2026 CVEs (page 64)
Page 64 of 446 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-16308 | High | 7.5 | 2026-07-30 | IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of servic… |
CVE-2026-15435 | Critical | 9.8 | 2026-07-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An a… |
CVE-2026-14980 | High | 8.3 | 2026-07-30 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF… |
CVE-2026-14522 | High | 8.8 | 2026-07-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improp… |
CVE-2026-14519 | High | 7.5 | 2026-07-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path trave… |
CVE-2026-12947 | High | 7.5 | 2026-07-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read… |
CVE-2026-11980 | High | 7.3 | 2026-07-30 | IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up. |
CVE-2026-11897 | High | 7.5 | 2026-07-30 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A rem… |
CVE-2026-11707 | Critical | 9.3 | 2026-07-30 | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administra… |
CVE-2026-11383 | Medium | 5.4 | 2026-07-30 | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console. |
CVE-2026-67351 | High | 8.8 | 2026-07-30 | Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without… |
CVE-2026-60075 | High | 7.5 | 2026-07-30 | Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time rem… |
CVE-2026-60074 | High | 7.5 | 2026-07-30 | Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes c… |
CVE-2026-5219 | High | 8.3 | 2026-07-30 | Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue… |
CVE-2026-58218 | Medium | 5.3 | 2026-07-30 | A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A rem… |
CVE-2026-57859 | High | 7.5 | 2026-07-30 | e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database wr… |
CVE-2026-56428 | High | 8.1 | 2026-07-30 | The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuration. An inse… |
CVE-2026-41709 | Low | 2.7 | 2026-07-30 | VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being… |
CVE-2026-12722 | High | 8.2 | 2026-07-30 | Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issu… |
CVE-2026-59310 | Critical | 9.8 | 2026-07-30 | VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to ex… |
CVE-2026-59309 | Critical | 9.8 | 2026-07-30 | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit th… |
CVE-2026-54368 | High | 8.8 | 2026-07-30 | CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arb… |
CVE-2026-54367 | High | 8.6 | 2026-07-30 | CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account setti… |
CVE-2026-54366 | High | 7.5 | 2026-07-30 | CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by su… |
CVE-2026-54365 | High | 7.5 | 2026-07-30 | CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary… |
CVE-2026-54364 | Medium | 6.5 | 2026-07-30 | CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embe… |
CVE-2026-54363 | Critical | 9.1 | 2026-07-30 | CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by explo… |
CVE-2026-47876 | Critical | 9.3 | 2026-07-30 | VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a vi… |
CVE-2026-41703 | High | 7.6 | 2026-07-30 | VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds… |
CVE-2026-7260 | Medium | 5.5 | 2026-07-30 | Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* bef… |
CVE-2026-5582 | Medium | 4.3 | 2026-07-30 | The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verifi… |
CVE-2026-18382 | Medium | 6.8 | 2026-07-30 | A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary… |
CVE-2026-18381 | High | 7.6 | 2026-07-30 | A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the… |
CVE-2026-18378 | High | 7.6 | 2026-07-30 | A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary u… |
CVE-2026-17544 | Critical | 9.8 | 2026-07-30 | Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5… |
CVE-2026-17543 | Critical | 9.8 | 2026-07-30 | Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* bef… |
CVE-2026-15397 | High | 7.2 | 2026-07-30 | The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the p… |
CVE-2026-22622 | High | 8.8 | 2026-07-30 | Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate pr… |
CVE-2026-22621 | High | 8.3 | 2026-07-30 | Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to e… |
CVE-2026-22620 | High | 8.6 | 2026-07-30 | Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass a… |
CVE-2026-18369 | Medium | 5.8 | 2026-07-30 | A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects… |
CVE-2026-18363 | | 2026-07-30 | A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password rese… | |
CVE-2026-18362 | Medium | 5.9 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks. |
CVE-2026-18361 | High | 7.6 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function. |
CVE-2026-18360 | High | 7.6 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function. |
CVE-2026-16971 | Medium | 5.9 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks. |
CVE-2026-16970 | Medium | 4.2 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be mi… |
CVE-2026-16969 | High | 7.6 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function. |
CVE-2026-18353 | | 2026-07-30 | PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` befo… | |
CVE-2026-7849 | Critical | 9.8 | 2026-07-30 | Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subse… |
CVE-2026-44108 | Critical | 9.8 | 2026-07-30 | Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window… |
CVE-2026-44107 | High | 7.5 | 2026-07-30 | A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the… |
CVE-2026-44106 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulti… |
CVE-2026-44105 | Medium | 6.6 | 2026-07-30 | The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to auth… |
CVE-2026-44104 | Critical | 9.8 | 2026-07-30 | The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This… |
CVE-2026-44103 | Medium | 5.3 | 2026-07-30 | An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates with… |
CVE-2026-44102 | Medium | 5.3 | 2026-07-30 | An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file… |
CVE-2026-44101 | Critical | 9.8 | 2026-07-30 | Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can lead to De… |
CVE-2026-44100 | Critical | 9.4 | 2026-07-30 | The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial… |
CVE-2026-44099 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full sy… |
CVE-2026-44098 | High | 8.6 | 2026-07-30 | This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulti… |
CVE-2026-44097 | High | 7.1 | 2026-07-30 | A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent… |
CVE-2026-44096 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise. |
CVE-2026-44095 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resul… |
CVE-2026-44094 | High | 8.6 | 2026-07-30 | An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. Th… |
CVE-2026-44093 | High | 7.8 | 2026-07-30 | A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, r… |
CVE-2026-44092 | Critical | 9.1 | 2026-07-30 | An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. Th… |
CVE-2026-44091 | Critical | 9.1 | 2026-07-30 | An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration… |
CVE-2026-44090 | Critical | 9.8 | 2026-07-30 | Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This… |
CVE-2026-13584 | | 2026-07-30 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model… | |
CVE-2026-64635 | Medium | 5.3 | 2026-07-30 | Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control th… |
CVE-2026-59328 | Medium | 4.2 | 2026-07-30 | Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untru… |
CVE-2026-59327 | Medium | 4.4 | 2026-07-30 | Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain string attribute on the "Spring Boot DevTools… |
CVE-2026-59326 | Low | 3.3 | 2026-07-30 | The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable at INFO level whenever it creates… |
CVE-2026-58066 | Critical | 9.8 | 2026-07-30 | Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validat… |
CVE-2026-58046 | Critical | 9.9 | 2026-07-30 | Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Pl… |
CVE-2026-58043 | High | 7.5 | 2026-07-30 | A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who i… |
CVE-2026-58040 | Medium | 6.3 | 2026-07-30 | An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-202… |
CVE-2026-56850 | Medium | 4.1 | 2026-07-30 | A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requ… |
CVE-2026-56847 | Low | 3.3 | 2026-07-30 | A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to… |
CVE-2026-47882 | High | 8.3 | 2026-07-30 | When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Das… |
CVE-2026-47873 | High | 8.0 | 2026-07-30 | The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricti… |
CVE-2026-47858 | High | 8.0 | 2026-07-30 | Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote… |
CVE-2026-16531 | Medium | 5.3 | 2026-07-30 | An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary… |
CVE-2026-16530 | Medium | 6.5 | 2026-07-30 | A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sendi… |
CVE-2026-16529 | High | 7.5 | 2026-07-30 | A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permane… |
CVE-2026-16527 | High | 7.3 | 2026-07-30 | An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overw… |
CVE-2026-16526 | High | 8.8 | 2026-07-30 | A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privilege… |
CVE-2026-16524 | High | 7.8 | 2026-07-30 | A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets… |
CVE-2026-15382 | Medium | 6.5 | 2026-07-30 | The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploa… |
CVE-2026-15257 | Medium | 5.3 | 2026-07-30 | The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allo… |
CVE-2026-15255 | Medium | 5.3 | 2026-07-30 | The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being… |
CVE-2026-15252 | Medium | 5.4 | 2026-07-30 | The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user… |
CVE-2026-15250 | Medium | 5.3 | 2026-07-30 | The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its public book… |
CVE-2026-15240 | High | 7.5 | 2026-07-30 | The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower… |
CVE-2026-15235 | Medium | 4.3 | 2026-07-30 | The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its… |
CVE-2026-15153 | Medium | 6.8 | 2026-07-30 | The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query… |
CVE-2026-15054 | Low | 3.7 | 2026-07-30 | The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated… |
CVE-2026-14923 | Medium | 6.5 | 2026-07-30 | The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates pos… |
CVE-2026-14602 | Critical | 9.0 | 2026-07-30 | The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inj… |