2026 CVEs (page 640)
Page 640 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-23739 | Low | 2.0 | 2026-02-06 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open(… |
CVE-2026-23738 | Low | 3.5 | 2026-02-06 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/con… |
CVE-2026-2057 | High | 7.3 | 2026-02-06 | A vulnerability was detected in SourceCodester Medical Center Portal Management System 1.0. This affects an unknown function of the file /login.php. The manipu… |
CVE-2026-2056 | Medium | 5.3 | 2026-02-06 | A security vulnerability has been detected in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. The impacted element is an unknown function of the file /wan_connec… |
CVE-2026-1337 | Medium | 5.4 | 2026-02-06 | Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs… |
CVE-2026-2055 | Medium | 5.3 | 2026-02-06 | A weakness has been identified in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. The affected element is an unknown function of the component DHCP Client Inform… |
CVE-2026-2054 | Medium | 5.3 | 2026-02-06 | A security flaw has been discovered in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. Impacted is an unknown function of the component Wifi Setting Handler. Per… |
CVE-2026-2018 | High | 7.3 | 2026-02-06 | A flaw has been found in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/settings/controller.php. This manipulati… |
CVE-2026-2017 | Critical | 9.8 | 2026-02-06 | A vulnerability was detected in IP-COM W30AP up to 1.0.0.11(1340). Affected by this issue is the function R7WebsSecurityHandler of the file /goform/wx3auth of… |
CVE-2026-2016 | Medium | 5.3 | 2026-02-06 | A security vulnerability has been detected in happyfish100 libfastcommon up to 1.0.84. Affected by this vulnerability is the function base64_decode of the file… |
CVE-2026-1293 | Medium | 6.4 | 2026-02-06 | The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `yoast-schem… |
CVE-2026-2015 | Medium | 6.3 | 2026-02-06 | A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Fin… |
CVE-2026-2014 | High | 7.3 | 2026-02-06 | A security flaw has been discovered in itsourcecode Student Management System 1.0. This impacts an unknown function of the file /ramonsys/billing/index.php. Pe… |
CVE-2026-2013 | High | 7.3 | 2026-02-06 | A vulnerability was identified in itsourcecode Student Management System 1.0. This affects an unknown function of the file /ramonsys/soa/index.php. Such manipu… |
CVE-2026-24928 | Medium | 5.8 | 2026-02-06 | Out-of-bounds write vulnerability in the file system module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-24927 | Medium | 5.5 | 2026-02-06 | Out-of-bounds access vulnerability in the frequency modulation module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24924 | Medium | 6.1 | 2026-02-06 | Vulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-24920 | Medium | 6.2 | 2026-02-06 | Permission control vulnerability in the AMS module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-2012 | High | 7.3 | 2026-02-06 | A vulnerability was determined in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /ramonsys/facultyloading/… |
CVE-2026-2011 | High | 7.3 | 2026-02-06 | A vulnerability was found in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /ramonsys/enrollment/controlle… |
CVE-2026-24931 | Medium | 5.9 | 2026-02-06 | Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-24930 | High | 8.4 | 2026-02-06 | UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24929 | Medium | 5.9 | 2026-02-06 | Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24926 | High | 8.4 | 2026-02-06 | Out-of-bounds write vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24925 | High | 7.3 | 2026-02-06 | Heap-based buffer overflow vulnerability in the image module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24923 | Medium | 6.3 | 2026-02-06 | Permission control vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-24922 | Medium | 6.9 | 2026-02-06 | Buffer overflow vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24921 | Medium | 4.8 | 2026-02-06 | Address read vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2026-24919 | Medium | 6.0 | 2026-02-06 | Out-of-bounds write vulnerability in the DFX module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24918 | Medium | 6.8 | 2026-02-06 | Address read vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24917 | Medium | 6.5 | 2026-02-06 | UAF vulnerability in the security module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-24916 | Medium | 5.9 | 2026-02-06 | Identity authentication bypass vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-24915 | Medium | 6.2 | 2026-02-06 | Out-of-bounds read issue in the media subsystem. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2026-24914 | Medium | 4.0 | 2026-02-06 | Type confusion vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-21643 | Critical | 9.8 | 2026-02-06 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthentic… |
CVE-2026-1785 | Medium | 4.3 | 2026-02-06 | The Code Snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.4. This is due to missing nonce va… |
CVE-2026-1499 | High | 8.8 | 2026-02-06 | The WP Duplicate plugin for WordPress is vulnerable to Missing Authorization leading to Arbitrary File Upload in all versions up to and including 1.1.8. This i… |
CVE-2026-1252 | Medium | 6.4 | 2026-02-06 | The Events Listing Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Event URL' parameter in all versions up to, and including… |
CVE-2026-2010 | Medium | 4.2 | 2026-02-06 | A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/public… |
CVE-2026-2009 | Medium | 6.3 | 2026-02-06 | A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/php_action/createUser… |
CVE-2026-21626 | High | 7.5 | 2026-02-06 | Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure |
CVE-2026-1279 | Medium | 6.4 | 2026-02-06 | The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_title' parameter in the `search_employee_directory` shor… |
CVE-2026-2008 | Medium | 6.3 | 2026-02-06 | A vulnerability was detected in abhiphile fermat-mcp up to 47f11def1cd37e45dd060f30cdce346cbdbd6f0a. This vulnerability affects the function eqn_chart of the f… |
CVE-2026-2000 | Medium | 4.7 | 2026-02-06 | A vulnerability was found in DCN DCME-320 up to 20260121. Impacted is the function apply_config of the file /function/system/basic/bridge_cfg.php of the compon… |
CVE-2026-1998 | Low | 3.3 | 2026-02-06 | A flaw has been found in micropython up to 1.27.0. This vulnerability affects the function mp_import_all of the file py/runtime.c. This manipulation causes mem… |
CVE-2026-1909 | Medium | 6.4 | 2026-02-06 | The WaveSurfer-WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's audio shortcode in all versions up to, and including, 2.8… |
CVE-2026-1888 | Medium | 6.4 | 2026-02-06 | The Docus – YouTube Video Playlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'docusplaylist' shortcode in all versions up to, a… |
CVE-2026-1808 | Medium | 6.4 | 2026-02-06 | The Orange Confort+ accessibility toolbar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' parameter of the ocpl… |
CVE-2026-1401 | Medium | 6.4 | 2026-02-06 | The Tune Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CSV import in all versions up to, and including, 1.6.3. This is due to i… |
CVE-2026-0521 | Medium | 6.1 | 2026-02-06 | A reflected cross-site scripting (XSS) vulnerability in the PDF export functionality of the TYDAC AG MAP+ solution allows unauthenticated attackers to craft a… |
CVE-2026-1991 | Low | 3.3 | 2026-02-06 | A vulnerability was detected in libuvc up to 0.0.7. Affected is the function uvc_scan_streaming of the file src/device.c of the component UVC Descriptor Handle… |
CVE-2026-0598 | Medium | 4.2 | 2026-02-06 | A security flaw was identified in the Ansible Lightspeed API conversation endpoints that handle AI chat interactions. The APIs do not properly verify whether a… |
CVE-2026-1990 | Low | 3.3 | 2026-02-06 | A security vulnerability has been detected in oatpp up to 1.3.1. This impacts the function oatpp::data::type::ObjectWrapper::ObjectWrapper of the file src/oatp… |
CVE-2026-1979 | Medium | 5.3 | 2026-02-06 | A flaw has been found in mruby up to 3.4.0. This affects the function mrb_vm_exec of the file src/vm.c of the component JMPNOT-to-JMPIF Optimization. Executing… |
CVE-2026-1978 | Medium | 5.3 | 2026-02-06 | A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the compone… |
CVE-2026-1977 | Medium | 6.3 | 2026-02-06 | A security vulnerability has been detected in isaacwasserman mcp-vegalite-server up to 16aefed598b8cd897b78e99b907f6e2984572c61. Affected by this vulnerability… |
CVE-2026-1976 | Medium | 5.3 | 2026-02-06 | A weakness has been identified in Free5GC up to 4.1.0. Affected is the function SessionDeletionResponse of the component SMF. This manipulation causes null poi… |
CVE-2026-1975 | Medium | 5.3 | 2026-02-06 | A security flaw has been discovered in Free5GC up to 4.1.0. This impacts the function identityTriggerType of the file pfcp_reports.go. The manipulation results… |
CVE-2026-1228 | Medium | 4.3 | 2026-02-06 | The Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) plugin for WordPress is vulnerable to Insecure Direct Object Re… |
CVE-2026-1974 | Medium | 5.3 | 2026-02-06 | A vulnerability was identified in Free5GC up to 4.1.0. This affects the function ResolveNodeIdToIp of the file internal/sbi/processor/datapath.go of the compon… |
CVE-2026-1973 | Medium | 5.3 | 2026-02-06 | A vulnerability was determined in Free5GC up to 4.1.0. The impacted element is the function establishPfcpSession of the component SMF. Executing a manipulation… |
CVE-2026-1972 | Medium | 5.3 | 2026-02-06 | A vulnerability was found in Edimax BR-6208AC 2_1.02. The affected element is the function auth_check_userpass2. Performing a manipulation of the argument User… |
CVE-2026-1971 | Low | 2.4 | 2026-02-06 | A vulnerability has been found in Edimax BR-6288ACL up to 1.12. Impacted is the function wiz_WISP24gmanual of the file wiz_WISP24gmanual.asp. Such manipulation… |
CVE-2026-23623 | Medium | 5.3 | 2026-02-06 | Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to Collabora Online Development Edition version 25.04.08.2 and p… |
CVE-2026-24302 | High | 8.6 | 2026-02-05 | Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-24300 | Critical | 9.8 | 2026-02-05 | Azure Front Door Elevation of Privilege Vulnerability |
CVE-2026-21532 | High | 8.2 | 2026-02-05 | Azure Function Information Disclosure Vulnerability |
CVE-2026-0391 | Medium | 6.5 | 2026-02-05 | User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-25815 | Low | 3.2 | 2026-02-05 | Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 thro… |
CVE-2026-1970 | Low | 3.5 | 2026-02-05 | A flaw has been found in Edimax BR-6258n up to 1.18. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup. This manipulation of… |
CVE-2026-1964 | Medium | 4.3 | 2026-02-05 | A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endpoint. This manipula… |
CVE-2026-1963 | Medium | 6.3 | 2026-02-05 | A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachment Storage. The mani… |
CVE-2026-1962 | Medium | 6.3 | 2026-02-05 | A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Atta… |
CVE-2026-0106 | Critical | 9.3 | 2026-02-05 | In vpu_mmap of vpu_ioctl, there is a possible arbitrary address mmap due to a missing bounds check. This could lead to local escalation of privilege with no ad… |
CVE-2026-1301 | | 2026-02-05 | In builds with PubSub and JSON enabled, a crafted JSON message can cause the decoder to write beyond a heap-allocated array before authentication, reliably cra… | |
CVE-2026-1707 | High | 7.4 | 2026-02-05 | pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing rest… |
CVE-2026-0715 | Medium | 6.8 | 2026-02-05 | Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physi… |
CVE-2026-0714 | Medium | 6.8 | 2026-02-05 | A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Linux 3, where the di… |
CVE-2026-1927 | Medium | 5.4 | 2026-02-05 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the g… |
CVE-2026-1523 | | 2026-02-05 | Path Traversal vulnerability in Digitek ADT1100 and Digitek DT950 from PRIMION DIGITEK, S.L.U (Azkoyen Group). This vulnerability allows an attacker to access… | |
CVE-2026-23797 | Medium | 4.9 | 2026-02-05 | In Quick.Cart user passwords are stored in plaintext form. An attacker with high privileges can display users' password in user editing page. The vendor was n… |
CVE-2026-23796 | Critical | 9.8 | 2026-02-05 | Quick.Cart allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour… |
CVE-2026-23572 | High | 7.2 | 2026-02-05 | Improper access control in the TeamViewer Full and Host clients (Windows, macOS, Linux) prior version 15.74.5 allows an authenticated user to bypass additional… |
CVE-2026-1966 | | 2026-02-05 | YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration v… | |
CVE-2026-1517 | Medium | 4.7 | 2026-02-05 | A vulnerability was identified in iomad up to 5.0. Affected is an unknown function of the component Company Admin Block. Such manipulation leads to sql injecti… |
CVE-2026-1654 | Medium | 6.1 | 2026-02-05 | The Peter's Date Countdown plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to… |
CVE-2026-1294 | High | 7.2 | 2026-02-05 | The All In One Image Viewer Block plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.2 due to missing… |
CVE-2026-1271 | Medium | 5.3 | 2026-02-05 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inclu… |
CVE-2026-1319 | Medium | 6.4 | 2026-02-05 | The Robin Image Optimizer – Unlimited Image Optimization & WebP Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternativ… |
CVE-2026-25198 | Medium | 4.7 | 2026-02-05 | web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. If this vulnerability is exploited, the user may… |
CVE-2026-1953 | | 2026-02-05 | Nukegraphic CMS v3.1.2 contains a stored cross-site scripting (XSS) vulnerability in the user profile edit functionality at /ngc-cms/user-edit-profile.php. The… | |
CVE-2026-1268 | Medium | 6.4 | 2026-02-05 | The Dynamic Widget Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget content field in the Gutenberg editor sidebar in al… |
CVE-2026-1246 | Medium | 4.9 | 2026-02-05 | The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Read via path traversal in the 'loadFile' parameter in all versions up to… |
CVE-2026-0867 | Medium | 6.4 | 2026-02-05 | The Essential Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ew-author, ew-archive, ew-category, ew-page, and ew-me… |
CVE-2026-1898 | Medium | 6.3 | 2026-02-05 | A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User… |
CVE-2026-1897 | Medium | 4.3 | 2026-02-05 | A vulnerability was found in WeKan up to 8.20. Affected by this issue is some unknown functionality of the file server/methods/positionHistory.js of the compon… |
CVE-2026-1896 | Medium | 6.3 | 2026-02-05 | A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMigration of the file server/migrations/co… |
CVE-2026-25585 | High | 7.8 | 2026-02-04 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-22038 | High | 8.1 | 2026-02-04 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autog… |
CVE-2026-1895 | Medium | 6.3 | 2026-02-04 | A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Exec… |