2026 CVEs (page 637)
Page 637 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-25740 | | 2026-02-09 | captive browser, a dedicated Chrome instance to log into captive portals without messing with DNS settings. In 25.05 and earlier, when programs.captive-browser… | |
CVE-2026-25639 | High | 7.5 | 2026-02-09 | Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeErr… |
CVE-2026-25528 | Medium | 5.8 | 2026-02-09 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side R… |
CVE-2026-2246 | Low | 3.3 | 2026-02-09 | A security vulnerability has been detected in AprilRobotics apriltag up to 3.4.5. Affected by this vulnerability is the function apriltag_detector_detect of th… |
CVE-2026-2245 | Low | 3.3 | 2026-02-09 | A vulnerability was identified in CCExtractor up to 183. This affects the function parse_PAT/parse_PMT in the library src/lib_ccx/ts_tables.c of the component… |
CVE-2026-25598 | Medium | 5.3 | 2026-02-09 | Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Prior to 2.14.2, a security vulnerability has been identified in the… |
CVE-2026-25498 | High | 7.2 | 2026-02-09 | Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution (RCE) vulnera… |
CVE-2026-25497 | High | 8.8 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions from 4.0.0-RC1 to before 4.17.0-beta.1 and 5.9.0-beta.1, there is a Privilege Escalatio… |
CVE-2026-25496 | Medium | 4.8 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a stored XSS vulnerability exis… |
CVE-2026-25495 | High | 8.8 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the element-indexes/get-element… |
CVE-2026-25494 | Medium | 6.5 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation… |
CVE-2026-25493 | Medium | 6.5 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation… |
CVE-2026-25492 | Medium | 6.5 | 2026-02-09 | Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save_images_Asset GraphQL mutation can be a… |
CVE-2026-25491 | Medium | 4.8 | 2026-02-09 | Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The name is not sanitized when dis… |
CVE-2026-25480 | Medium | 6.5 | 2026-02-09 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode NFKD normalization… |
CVE-2026-25479 | Medium | 6.5 | 2026-02-09 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled in… |
CVE-2026-25478 | High | 7.4 | 2026-02-09 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built fro… |
CVE-2026-25231 | High | 7.5 | 2026-02-09 | FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read vulnerability due to… |
CVE-2026-25230 | Medium | 4.6 | 2026-02-09 | FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability allows an authenticated user to modify the DOM and… |
CVE-2026-25057 | Critical | 9.1 | 2026-02-09 | MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assig… |
CVE-2026-24900 | Medium | 6.5 | 2026-02-09 | MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submis… |
CVE-2026-1529 | High | 8.1 | 2026-02-09 | A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token… |
CVE-2026-1486 | High | 8.8 | 2026-02-09 | A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enab… |
CVE-2026-24777 | Medium | 6.7 | 2026-02-09 | OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permission can lock and unlock users. This f… |
CVE-2026-24684 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is… |
CVE-2026-24683 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without… |
CVE-2026-24682 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an incorrect number of audio formats on parse… |
CVE-2026-24681 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback afte… |
CVE-2026-24680 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Fr… |
CVE-2026-24679 | Critical | 9.1 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied interface numbers as array indices wit… |
CVE-2026-24678 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, A capture thread sends sample responses using a freed channel callback after… |
CVE-2026-24677 | Critical | 9.1 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, ecam_encoder_compress_h264 trusts server-controlled dimensions and does not v… |
CVE-2026-24676 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thr… |
CVE-2026-24675 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code… |
CVE-2026-24491 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed… |
CVE-2026-23948 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logon_info_v2() allows… |
CVE-2026-2242 | Low | 3.3 | 2026-02-09 | A vulnerability was determined in janet-lang janet up to 1.40.1. This impacts the function janetc_if of the file src/core/specials.c. Executing a manipulation… |
CVE-2026-2241 | Low | 3.3 | 2026-02-09 | A vulnerability was found in janet-lang janet up to 1.40.1. This affects the function os_strftime of the file src/core/os.c. Performing a manipulation results… |
CVE-2026-21419 | Medium | 6.6 | 2026-02-09 | Dell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link Resolution Before File Access ('Link Following') vulnerability in… |
CVE-2026-2240 | Low | 3.3 | 2026-02-09 | A vulnerability has been found in janet-lang janet up to 1.40.1. The impacted element is the function janetc_pop_funcdef of the file src/core/compile.c. Such m… |
CVE-2026-24095 | | 2026-02-09 | Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p21, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows users with the "Use WATO" permission t… | |
CVE-2026-24027 | Medium | 5.3 | 2026-02-09 | Crafted zones can lead to increased incoming network traffic. |
CVE-2026-0398 | Medium | 5.3 | 2026-02-09 | Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor. |
CVE-2026-1960 | | 2026-02-09 | Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'Facebook' parameter in '/loggrodemo/jbrain/ConsultaTerceros' endpoint. | |
CVE-2026-1959 | | 2026-02-09 | Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'descripción' parameter in the '/loggrodemo/jbrain/MaestraCuentasBancarias' endpoin… | |
CVE-2026-0632 | Medium | 5.4 | 2026-02-09 | The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.12 via the 'saveDa… |
CVE-2026-25848 | Critical | 9.1 | 2026-02-09 | In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible |
CVE-2026-25847 | High | 8.2 | 2026-02-09 | In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible |
CVE-2026-25846 | Medium | 6.5 | 2026-02-09 | In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs |
CVE-2026-24098 | Medium | 6.5 | 2026-02-09 | Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors… |
CVE-2026-22922 | Medium | 6.5 | 2026-02-09 | Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access t… |
CVE-2026-2227 | Medium | 4.7 | 2026-02-09 | A vulnerability was found in D-Link DCS-931L up to 1.13.0. Impacted is the function doSystem of the file /setSystemAdmin. Performing a manipulation of the argu… |
CVE-2026-2226 | Medium | 4.7 | 2026-02-09 | A vulnerability has been found in DouPHP up to 1.9. This issue affects some unknown processing of the file /admin/file.php of the component ZIP File Handler. S… |
CVE-2026-23903 | Medium | 5.3 | 2026-02-09 | Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to ver… |
CVE-2026-2225 | High | 7.3 | 2026-02-09 | A flaw has been found in itsourcecode News Portal Project 1.0. This vulnerability affects unknown code of the file /admin/index.php of the component Administra… |
CVE-2026-2224 | Low | 3.5 | 2026-02-09 | A vulnerability was detected in code-projects Online Reviewer System 1.0. This affects an unknown part of the file /system/system/admins/manage/users/btn_funct… |
CVE-2026-25916 | Medium | 4.3 | 2026-02-09 | Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage. |
CVE-2026-25905 | Medium | 5.8 | 2026-02-09 | The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use the Pyodide APIs to… |
CVE-2026-25904 | Medium | 5.8 | 2026-02-09 | The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the lo… |
CVE-2026-2236 | High | 7.5 | 2026-02-09 | C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database cont… |
CVE-2026-2235 | Medium | 6.5 | 2026-02-09 | C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database content… |
CVE-2026-2234 | Critical | 9.1 | 2026-02-09 | C&Cm@il developed by HGiga has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read and modify any user's mail content. |
CVE-2026-2223 | High | 7.3 | 2026-02-09 | A security vulnerability has been detected in code-projects Online Reviewer System 1.0. Affected by this issue is some unknown functionality of the file /syste… |
CVE-2026-2222 | Low | 2.4 | 2026-02-09 | A weakness has been identified in code-projects Online Reviewer System 1.0. Affected by this vulnerability is an unknown functionality of the file /system/syst… |
CVE-2026-22906 | Critical | 9.8 | 2026-02-09 | User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and… |
CVE-2026-22905 | High | 7.5 | 2026-02-09 | An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (e.g., /js/../cgi-bin… |
CVE-2026-22904 | Critical | 9.8 | 2026-02-09 | Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and… |
CVE-2026-22903 | Critical | 9.8 | 2026-02-09 | An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the… |
CVE-2026-2221 | High | 7.3 | 2026-02-09 | A security flaw has been discovered in code-projects Online Reviewer System 1.0. Affected is an unknown function of the file /login/index.php of the component… |
CVE-2026-2220 | High | 7.3 | 2026-02-09 | A vulnerability was identified in code-projects Online Reviewer System 1.0. This impacts an unknown function of the file /system/system/admins/assessments/pret… |
CVE-2026-24466 | Medium | 6.7 | 2026-02-09 | Products provided by Oki Electric Industry Co., Ltd. and its OEM products (Ricoh Co., Ltd., Murata Machinery, Ltd.) register Windows services with unquoted fil… |
CVE-2026-1868 | Critical | 9.9 | 2026-02-09 | GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6… |
CVE-2026-0870 | High | 7.8 | 2026-02-09 | MacroHub developed by GIGABYTE has a Local Privilege Escalation vulnerability. Due to the MacroHub application launching external applications with improper pr… |
CVE-2026-2218 | Medium | 6.3 | 2026-02-09 | A vulnerability was determined in D-Link DCS-933L up to 1.14.11. This affects an unknown function of the file /setSystemAdmin of the component alphapd. This ma… |
CVE-2026-2217 | High | 7.3 | 2026-02-09 | A vulnerability was found in itsourcecode Event Management System 1.0. The impacted element is an unknown function of the file /admin/manage_user.php. The mani… |
CVE-2026-2216 | Medium | 4.3 | 2026-02-09 | A flaw has been found in rachelos WeRSS we-mp-rss up to 1.4.8. Impacted is the function download_export_file of the file apis/tools.py. Executing a manipulatio… |
CVE-2026-22613 | Medium | 5.7 | 2026-02-09 | The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Ma… |
CVE-2026-2215 | Low | 3.7 | 2026-02-09 | A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. This issue affects some unknown processing of the file core/auth.py of the component JWT… |
CVE-2026-2214 | Low | 2.4 | 2026-02-09 | A weakness has been identified in code-projects for Plugin 1.0. This affects an unknown part of the file /Administrator/PHP/AdminAddAlbum.php. This manipulatio… |
CVE-2026-2213 | Medium | 4.7 | 2026-02-09 | A security flaw has been discovered in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP… |
CVE-2026-1615 | Critical | 9.8 | 2026-02-09 | Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The libr… |
CVE-2026-2212 | High | 7.3 | 2026-02-09 | A vulnerability was identified in code-projects Online Music Site 1.0. Affected by this vulnerability is an unknown functionality of the file /Administrator/PH… |
CVE-2026-2211 | High | 7.3 | 2026-02-09 | A vulnerability was determined in code-projects Online Music Site 1.0. Affected is an unknown function of the file /Administrator/PHP/AdminDeleteCategory.php… |
CVE-2026-2210 | High | 7.2 | 2026-02-09 | A vulnerability has been found in D-Link DIR-823X 250416. This affects the function sub_4211C8 of the file /goform/set_filtering. Such manipulation leads to os… |
CVE-2026-2203 | High | 8.8 | 2026-02-09 | A flaw has been found in Tenda AC8 16.03.33.05. Affected by this vulnerability is an unknown functionality of the file /goform/fast_setting_wifi_set of the com… |
CVE-2026-2202 | High | 8.8 | 2026-02-09 | A vulnerability was detected in Tenda AC8 16.03.33.05. Affected is the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet of the component httpd… |
CVE-2026-2201 | Low | 2.4 | 2026-02-09 | A security vulnerability has been detected in ZeroWdd studentmanager up to 2151560fc0a50ec00426785ec1e01a3763b380d9. This impacts the function addLeave of the… |
CVE-2026-2200 | Low | 2.4 | 2026-02-09 | A weakness has been identified in heyewei JFinalCMS 5.0.0. This affects an unknown function of the file /admin/admin/save of the component API Endpoint. Execut… |
CVE-2026-2199 | High | 7.3 | 2026-02-09 | A security flaw has been discovered in code-projects Online Reviewer System 1.0. The impacted element is an unknown function of the file /reviewer/system/syste… |
CVE-2026-2198 | High | 7.3 | 2026-02-09 | A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /system/system/admins/asses… |
CVE-2026-2197 | High | 7.3 | 2026-02-09 | A vulnerability was determined in code-projects Online Reviewer System 1.0. Impacted is an unknown function of the file /system/system/admins/assessments/prete… |
CVE-2026-2196 | High | 7.3 | 2026-02-09 | A vulnerability was found in code-projects Online Reviewer System 1.0. This issue affects some unknown processing of the file /system/system/admins/assessments… |
CVE-2026-2195 | High | 7.3 | 2026-02-09 | A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /system/system/admins/assessmen… |
CVE-2026-2194 | Medium | 6.3 | 2026-02-09 | A flaw has been found in D-Link DI-7100G C1 24.04.18D1. This affects the function start_proxy_client_email. Executing a manipulation can lead to command inject… |
CVE-2026-2193 | Medium | 6.3 | 2026-02-08 | A vulnerability was detected in D-Link DI-7100G C1 24.04.18D1. Affected by this issue is the function set_jhttpd_info. Performing a manipulation of the argumen… |
CVE-2026-2192 | High | 7.2 | 2026-02-08 | A security vulnerability has been detected in Tenda AC9 15.03.06.42_multi. Affected by this vulnerability is the function formGetRebootTimer. Such manipulation… |
CVE-2026-2191 | High | 7.2 | 2026-02-08 | A weakness has been identified in Tenda AC9 15.03.06.42_multi. Affected is the function formGetDdosDefenceList. This manipulation of the argument security.ddos… |
CVE-2026-2190 | High | 7.3 | 2026-02-08 | A security flaw has been discovered in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/user/controller.php. T… |
CVE-2026-2189 | High | 7.3 | 2026-02-08 | A vulnerability was identified in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/report/index.php. The manip… |
CVE-2026-2188 | High | 7.2 | 2026-02-08 | A vulnerability was determined in UTT 进取 521G 3.1.1-190816. The impacted element is the function sub_446B18 of the file /goform/formPdbUpConfig. Executing a ma… |