2026 CVEs (page 633)
Page 633 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-25748 | High | 8.6 | 2026-02-12 | authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using fo… |
CVE-2026-25227 | Critical | 9.1 | 2026-02-12 | authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using delegated permissions, a User that has th… |
CVE-2026-24895 | Critical | 9.8 | 2026-02-12 | FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case con… |
CVE-2026-24894 | High | 7.5 | 2026-02-12 | FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset be… |
CVE-2026-24044 | | 2026-02-12 | Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kubernetes distribution. The ESS Community Hel… | |
CVE-2026-26219 | Critical | 9.1 | 2026-02-12 | newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational… |
CVE-2026-26218 | Critical | 9.8 | 2026-02-12 | newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default passwor… |
CVE-2026-22821 | Medium | 4.9 | 2026-02-12 | mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vulnerability is fixed in 1.9.4. |
CVE-2026-21438 | Medium | 5.3 | 2026-02-12 | webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and… |
CVE-2026-21435 | Medium | 5.3 | 2026-02-12 | webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing… |
CVE-2026-21434 | Medium | 5.3 | 2026-02-12 | webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption in webtransport-go's… |
CVE-2026-26217 | High | 8.6 | 2026-02-12 | Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpo… |
CVE-2026-26216 | Critical | 10.0 | 2026-02-12 | Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter cont… |
CVE-2026-26214 | High | 7.4 | 2026-02-12 | Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configurati… |
CVE-2026-1104 | High | 8.8 | 2026-02-12 | The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creation and download due to a missing capabil… |
CVE-2026-2007 | High | 8.2 | 2026-02-12 | Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. The attacker has limited control over… |
CVE-2026-2006 | High | 8.8 | 2026-02-12 | Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun… |
CVE-2026-2005 | High | 8.8 | 2026-02-12 | Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions… |
CVE-2026-2004 | High | 8.8 | 2026-02-12 | Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the o… |
CVE-2026-2003 | Medium | 4.3 | 2026-02-12 | Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of atta… |
CVE-2026-1320 | High | 7.2 | 2026-02-12 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTTP header… |
CVE-2026-1671 | Medium | 6.5 | 2026-02-12 | The Activity Log for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the winter_activity_log_a… |
CVE-2026-1316 | High | 7.2 | 2026-02-12 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media[].href' parameter in all versions up to… |
CVE-2026-2276 | | 2026-02-12 | Reflected Cross-Site Scripting (XSS) vulnerability in the Wix web application, where the endpoint ' https://manage.wix.com/account/account-settings ', responsi… | |
CVE-2026-1356 | Medium | 4.8 | 2026-02-12 | The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and in… |
CVE-2026-21722 | Medium | 5.3 | 2026-02-12 | Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read… |
CVE-2026-2327 | Medium | 5.3 | 2026-02-12 | Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\… |
CVE-2026-2391 | Low | 3.7 | 2026-02-12 | ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-… |
CVE-2026-25676 | High | 7.8 | 2026-02-12 | The installer of M-Track Duo HD version 1.0.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a res… |
CVE-2026-26235 | High | 7.5 | 2026-02-12 | JUNG Smart Visu Server 1.1.1050 contains a denial of service vulnerability that allows unauthenticated attackers to remotely shutdown or reboot the server. Att… |
CVE-2026-26234 | High | 8.8 | 2026-02-12 | JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override request URLs by injectin… |
CVE-2026-1537 | Medium | 5.3 | 2026-02-12 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabili… |
CVE-2026-23857 | High | 8.2 | 2026-02-12 | Dell Update Package (DUP) Framework, versions 23.12.00 through 24.12.00, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability… |
CVE-2026-23856 | High | 7.8 | 2026-02-12 | Dell iDRAC Service Module (iSM) for Windows, versions prior to 6.0.3.1, and Dell iDRAC Service Module (iSM) for Linux, versions prior to 5.4.1.1, contain an Im… |
CVE-2026-0969 | High | 8.8 | 2026-02-12 | The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This v… |
CVE-2026-1729 | Critical | 9.8 | 2026-02-12 | The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.0.12. This is due to the plugin not properly ve… |
CVE-2026-26215 | | 2026-02-11 | manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote c… | |
CVE-2026-20700 | High | 7.8 | 2026-02-11 | A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS… |
CVE-2026-20682 | Medium | 5.3 | 2026-02-11 | A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An attacker may be a… |
CVE-2026-20681 | Low | 3.3 | 2026-02-11 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Tahoe 26.3. An app may be able to access infor… |
CVE-2026-20680 | Medium | 6.5 | 2026-02-11 | The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPad… |
CVE-2026-20678 | Medium | 5.5 | 2026-02-11 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An app may… |
CVE-2026-20677 | Critical | 9.0 | 2026-02-11 | A race condition was addressed with improved handling of symbolic links. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS S… |
CVE-2026-20676 | Medium | 5.3 | 2026-02-11 | This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A we… |
CVE-2026-20675 | Medium | 5.5 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS… |
CVE-2026-20674 | Medium | 4.6 | 2026-02-11 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.3 and iPadOS 26.3. An attacker with physical access to a locked device… |
CVE-2026-20673 | Medium | 5.3 | 2026-02-11 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 2… |
CVE-2026-20671 | Low | 3.1 | 2026-02-11 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS So… |
CVE-2026-20669 | Medium | 5.5 | 2026-02-11 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Tahoe 26.3. An app may be able to… |
CVE-2026-20667 | High | 8.8 | 2026-02-11 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3… |
CVE-2026-20666 | Medium | 5.5 | 2026-02-11 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.3. An app may be able to access sensitive user data. |
CVE-2026-20663 | Low | 3.3 | 2026-02-11 | The issue was resolved by sanitizing logging. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An app may be able to enumerate a… |
CVE-2026-20662 | Medium | 4.6 | 2026-02-11 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An attacker with physical a… |
CVE-2026-20661 | Medium | 4.6 | 2026-02-11 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An attacker… |
CVE-2026-20660 | High | 7.5 | 2026-02-11 | A path handling issue was addressed with improved logic. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequ… |
CVE-2026-20658 | High | 7.8 | 2026-02-11 | A package validation issue was addressed by blocking the vulnerable package. This issue is fixed in macOS Tahoe 26.3. An app may be able to gain root privilege… |
CVE-2026-20656 | Low | 3.3 | 2026-02-11 | A logic issue was addressed with improved validation. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, macOS Tahoe 26.3. An app may be able to… |
CVE-2026-20655 | Medium | 5.5 | 2026-02-11 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An attacker… |
CVE-2026-20654 | Medium | 5.5 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26… |
CVE-2026-20653 | Medium | 5.5 | 2026-02-11 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 a… |
CVE-2026-20652 | High | 7.5 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe… |
CVE-2026-20650 | High | 7.5 | 2026-02-11 | A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3… |
CVE-2026-20649 | High | 7.5 | 2026-02-11 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3. A user… |
CVE-2026-20648 | Medium | 5.5 | 2026-02-11 | A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Tahoe 26.3. A malicious app may be able to access… |
CVE-2026-20647 | Medium | 5.5 | 2026-02-11 | This issue was addressed with improved data protection. This issue is fixed in macOS Tahoe 26.3. An app may be able to access sensitive user data. |
CVE-2026-20646 | Low | 3.3 | 2026-02-11 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.3. A malicious app may be able to read sensitive location inf… |
CVE-2026-20645 | Medium | 4.6 | 2026-02-11 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26… |
CVE-2026-20644 | Medium | 6.5 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe… |
CVE-2026-20642 | Low | 2.4 | 2026-02-11 | An input validation issue was addressed. This issue is fixed in iOS 26.3 and iPadOS 26.3. A person with physical access to an iOS device may be able to access… |
CVE-2026-20641 | High | 7.1 | 2026-02-11 | A privacy issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS… |
CVE-2026-20640 | Medium | 4.6 | 2026-02-11 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3. An attacker with physical a… |
CVE-2026-20638 | Medium | 5.5 | 2026-02-11 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3. A user with Live Caller ID app extensions turned off could h… |
CVE-2026-20636 | Medium | 6.5 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. Processin… |
CVE-2026-20635 | Medium | 4.3 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe… |
CVE-2026-20634 | Medium | 5.5 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, mac… |
CVE-2026-20630 | Medium | 5.5 | 2026-02-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may… |
CVE-2026-20629 | Medium | 5.5 | 2026-02-11 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to access user-sensitive d… |
CVE-2026-20628 | High | 7.1 | 2026-02-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15… |
CVE-2026-20627 | Medium | 5.5 | 2026-02-11 | An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3… |
CVE-2026-20626 | High | 7.8 | 2026-02-11 | This issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Tahoe 26.3, visionOS 26.3. A malici… |
CVE-2026-20625 | Medium | 5.5 | 2026-02-11 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8… |
CVE-2026-20624 | Medium | 5.5 | 2026-02-11 | An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be ab… |
CVE-2026-20623 | Medium | 5.5 | 2026-02-11 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may be able to access… |
CVE-2026-20621 | Medium | 5.5 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, mac… |
CVE-2026-20620 | High | 7.7 | 2026-02-11 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. A… |
CVE-2026-20619 | Medium | 5.5 | 2026-02-11 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may be able to access sensiti… |
CVE-2026-20618 | Medium | 5.5 | 2026-02-11 | An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to access user-sensitive data. |
CVE-2026-20617 | High | 7.0 | 2026-02-11 | A race condition was addressed with improved state handling. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS… |
CVE-2026-20616 | High | 8.8 | 2026-02-11 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sonoma 14.8.4, macOS Tahoe… |
CVE-2026-20615 | High | 7.8 | 2026-02-11 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS… |
CVE-2026-20614 | High | 7.8 | 2026-02-11 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be… |
CVE-2026-20612 | Medium | 5.5 | 2026-02-11 | A privacy issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be able to a… |
CVE-2026-20611 | High | 7.8 | 2026-02-11 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS… |
CVE-2026-20610 | High | 7.8 | 2026-02-11 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.3. An app may be able to gain root privileges. |
CVE-2026-20609 | Medium | 4.4 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, mac… |
CVE-2026-20608 | Medium | 5.5 | 2026-02-11 | This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS T… |
CVE-2026-20606 | High | 7.1 | 2026-02-11 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4… |
CVE-2026-20605 | Medium | 4.6 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Ta… |
CVE-2026-20603 | Medium | 4.4 | 2026-02-11 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Tahoe 26.3. An app with root privileges may be able to… |
CVE-2026-20602 | Medium | 5.5 | 2026-02-11 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be abl… |