use of Uninitialized Variable vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Re… |
CVE-2026-2556 | Medium | 6.3 | 2026-02-16 | A security vulnerability has been detected in cskefu up to 8.0.1. This issue affects some unknown processing of the file com/cskefu/cc/controller/resource/Medi… |
CVE-2026-1046 | High | 7.6 | 2026-02-16 | Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on… |
CVE-2026-2555 | Medium | 5.0 | 2026-02-16 | A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/contro… |
CVE-2026-2553 | Medium | 6.3 | 2026-02-16 | A security flaw has been discovered in tushar-2223 Hotel-Management-System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. This affects an unknown part of the… |
CVE-2026-2552 | Medium | 5.5 | 2026-02-16 | A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer… |
CVE-2026-2551 | Medium | 5.4 | 2026-02-16 | A vulnerability was determined in ZenTao up to 21.7.8. Affected by this vulnerability is the function delete of the file editor/control.php of the component Ba… |
CVE-2026-2452 | Medium | 6.5 | 2026-02-16 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be repl… |
CVE-2026-2451 | Medium | 6.5 | 2026-02-16 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be repl… |
CVE-2026-2415 | Medium | 5.9 | 2026-02-16 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be repl… |
CVE-2026-2577 | Critical | 10.0 | 2026-02-16 | The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentica… |
CVE-2026-2550 | Critical | 9.8 | 2026-02-16 | A vulnerability was found in EFM iptime A6004MX 14.18.2. Affected is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi. The manipulation resu… |
CVE-2026-2549 | High | 7.3 | 2026-02-16 | A vulnerability has been found in zhanghuanhao LibrarySystem 图书馆管理系统 up to 1.1.1. This impacts an unknown function of the file BookController.java. The manipul… |
CVE-2026-0999 | Medium | 5.4 | 2026-02-16 | Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated us… |
CVE-2026-0998 | Medium | 4.3 | 2026-02-16 | Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate user identity and post… |
CVE-2026-0997 | Medium | 4.3 | 2026-02-16 | Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate the authenticated user… |
CVE-2026-2548 | Medium | 6.3 | 2026-02-16 | A flaw has been found in WAYOS FBM-220G 24.10.19. This affects the function sub_40F820 of the file rc. Executing a manipulation of the argument upnp_waniface/u… |
CVE-2026-2547 | Low | 3.5 | 2026-02-16 | A vulnerability was detected in LigeroSmart up to 6.1.26. The impacted element is the function AgentDashboard of the file /otrs/index.pl. Performing a manipula… |
CVE-2026-2546 | Low | 3.5 | 2026-02-16 | A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulati… |
CVE-2026-2545 | Low | 3.5 | 2026-02-16 | A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketSearch. This manipulat… |
CVE-2026-2544 | High | 7.3 | 2026-02-16 | A security flaw has been discovered in yued-fe LuLu UI up to 3.0.0. This issue affects the function child_process.exec of the file run.js. The manipulation res… |
CVE-2026-2543 | Low | 2.7 | 2026-02-16 | A vulnerability was identified in vichan-devel vichan up to 5.1.5. This vulnerability affects unknown code of the file inc/mod/pages.php of the component Passw… |
CVE-2026-2542 | High | 7.0 | 2026-02-16 | A weakness has been identified in Total VPN 0.5.29.0 on Windows. Affected by this vulnerability is an unknown functionality of the file C:\Program Files\Total… |
CVE-2026-2538 | High | 7.0 | 2026-02-16 | A security flaw has been discovered in Flos Freeware Notepad2 4.2.22/4.2.23/4.2.24/4.2.25. Affected is an unknown function in the library Msimg32.dll. Performi… |
CVE-2026-0929 | Medium | 4.3 | 2026-02-16 | The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create forms on the site. |
CVE-2026-2537 | Medium | 4.7 | 2026-02-16 | A vulnerability was identified in Comfast CF-E4 2.6.0.1. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of t… |
CVE-2026-2536 | Medium | 6.3 | 2026-02-16 | A vulnerability was determined in opencc JFlow up to 20260129. This affects the function Imp_Done of the file src/main/java/bp/wf/httphandler/WF_Admin_AttrFlow… |
CVE-2026-2535 | Medium | 6.3 | 2026-02-16 | A vulnerability was found in Comfast CF-N1 V2 2.6.0.2. The impacted element is the function sub_44AB9C of the file /cgi-bin/mbox-config?method=SET§ion=ptes… |
CVE-2026-2534 | Medium | 6.3 | 2026-02-16 | A vulnerability has been found in Comfast CF-N1 V2 2.6.0.2. The affected element is the function sub_44AC4C of the file /cgi-bin/mbox-config?method=SET§ion… |
CVE-2026-2533 | High | 7.3 | 2026-02-16 | A flaw has been found in Tosei Self-service Washing Machine 4.02. Impacted is an unknown function of the file /cgi-bin/tosei_datasend.php. Executing a manipula… |
CVE-2026-2532 | Medium | 6.3 | 2026-02-16 | A vulnerability was detected in lintsinghua DeepAudit up to 3.0.3. This issue affects some unknown processing of the file backend/app/api/v1/endpoints/embeddin… |
CVE-2026-2531 | Medium | 6.3 | 2026-02-16 | A security vulnerability has been detected in MindsDB up to 25.14.1. This vulnerability affects the function clear_filename of the file mindsdb/utilities/secur… |
CVE-2026-2530 | Medium | 6.3 | 2026-02-16 | A weakness has been identified in Wavlink WL-WN579A3 up to 20210219. This affects the function AddMac of the file /cgi-bin/wireless.cgi. This manipulation of t… |
CVE-2026-2529 | Medium | 6.3 | 2026-02-16 | A security flaw has been discovered in Wavlink WL-WN579A3 up to 20210219. Affected by this issue is the function DeleteMac of the file /cgi-bin/wireless.cgi. T… |
CVE-2026-2528 | Medium | 6.3 | 2026-02-16 | A vulnerability was identified in Wavlink WL-WN579A3 up to 20210219. Affected by this vulnerability is the function Delete_Mac_list of the file /cgi-bin/wirele… |
CVE-2026-2527 | Medium | 6.3 | 2026-02-16 | A vulnerability was determined in Wavlink WL-WN579A3 up to 20210219. Affected is an unknown function of the file /cgi-bin/login.cgi. Executing a manipulation o… |
CVE-2026-2526 | Medium | 6.3 | 2026-02-16 | A vulnerability was found in Wavlink WL-WN579A3 up to 20210219. This impacts the function multi_ssid of the file /cgi-bin/wireless.cgi. Performing a manipulati… |
CVE-2026-2525 | Medium | 5.3 | 2026-02-16 | A vulnerability has been found in Free5GC up to 4.1.0. This affects an unknown function of the component PFCP UDP Endpoint. Such manipulation leads to denial o… |
CVE-2026-2524 | Medium | 5.3 | 2026-02-16 | A flaw has been found in Open5GS 2.7.6. The impacted element is the function mme_s11_handle_create_session_response of the component MME. This manipulation cau… |
CVE-2026-2523 | Medium | 5.3 | 2026-02-16 | A vulnerability was detected in Open5GS up to 2.7.6. The affected element is the function smf_gn_handle_create_pdp_context_request of the file /src/smf/gn-hand… |
CVE-2026-2522 | Medium | 5.3 | 2026-02-16 | A security vulnerability has been detected in Open5GS up to 2.7.6. Impacted is an unknown function of the file /src/mme/esm-build.c of the component MME. The m… |
CVE-2026-2521 | Medium | 5.3 | 2026-02-15 | A weakness has been identified in Open5GS up to 2.7.6. This issue affects the function sgwc_s5c_handle_create_session_response of the component SGW-C. Executin… |
CVE-2026-26369 | High | 8.8 | 2026-02-15 | eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC meth… |
CVE-2026-26368 | High | 8.8 | 2026-02-15 | eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated lo… |
CVE-2026-26367 | High | 8.1 | 2026-02-15 | eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated l… |
CVE-2026-26366 | Critical | 9.8 | 2026-02-15 | eNet SMART HOME server 2.2.1 and 2.3.1 ships with default credentials (user:user, admin:admin) that remain active after installation and commissioning without… |
CVE-2026-2517 | Medium | 5.3 | 2026-02-15 | A security flaw has been discovered in Open5GS up to 2.7.6. This vulnerability affects the function ogs_gtp2_parse_tft in the library lib/gtp/v2/types.c of the… |
CVE-2026-2516 | High | 7.0 | 2026-02-15 | A vulnerability was identified in Unidocs ezPDF DRM Reader and ezPDF Reader 2.0/3.0.0.4. This affects an unknown part in the library SHFOLDER.dll. Such manipul… |
CVE-2026-2541 | | 2026-02-15 | The Micca KE700 system relies on a 6-bit portion of an identifier for authentication within rolling codes, providing only 64 possible combinations. This low en… | |
CVE-2026-2540 | | 2026-02-15 | The Micca KE700 system contains flawed resynchronization logic and is vulnerable to replay attacks. This attack requires sending two previously captured codes… | |
CVE-2026-2539 | | 2026-02-15 | The RF communication protocol in the Micca KE700 car alarm system does not encrypt its data frames. An attacker with a radio interception tool (e.g., SDR) can… | |
CVE-2026-1793 | Medium | 6.5 | 2026-02-15 | The Element Pack Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 8.3.17 via the SVG widge… |