2026 CVEs (page 643)
Page 643 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-1801 | Medium | 5.3 | 2026-02-03 | A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_… |
CVE-2026-25616 | Medium | 4.7 | 2026-02-03 | Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665. |
CVE-2026-25615 | High | 7.2 | 2026-02-03 | Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668. |
CVE-2026-25614 | High | 7.5 | 2026-02-03 | Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680. |
CVE-2026-24441 | Medium | 5.9 | 2026-02-03 | Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior expose account credentials in plaintext within HTTP responses, allowing an on-path attacker to ob… |
CVE-2026-24434 | Medium | 6.5 | 2026-02-03 | Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior does not implement CSRF protections for administrative functions in the web management interface… |
CVE-2026-24149 | High | 7.8 | 2026-02-03 | NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injection issue. A succ… |
CVE-2026-1803 | High | 8.1 | 2026-02-03 | A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the component Dropbear SSH Service. This manipulation causes u… |
CVE-2026-25522 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25503 | High | 7.1 | 2026-02-03 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-25502 | High | 7.8 | 2026-02-03 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-25490 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25489 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25488 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25487 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25486 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute ma… |
CVE-2026-25485 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25484 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, there is a Stored XSS via Product Type nam… |
CVE-2026-25483 | Medium | 5.4 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exists in Craft… |
CVE-2026-25482 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in t… |
CVE-2026-25241 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, an unauthenticated SQL injection in the /get/<package>/<versi… |
CVE-2026-25240 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability can occur in user::maintains()… |
CVE-2026-25239 | High | 7.5 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in apidoc queue insertion can a… |
CVE-2026-25238 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in bug subscription deletion ma… |
CVE-2026-25237 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, use of preg_replace() with the /e modifier in bug update emai… |
CVE-2026-25236 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection risk exists in karma queries due to unsafe li… |
CVE-2026-25235 | High | 7.5 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess… |
CVE-2026-25234 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in category deletion can allow… |
CVE-2026-25233 | Critical | 9.1 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintaine… |
CVE-2026-24427 | Medium | 5.5 | 2026-02-03 | Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior expose sensitive information in web management responses. Administrative credentials, including t… |
CVE-2026-24426 | Medium | 6.1 | 2026-02-03 | Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior contain an improper output encoding vulnerability in the web management interface. User-supplied… |
CVE-2026-1802 | High | 7.3 | 2026-02-03 | A security flaw has been discovered in Ziroom ZHOME A0101 1.0.1.0. This issue affects the function macAddrClone of the file luci\controller\api\zrMacClone.lua… |
CVE-2026-0620 | | 2026-02-03 | When configured as L2TP/IPSec VPN server, Archer AXE75 V1 may accept connections using L2TP without IPSec protection, even when IPSec is enabled. This allows… | |
CVE-2026-24774 | Medium | 4.3 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a business logic vulnerability allows a… |
CVE-2026-24773 | High | 7.5 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an Insecure Direct Object Reference (ID… |
CVE-2026-24674 | Medium | 4.7 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Reflected Cross-Site Scripting (XSS)… |
CVE-2026-24673 | Medium | 4.3 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a file upload validation bypass vulnera… |
CVE-2026-24672 | High | 7.3 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting (XSS) vul… |
CVE-2026-24671 | Medium | 6.1 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting (XSS) vul… |
CVE-2026-24670 | Medium | 6.5 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a broken access control vulnerability a… |
CVE-2026-24669 | High | 7.8 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an insecure password reset mechanism al… |
CVE-2026-24668 | Medium | 6.5 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a broken access control vulnerability a… |
CVE-2026-24667 | Medium | 5.0 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidate active user sessi… |
CVE-2026-24666 | Medium | 6.5 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Cross-Site Request Forgery (CSRF) vul… |
CVE-2026-24665 | High | 8.7 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a stored Cross-Site Scripting (XSS) vul… |
CVE-2026-24664 | Medium | 5.3 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a username enumeration vulnerability al… |
CVE-2026-22228 | Medium | 4.9 | 2026-02-03 | An authenticated user with high privileges may trigger a denial‑of‑service condition in TP-Link Archer BE230 v1.2 by restoring a crafted configuration file con… |
CVE-2026-22220 | Medium | 4.5 | 2026-02-03 | A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web… |
CVE-2026-1568 | Critical | 9.6 | 2026-02-03 | Rapid7 InsightVM versions before 8.34.0 contain a signature verification issue on the Assertion Consumer Service (ACS) cloud endpoint that could allow an attac… |
CVE-2026-24762 | High | 7.5 | 2026-02-03 | RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material (access key, secret… |
CVE-2026-23795 | Medium | 4.9 | 2026-02-03 | Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Ke… |
CVE-2026-23794 | Medium | 6.8 | 2026-02-03 | Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduse… |
CVE-2026-21862 | High | 7.5 | 2026-02-03 | RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: get_condition_values trusts cl… |
CVE-2026-25036 | Medium | 6.5 | 2026-02-03 | Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-25028 | Medium | 5.4 | 2026-02-03 | Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Exploiting Incorrectly Co… |
CVE-2026-25027 | High | 7.5 | 2026-02-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp unicamp allows PHP L… |
CVE-2026-25024 | Medium | 5.4 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Cross Site Request Forgery.This issue affects Thir… |
CVE-2026-25023 | Medium | 5.3 | 2026-02-03 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in mdedev Run Contests, Raffles, and Giveaways with ContestsWP contest… |
CVE-2026-25022 | High | 8.5 | 2026-02-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system… |
CVE-2026-25021 | Medium | 5.4 | 2026-02-03 | Missing Authorization vulnerability in Mizan Themes Mizan Demo Importer mizan-demo-importer allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-25020 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in WP connect WP Sync for Notion wp-sync-for-notion allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-25019 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-25016 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Nelio Software Nelio Popups nelio-popups allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-25015 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1… |
CVE-2026-25014 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in themelooks Enter Addons enteraddons allows Cross Site Request Forgery.This issue affects Enter Addons: from… |
CVE-2026-25012 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-25011 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured A… |
CVE-2026-25010 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in ILLID Share This Image share-this-image allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-24998 | Medium | 5.3 | 2026-02-03 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hustle wordpress-popu… |
CVE-2026-24997 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in Wired Impact Wired Impact Volunteer Management wired-impact-volunteer-management allows Exploiting Incorrectly Configure… |
CVE-2026-24996 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in wpelemento WPElemento Importer wpelemento-importer allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-24995 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-24994 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-24992 | Medium | 5.3 | 2026-02-03 | Insertion of Sensitive Information Into Sent Data vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-s… |
CVE-2026-24991 | Medium | 5.3 | 2026-02-03 | Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Acc… |
CVE-2026-24990 | Medium | 5.4 | 2026-02-03 | Missing Authorization vulnerability in Fahad Mahmood WP Docs wp-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-24988 | Medium | 6.5 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Hogg The Events Calendar Shortcode & Block the-even… |
CVE-2026-24986 | Medium | 5.4 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in wp.insider Simple Membership WP user Import simple-membership-wp-user-import allows Cross Site Request Forge… |
CVE-2026-24985 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in approveme WP Forms Signature Contract Add-On wp-forms-signature-contract-add-on allows Exploiting Incorrectly Configured… |
CVE-2026-24984 | Medium | 6.5 | 2026-02-03 | Missing Authorization vulnerability in Brecht Visual Link Preview visual-link-preview allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-24982 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-24967 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2026-24966 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in Copyscape Copyscape Premium copyscape-premium allows Cross Site Request Forgery.This issue affects Copyscape… |
CVE-2026-24965 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Exploiting Incorrectly Configured Acc… |
CVE-2026-24962 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Sigmize sigmize allows Cross Site Request Forgery.This issue affects Sigmize: from n/a thro… |
CVE-2026-24961 | Medium | 5.4 | 2026-02-03 | Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Server Side Request Forgery.This issue affects Grand Blog: from n/a… |
CVE-2026-24958 | Medium | 6.5 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows… |
CVE-2026-24957 | Medium | 6.5 | 2026-02-03 | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-24954 | High | 8.8 | 2026-02-03 | Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a thro… |
CVE-2026-24952 | Medium | 6.5 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple… |
CVE-2026-24951 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCr… |
CVE-2026-24947 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-24945 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured… |
CVE-2026-24942 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in magepeopleteam WpEvently mage-eventpress allows Cross Site Request Forgery.This issue affects WpEvently: fro… |
CVE-2026-24940 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Themefic Travelfic Toolkit travelfic-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-24939 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-24938 | Medium | 5.9 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Better Search better-search allows Stored XSS.This i… |
CVE-2026-1814 | | 2026-02-03 | Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. Wh… | |
CVE-2026-1312 | Medium | 5.4 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases con… |
CVE-2026-1287 | Medium | 5.4 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via con… |