2026 CVEs (page 634)
Page 634 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20601 | Low | 3.3 | 2026-02-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.3. An app may be able to monitor keystrokes without user… |
CVE-2026-1669 | High | 7.5 | 2026-02-11 | Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacke… |
CVE-2026-26031 | Medium | 5.3 | 2026-02-11 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe… |
CVE-2026-26029 | High | 7.5 | 2026-02-11 | sf-mcp-server is an implementation of Salesforce MCP server for Claude for Desktop. A command injection vulnerability exists in sf-mcp-server due to unsafe use… |
CVE-2026-26023 | Medium | 6.1 | 2026-02-11 | Dify is an open-source LLM app development platform. Prior to 1.13.0, a cross site scripting vulnerability has been found in the web application chat frontend… |
CVE-2026-26021 | Critical | 9.8 | 2026-02-11 | set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (>=… |
CVE-2026-26019 | Medium | 4.1 | 2026-02-11 | LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader class in @langchain/community is a web crawler that rec… |
CVE-2026-26012 | Medium | 6.5 | 2026-02-11 | vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can re… |
CVE-2026-26158 | High | 7.0 | 2026-02-11 | A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar arc… |
CVE-2026-26157 | High | 7.0 | 2026-02-11 | A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracte… |
CVE-2026-26014 | Medium | 5.9 | 2026-02-11 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES… |
CVE-2026-26010 | High | 7.6 | 2026-02-11 | OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for cer… |
CVE-2026-25999 | High | 7.1 | 2026-02-11 | Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to 2.10.2, there is an improper access control vulnerability that allows una… |
CVE-2026-25994 | Critical | 9.8 | 2026-02-11 | PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a buffer overflow vulnerability exists in PJNATH ICE Sessio… |
CVE-2026-25990 | High | 7.5 | 2026-02-11 | Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vuln… |
CVE-2026-25935 | Medium | 5.4 | 2026-02-11 | Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since t… |
CVE-2026-25924 | High | 8.4 | 2026-02-11 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authentic… |
CVE-2026-25759 | High | 8.7 | 2026-02-11 | Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authent… |
CVE-2026-25633 | Medium | 4.3 | 2026-02-11 | Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permission to view assets are able are able t… |
CVE-2026-25062 | Medium | 5.5 | 2026-02-11 | Outline is a service that allows for collaborative documentation. Prior to 1.4.0, during the JSON import process, the value of attachments[].key from the impor… |
CVE-2026-2323 | Medium | 4.3 | 2026-02-11 | Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-2322 | Medium | 5.4 | 2026-02-11 | Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-2321 | High | 8.8 | 2026-02-11 | Use after free in Ozone in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
CVE-2026-2320 | Medium | 6.5 | 2026-02-11 | Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-2319 | High | 7.5 | 2026-02-11 | Race in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures and install a malicio… |
CVE-2026-2318 | Medium | 6.5 | 2026-02-11 | Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific U… |
CVE-2026-2317 | Medium | 6.5 | 2026-02-11 | Inappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-2316 | Medium | 6.5 | 2026-02-11 | Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-2315 | High | 8.8 | 2026-02-11 | Inappropriate implementation in WebGPU in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially perform out of bounds memory access via… |
CVE-2026-2314 | High | 8.8 | 2026-02-11 | Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-2313 | High | 8.8 | 2026-02-11 | Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2026-2361 | High | 8.0 | 2026-02-11 | PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing mali… |
CVE-2026-2360 | High | 8.0 | 2026-02-11 | PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place mal… |
CVE-2026-0229 | | 2026-02-11 | A denial-of-service (DoS) vulnerability in the Advanced DNS Security (ADNS) feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker… | |
CVE-2026-0228 | | 2026-02-11 | An improper certificate validation vulnerability in PAN-OS allows users to connect Terminal Server Agents on Windows to PAN-OS using expired certificates even… | |
CVE-2026-25084 | Critical | 9.8 | 2026-02-11 | Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs. |
CVE-2026-24789 | Critical | 9.8 | 2026-02-11 | An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication. |
CVE-2026-25869 | High | 7.5 | 2026-02-11 | MiniGal Nano versions 0.3.5 and prior contain a path traversal vulnerability in index.php via the dir parameter. The application appends user-controlled input… |
CVE-2026-25868 | Medium | 6.1 | 2026-02-11 | MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter. The application construct… |
CVE-2026-1837 | High | 7.5 | 2026-02-11 | A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized un… |
CVE-2026-2345 | Low | 3.6 | 2026-02-11 | Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers… |
CVE-2026-2344 | | 2026-02-11 | A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessMa… | |
CVE-2026-2250 | High | 7.5 | 2026-02-11 | The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite datab… |
CVE-2026-2249 | Critical | 9.8 | 2026-02-11 | METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpo… |
CVE-2026-2248 | Critical | 9.8 | 2026-02-11 | METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpo… |
CVE-2026-2337 | | 2026-02-11 | A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet Bus… | |
CVE-2026-1227 | | 2026-02-11 | CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within… | |
CVE-2026-1226 | | 2026-02-11 | CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when mali… | |
CVE-2026-0910 | High | 8.8 | 2026-02-11 | The wpForo Forum plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.13 via deserialization of untrusted input… |
CVE-2026-22894 | Medium | 6.5 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2026-1458 | Medium | 6.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain co… |
CVE-2026-1456 | Medium | 6.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticate… |
CVE-2026-1387 | Medium | 6.5 | 2026-02-11 | GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed… |
CVE-2026-1282 | Low | 3.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allow… |
CVE-2026-1094 | Medium | 4.6 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 18.8.4 that could have allowed an authenticated developer to hide specia… |
CVE-2026-1080 | Medium | 4.3 | 2026-02-11 | GitLab has remediated an issue in GitLab EE affecting all versions from 16.7 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain cond… |
CVE-2026-0958 | High | 7.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allow… |
CVE-2026-0595 | High | 7.3 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain c… |
CVE-2026-2295 | Medium | 5.3 | 2026-02-11 | The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability che… |
CVE-2026-1885 | Medium | 6.4 | 2026-02-11 | The Slideshow Wp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sswpid' attribute of the 'sswp-slide' shortcode in all versions up… |
CVE-2026-1853 | Medium | 6.4 | 2026-02-11 | The BuddyHolis ListSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listsearch' shortcode in all versions up to, and… |
CVE-2026-1833 | Medium | 5.3 | 2026-02-11 | The WaMate Confirm – Order Confirmation plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.1. This is due to t… |
CVE-2026-1827 | Medium | 6.4 | 2026-02-11 | The Flask Micro code-editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's codeflask shortcode in all versions up to, and i… |
CVE-2026-1826 | Medium | 6.4 | 2026-02-11 | The OpenPOS Lite – Point of Sale for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter of the order_qrcod… |
CVE-2026-1821 | Medium | 6.4 | 2026-02-11 | The Microtango plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'restkey' parameter of the mt_reservation shortcode in all versions up… |
CVE-2026-1809 | Medium | 6.4 | 2026-02-11 | The HTML Tag Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.1… |
CVE-2026-1804 | Medium | 6.4 | 2026-02-11 | The WDES Responsive Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wdes-popup-title' shortcode in all versions up to… |
CVE-2026-1786 | Medium | 6.5 | 2026-02-11 | The Twitter posts to Blog plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dg_tw_options' func… |
CVE-2026-1748 | Medium | 4.3 | 2026-02-11 | The Invoct – PDF Invoices & Billing for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on mult… |
CVE-2026-1560 | High | 8.8 | 2026-02-11 | The Custom Block Builder – Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.0 via multiple fun… |
CVE-2026-1215 | Medium | 4.3 | 2026-02-11 | The MMA Call Tracking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.15. This is due to missing non… |
CVE-2026-0815 | Medium | 4.4 | 2026-02-11 | The Category Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag-image' parameter in all versions up to, and including, 2.0 du… |
CVE-2026-0724 | Medium | 4.4 | 2026-02-11 | The WPlyr Media Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_wplyr_accent_color' parameter in all versions up to, and incl… |
CVE-2026-1357 | Critical | 9.8 | 2026-02-11 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and i… |
CVE-2026-1235 | Medium | 6.5 | 2026-02-11 | The WP eCommerce WordPress plugin through 3.15.1 unserializes user input via ajax actions, which could allow unauthenticated users to perform PHP Object Inject… |
CVE-2026-26079 | Medium | 4.7 | 2026-02-11 | Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled. |
CVE-2026-1893 | Medium | 6.4 | 2026-02-11 | The Orbisius Random Name Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_label' parameter in the 'orbisius_random_name… |
CVE-2026-1231 | Medium | 6.4 | 2026-02-11 | The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `js` Global Settings… |
CVE-2026-1571 | Medium | 6.1 | 2026-02-11 | User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted… |
CVE-2026-25872 | Medium | 5.3 | 2026-02-10 | JUNG Smart Panel KNX firmware version L1.12.22 and prior contain an unauthenticated path traversal vulnerability in the embedded web interface. The application… |
CVE-2026-25870 | Medium | 5.8 | 2026-02-10 | DoraCMS version 3.1 and prior contains a server-side request forgery (SSRF) vulnerability in its UEditor remote image fetch functionality. The application acce… |
CVE-2026-26013 | Low | 3.7 | 2026-02-10 | LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitr… |
CVE-2026-26007 | Medium | 6.5 | 2026-02-10 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or Ellipt… |
CVE-2026-26006 | Medium | 6.5 | 2026-02-10 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The autogpt be… |
CVE-2026-1507 | High | 7.5 | 2026-02-10 | The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a de… |
CVE-2026-1495 | Medium | 6.5 | 2026-02-10 | The vulnerability, if exploited, could allow an attacker with Event Log Reader (S-1-5-32-573) privileges to obtain proxy details, including URL and proxy crede… |
CVE-2026-2303 | Medium | 6.5 | 2026-02-10 | The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-… |
CVE-2026-21349 | High | 7.8 | 2026-02-10 | Lightroom Desktop versions 15.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context o… |
CVE-2026-21348 | Medium | 5.5 | 2026-02-10 | Substance3D - Modeler versions 1.22.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could lev… |
CVE-2026-1763 | Medium | 4.6 | 2026-02-10 | Vulnerability in GE Vernova Enervista UR Setup on Windows.This issue affects Enervista: 8.6 and previous versions. |
CVE-2026-1762 | Low | 2.9 | 2026-02-10 | A vulnerability in GE Vernova Enervista UR Setup on Windows allows File Manipulation.This issue affects Enervista: 8.6 and prior versions. |
CVE-2026-2302 | Medium | 6.5 | 2026-02-10 | Under specific conditions when processing a maliciously crafted value of type Hash r, Mongoid::Criteria.from_hash may allow for executing arbitrary Ruby code. |
CVE-2026-26009 | Critical | 9.9 | 2026-02-10 | Catalyst is a platform built for enterprise game server hosts, game communities, and billing panel integrations. Install scripts defined in server templates ex… |
CVE-2026-25613 | Medium | 6.5 | 2026-02-10 | An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index. |
CVE-2026-25610 | Medium | 6.5 | 2026-02-10 | An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints. |
CVE-2026-25609 | Medium | 5.4 | 2026-02-10 | Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only. |
CVE-2026-25506 | High | 7.7 | 2026-02-10 | MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability… |
CVE-2026-21355 | Medium | 5.5 | 2026-02-10 | DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this… |
CVE-2026-21354 | Medium | 5.5 | 2026-02-10 | DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An at… |
CVE-2026-21353 | High | 7.8 | 2026-02-10 | DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the co… |