2026 CVEs (page 69)
Page 69 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82761 | | 2026-09-17 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its… | |
CVE-2026-82760 | | 2026-09-17 | Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversize… | |
CVE-2026-82759 | | 2026-09-17 | Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addres… | |
CVE-2026-82723 | | 2026-09-17 | Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the a… | |
CVE-2026-82685 | | 2026-09-17 | Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm anot… | |
CVE-2026-81829 | Medium | 5.3 | 2026-09-17 | A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When th… |
CVE-2026-81637 | | 2026-09-17 | Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the call… | |
CVE-2026-81632 | | 2026-09-17 | Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or b… | |
CVE-2026-81453 | Medium | 6.5 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vu… |
CVE-2026-81443 | Medium | 6.4 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with r… |
CVE-2026-81442 | High | 8.1 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. A low privileged attacker with remot… |
CVE-2026-80355 | Medium | 5.4 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with… |
CVE-2026-80218 | | 2026-09-17 | Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed… | |
CVE-2026-78528 | Medium | 5.3 | 2026-09-17 | Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions. |
CVE-2026-78295 | High | 8.8 | 2026-09-17 | Unauthenticated Cross Site Request Forgery (CSRF) in Xagio SEO <= 7.1.0.43 versions. |
CVE-2026-78294 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. |
CVE-2026-78223 | | 2026-09-17 | Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a… | |
CVE-2026-74017 | Medium | 5.3 | 2026-09-17 | Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions. |
CVE-2026-74005 | Medium | 5.4 | 2026-09-17 | Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions. |
CVE-2026-74002 | Medium | 5.3 | 2026-09-17 | Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions. |
CVE-2026-74000 | Medium | 5.3 | 2026-09-17 | Contributor Broken Access Control in Simple Membership <= 4.8.2 versions. |
CVE-2026-73999 | Medium | 5.4 | 2026-09-17 | Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions. |
CVE-2026-71568 | Medium | 5.3 | 2026-09-17 | In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself… |
CVE-2026-66676 | Medium | 5.3 | 2026-09-17 | Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions. |
CVE-2026-66631 | High | 7.6 | 2026-09-17 | Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions. |
CVE-2026-66630 | High | 7.6 | 2026-09-17 | Administrator SQL Injection in PublishPress Series <= 3.1.3 versions. |
CVE-2026-66628 | High | 7.6 | 2026-09-17 | Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions. |
CVE-2026-66626 | High | 7.6 | 2026-09-17 | Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions. |
CVE-2026-66625 | High | 7.6 | 2026-09-17 | Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions. |
CVE-2026-66624 | High | 7.6 | 2026-09-17 | Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions. |
CVE-2026-66619 | High | 7.6 | 2026-09-17 | Administrator SQL Injection in Newsletters <= 4.18 versions. |
CVE-2026-66618 | High | 7.6 | 2026-09-17 | Administrator SQL Injection in WP Maps <= 4.9.9 versions. |
CVE-2026-66617 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions. |
CVE-2026-66608 | Medium | 6.4 | 2026-09-17 | Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions. |
CVE-2026-66580 | High | 8.5 | 2026-09-17 | Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions. |
CVE-2026-66579 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions. |
CVE-2026-66578 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions. |
CVE-2026-66577 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions. |
CVE-2026-66576 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions. |
CVE-2026-66575 | Medium | 5.3 | 2026-09-17 | Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions. |
CVE-2026-66574 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions. |
CVE-2026-66573 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions. |
CVE-2026-66572 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions. |
CVE-2026-66571 | High | 7.1 | 2026-09-17 | Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions. |
CVE-2026-62108 | Critical | 9.8 | 2026-09-17 | Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions. |
CVE-2026-62104 | Critical | 10.0 | 2026-09-17 | Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions. |
CVE-2026-62101 | Critical | 9.8 | 2026-09-17 | Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions. |
CVE-2026-14850 | | 2026-09-17 | The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipul… | |
CVE-2026-92932 | | 2026-09-17 | In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-bas… | |
CVE-2026-92921 | Medium | 4.9 | 2026-09-17 | admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database acc… |
CVE-2026-92920 | Medium | 5.4 | 2026-09-17 | admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permi… |
CVE-2026-92919 | High | 8.1 | 2026-09-17 | admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on… |
CVE-2026-92918 | High | 8.8 | 2026-09-17 | admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission ca… |
CVE-2026-92904 | Medium | 4.3 | 2026-09-17 | A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocat… |
CVE-2026-81481 | High | 7.5 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vu… |
CVE-2026-92925 | High | 7.1 | 2026-09-17 | A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-ca… |
CVE-2026-92917 | High | 7.5 | 2026-09-17 | Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, js… |
CVE-2026-92916 | High | 7.5 | 2026-09-17 | Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the… |
CVE-2026-92915 | High | 7.3 | 2026-09-17 | WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables t… |
CVE-2026-92914 | High | 8.1 | 2026-09-17 | AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equalit… |
CVE-2026-92913 | High | 7.4 | 2026-09-17 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation /… |
CVE-2026-92912 | Medium | 6.5 | 2026-09-17 | AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entr… |
CVE-2026-92860 | Critical | 9.1 | 2026-09-17 | A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/qui… |
CVE-2026-90823 | Critical | 9.8 | 2026-09-17 | FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_p… |
CVE-2026-90822 | Critical | 9.8 | 2026-09-17 | FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed d… |
CVE-2026-81480 | High | 7.2 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote… |
CVE-2026-81479 | Medium | 5.8 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local acce… |
CVE-2026-81478 | High | 8.1 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker wit… |
CVE-2026-81477 | High | 7.2 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A high privileged attacker with remote a… |
CVE-2026-81476 | High | 8.1 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command In… |
CVE-2026-81475 | High | 8.1 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated att… |
CVE-2026-81441 | Medium | 4.0 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated att… |
CVE-2026-81440 | High | 7.3 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remo… |
CVE-2026-78296 | Medium | 5.3 | 2026-09-17 | Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing. This issue affects FluentAuth: from n/… |
CVE-2026-92903 | High | 8.2 | 2026-09-17 | Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are exe… |
CVE-2026-92893 | Medium | 4.3 | 2026-09-17 | A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not en… |
CVE-2026-92611 | | 2026-09-17 | In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single… | |
CVE-2026-81474 | High | 7.8 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A low privileged attacker with local acc… |
CVE-2026-81439 | Low | 3.7 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote acce… |
CVE-2026-81438 | Low | 3.7 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated a… |
CVE-2026-66269 | High | 7.3 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… |
CVE-2026-92894 | Medium | 4.3 | 2026-09-17 | A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying… |
CVE-2026-78428 | High | 8.0 | 2026-09-17 | For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when mu… |
CVE-2026-78427 | Medium | 4.3 | 2026-09-17 | The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar i… |
CVE-2026-78426 | Low | 3.7 | 2026-09-17 | The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but… |
CVE-2026-78425 | | 2026-09-17 | Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anyth… | |
CVE-2026-50610 | | 2026-09-17 | A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a… | |
CVE-2026-50609 | | 2026-09-17 | A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a p… | |
CVE-2026-50608 | | 2026-09-17 | A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does no… | |
CVE-2026-15688 | | 2026-09-17 | Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to succe… | |
CVE-2026-87831 | Medium | 4.3 | 2026-09-17 | The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before de… |
CVE-2026-87829 | Medium | 4.3 | 2026-09-17 | The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before de… |
CVE-2026-86320 | High | 7.8 | 2026-09-17 | A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious… |
CVE-2026-50607 | | 2026-09-17 | A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to l… | |
CVE-2026-50606 | | 2026-09-17 | A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use… | |
CVE-2026-50605 | | 2026-09-17 | A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privi… | |
CVE-2026-91017 | Low | 3.7 | 2026-09-17 | The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-def… |
CVE-2026-90982 | Medium | 5.3 | 2026-09-17 | @fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such… |
CVE-2026-87963 | High | 8.6 | 2026-09-17 | The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it be… |
CVE-2026-86801 | High | 8.8 | 2026-09-17 | The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication… |