2026 CVEs (page 650)
Page 650 of 658 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-1183 | | 2026-01-20 | HTML injection vulnerability in multiple Botble products such as TransP, Athena, Martfury, and Homzen, consisting of an HTML injection due to a lack of proper… | |
CVE-2026-1180 | Medium | 5.8 | 2026-01-20 | A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using private_key_jwt. The issue allows a clie… |
CVE-2026-0895 | | 2026-01-20 | The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/… | |
CVE-2026-1223 | Medium | 4.9 | 2026-01-20 | PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers t… |
CVE-2026-1222 | High | 7.2 | 2026-01-20 | PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and ex… |
CVE-2026-1221 | Critical | 9.8 | 2026-01-20 | PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to… |
CVE-2026-1218 | Medium | 6.3 | 2026-01-20 | A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0. Impacted is the function initRCForm of the file RichClientService.class of the component com.arte… |
CVE-2026-1045 | Medium | 4.4 | 2026-01-20 | The Viet contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.2 due to insuff… |
CVE-2026-1042 | Medium | 4.4 | 2026-01-20 | The WP Hello Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'digit_one' and 'digit_two' parameters in all versions up to, and in… |
CVE-2026-0908 | High | 8.8 | 2026-01-20 | Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2026-0907 | Critical | 9.8 | 2026-01-20 | Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium… |
CVE-2026-0906 | Critical | 9.8 | 2026-01-20 | Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafte… |
CVE-2026-0905 | Critical | 9.8 | 2026-01-20 | Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to potentially obtain pote… |
CVE-2026-0904 | Medium | 5.4 | 2026-01-20 | Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing via a crafted HTML pa… |
CVE-2026-0903 | Medium | 5.4 | 2026-01-20 | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous file type protection… |
CVE-2026-0902 | High | 8.8 | 2026-01-20 | Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML… |
CVE-2026-0901 | Medium | 5.4 | 2026-01-20 | Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML pa… |
CVE-2026-0900 | High | 8.8 | 2026-01-20 | Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTM… |
CVE-2026-0899 | High | 8.8 | 2026-01-20 | Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML… |
CVE-2026-1051 | Medium | 4.3 | 2026-01-20 | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.1… |
CVE-2026-23950 | High | 8.8 | 2026-01-20 | node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path col… |
CVE-2026-23949 | High | 8.6 | 2026-01-20 | jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `… |
CVE-2026-23947 | Critical | 9.8 | 2026-01-20 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to… |
CVE-2026-23876 | High | 8.1 | 2026-01-20 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow… |
CVE-2026-23874 | Medium | 5.5 | 2026-01-20 | ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-13 have a stack overflow via infinite re… |
CVE-2026-22770 | Medium | 6.5 | 2026-01-20 | ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buff… |
CVE-2026-1203 | Medium | 5.6 | 2026-01-20 | A weakness has been identified in CRMEB up to 5.6.3. The impacted element is the function remoteRegister of the file crmeb/app/services/user/LoginServices.php… |
CVE-2026-1202 | High | 7.3 | 2026-01-20 | A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginControll… |
CVE-2026-1197 | Low | 3.1 | 2026-01-20 | A vulnerability was detected in MineAdmin 1.x/2.x. Affected by this vulnerability is an unknown functionality of the file /system/downloadById. Performing a ma… |
CVE-2026-1196 | Low | 3.1 | 2026-01-20 | A security vulnerability has been detected in MineAdmin 1.x/2.x. Affected is an unknown function of the file /system/getFileInfoById. Such manipulation of the… |
CVE-2026-1195 | Medium | 5.0 | 2026-01-20 | A weakness has been identified in MineAdmin 1.x/2.x. This impacts the function refresh of the file /system/refresh of the component JWT Token Handler. This man… |
CVE-2026-22219 | High | 7.7 | 2026-01-20 | Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlc… |
CVE-2026-22218 | Medium | 6.5 | 2026-01-20 | Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom El… |
CVE-2026-1194 | Medium | 5.3 | 2026-01-20 | A security flaw has been discovered in MineAdmin 1.x/2.x. This affects an unknown function of the component Swagger. The manipulation results in information di… |
CVE-2026-1193 | Medium | 6.3 | 2026-01-19 | A vulnerability was identified in MineAdmin 1.x/2.x. The impacted element is an unknown function of the file /system/cache/view of the component View Interface… |
CVE-2026-1192 | High | 7.3 | 2026-01-19 | A vulnerability was determined in Tosei Online Store Management System ネット店舗管理システム 1.01. The affected element is an unknown function of the file /cgi-bin/imode… |
CVE-2026-1179 | High | 7.3 | 2026-01-19 | A vulnerability was detected in Yonyou KSOA 9.0. This affects an unknown part of the file /kmf/user_popedom.jsp of the component HTTP GET Parameter Handler. Th… |
CVE-2026-23944 | Critical | 9.8 | 2026-01-19 | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests could be proxied to rem… |
CVE-2026-23885 | Medium | 6.4 | 2026-01-19 | Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()`… |
CVE-2026-1178 | High | 7.3 | 2026-01-19 | A security vulnerability has been detected in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /kmf/select.jsp of the componen… |
CVE-2026-1177 | High | 7.3 | 2026-01-19 | A weakness has been identified in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /kmf/save_folder.jsp of the component… |
CVE-2026-23886 | Medium | 5.3 | 2026-01-19 | Swift W3C TraceContext is a Swift implementation of the W3C Trace Context standard, and Swift OTel is an OpenTelemetry Protocol (OTLP) backend for Swift Log, S… |
CVE-2026-23880 | High | 7.3 | 2026-01-19 | OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software pri… |
CVE-2026-23877 | Medium | 4.3 | 2026-01-19 | Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()` function in the `/folder/dir-browser` e… |
CVE-2026-23875 | Medium | 5.4 | 2026-01-19 | CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots. Prior to version 0.0.8, a non-existing perm… |
CVE-2026-23849 | Medium | 5.3 | 2026-01-19 | File Browser provides a file managing interface within a specified directory and can be used to upload, delete, preview, rename, and edit files. Prior to versi… |
CVE-2026-23848 | Medium | 6.5 | 2026-01-19 | MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.7.71, a rate limiting bypass via `X-Forwarded-For` header spoofing… |
CVE-2026-23844 | Medium | 4.3 | 2026-01-19 | Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulnerability. A user can update/create accou… |
CVE-2026-23837 | Critical | 9.8 | 2026-01-19 | MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows una… |
CVE-2026-1176 | High | 7.3 | 2026-01-19 | A security flaw has been discovered in itsourcecode School Management System 1.0. Affected is an unknown function of the file /subject/index.php. Performing a… |
CVE-2026-1175 | Medium | 5.3 | 2026-01-19 | A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql of the component GraphQL Directive Han… |
CVE-2026-23852 | Critical | 9.6 | 2026-01-19 | SiYuan is a personal knowledge management system. Versions prior to 3.5.4 have a stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to inj… |
CVE-2026-23851 | Medium | 6.5 | 2026-01-19 | SiYuan is a personal knowledge management system. Versions prior to 3.5.4 contain a logic vulnerability in the /api/file/globalCopyFiles endpoint. The function… |
CVE-2026-23850 | High | 7.5 | 2026-01-19 | SiYuan is a personal knowledge management system. In versions prior to 3.5.4, the markdown feature allows unrestricted server side html-rendering which allows… |
CVE-2026-23847 | Medium | 6.1 | 2026-01-19 | SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to u… |
CVE-2026-23846 | High | 8.1 | 2026-01-19 | Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwo… |
CVE-2026-21696 | Medium | 6.5 | 2026-01-19 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Win… |
CVE-2026-1174 | Medium | 5.3 | 2026-01-19 | A vulnerability was determined in birkir prime up to 0.4.0.beta.0. This affects an unknown function of the file /graphql of the component GraphQL Alias Handler… |
CVE-2026-1173 | Medium | 5.3 | 2026-01-19 | A vulnerability was found in birkir prime up to 0.4.0.beta.0. The impacted element is an unknown function of the file /graphql of the component GraphQL Array B… |
CVE-2026-23878 | Medium | 6.5 | 2026-01-19 | HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ceacd5f1476458792c44c6a993670f02c984b4a0… |
CVE-2026-23845 | Medium | 5.8 | 2026-01-19 | Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Downl… |
CVE-2026-23843 | High | 7.1 | 2026-01-19 | teklifolustur_app is a web-based PHP application that allows users to create, manage, and track quotes for their clients. Prior to commit dd082a134a225b8dcd401… |
CVE-2026-23842 | High | 7.5 | 2026-01-19 | ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service c… |
CVE-2026-23841 | Critical | 9.3 | 2026-01-19 | Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripti… |
CVE-2026-23840 | Critical | 9.3 | 2026-01-19 | Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripti… |
CVE-2026-23839 | Critical | 9.3 | 2026-01-19 | Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripti… |
CVE-2026-23838 | | 2026-01-19 | Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the de… | |
CVE-2026-1172 | Medium | 5.3 | 2026-01-19 | A vulnerability has been found in birkir prime up to 0.4.0.beta.0. The affected element is an unknown function of the file /graphql of the component GraphQL Di… |
CVE-2026-1171 | Medium | 5.3 | 2026-01-19 | A flaw has been found in birkir prime up to 0.4.0.beta.0. Impacted is an unknown function of the file /graphql of the component GraphQL Field Handler. Executin… |
CVE-2026-23884 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed mem… |
CVE-2026-23883 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free`… |
CVE-2026-23836 | Critical | 9.9 | 2026-01-19 | HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which… |
CVE-2026-23833 | High | 7.5 | 2026-01-19 | ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the AP… |
CVE-2026-23732 | High | 7.5 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validate… |
CVE-2026-23721 | Medium | 4.3 | 2026-01-19 | OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visibl… |
CVE-2026-23646 | Medium | 6.5 | 2026-01-19 | OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end… |
CVE-2026-23625 | High | 8.7 | 2026-01-19 | OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerabilit… |
CVE-2026-23534 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands dec… |
CVE-2026-23533 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec de… |
CVE-2026-22797 | Critical | 9.9 | 2026-01-19 | An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. T… |
CVE-2026-1170 | Medium | 5.3 | 2026-01-19 | A vulnerability was detected in birkir prime up to 0.4.0.beta.0. This issue affects some unknown processing of the file /graphql of the component GraphQL API… |
CVE-2026-1169 | Medium | 4.3 | 2026-01-19 | A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code. Such manipulation leads to cross-site r… |
CVE-2026-23532 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `g… |
CVE-2026-23531 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls… |
CVE-2026-23530 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrc… |
CVE-2026-23522 | Low | 3.7 | 2026-01-19 | LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, `knowledgeBase.removeFilesFromKnowledgeBase` tRPC ep allows authenticate… |
CVE-2026-22850 | High | 8.3 | 2026-01-19 | Koko Analytics is an open-source analytics plugin for WordPress. Versions prior to 2.1.3 are vulnerable to arbitrary SQL execution through unescaped analytics… |
CVE-2026-22037 | High | 8.4 | 2026-01-19 | The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middle… |
CVE-2026-1162 | Critical | 9.8 | 2026-01-19 | A flaw has been found in UTT HiPER 810 1.7.4-141218. The impacted element is the function strcpy of the file /goform/setSysAdm. This manipulation of the argume… |
CVE-2026-22031 | High | 8.4 | 2026-01-19 | @fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 wh… |
CVE-2026-1161 | Low | 3.5 | 2026-01-19 | A vulnerability was detected in pbrong hrms 1.0.1. The affected element is the function UpdateRecruitmentById of the file /handler/recruitment.go. The manipula… |
CVE-2026-1160 | High | 7.3 | 2026-01-19 | A security vulnerability has been detected in PHPGurukul Directory Management System 1.0. Impacted is an unknown function of the file /index.php of the compone… |
CVE-2026-21618 | Medium | 6.1 | 2026-01-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthoriz… |
CVE-2026-1159 | High | 7.3 | 2026-01-19 | A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This issue affects some unknown processing of the file /order_online.ph… |
CVE-2026-1158 | High | 8.8 | 2026-01-19 | A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWizardCfg of the file /cgi-bin/cstecgi… |
CVE-2026-1007 | High | 7.6 | 2026-01-19 | Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: fr… |
CVE-2026-0610 | Critical | 9.8 | 2026-01-19 | SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12 |
CVE-2026-1157 | High | 8.8 | 2026-01-19 | A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This affects the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi. Such manipul… |
CVE-2026-1156 | High | 8.8 | 2026-01-19 | A vulnerability was determined in Totolink LR350 9.3.5u.6369_B20220309. Affected by this issue is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-1181 | Critical | 9.0 | 2026-01-19 | Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin req… |