2026 CVEs (page 70)
Page 70 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44940 | Medium | 5.7 | 2026-09-17 | The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them… |
CVE-2026-91019 | Medium | 4.9 | 2026-09-17 | The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing user… |
CVE-2026-91016 | Medium | 5.3 | 2026-09-17 | The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowin… |
CVE-2026-91015 | Medium | 5.3 | 2026-09-17 | The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder po… |
CVE-2026-91014 | High | 7.1 | 2026-09-17 | The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back… |
CVE-2026-91011 | Medium | 6.8 | 2026-09-17 | The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated use… |
CVE-2026-91010 | Medium | 4.3 | 2026-09-17 | The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message del… |
CVE-2026-91009 | Medium | 4.3 | 2026-09-17 | The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actio… |
CVE-2026-91008 | Low | 3.7 | 2026-09-17 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirma… |
CVE-2026-90923 | Medium | 6.5 | 2026-09-17 | The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete… |
CVE-2026-90922 | Medium | 5.3 | 2026-09-17 | The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pendin… |
CVE-2026-88904 | High | 8.8 | 2026-09-17 | The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from… |
CVE-2026-88795 | Critical | 9.0 | 2026-09-17 | The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester con… |
CVE-2026-88792 | High | 8.8 | 2026-09-17 | The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing… |
CVE-2026-87836 | Low | 2.7 | 2026-09-17 | The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to con… |
CVE-2026-87786 | High | 8.8 | 2026-09-17 | The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allow… |
CVE-2026-86824 | Medium | 4.8 | 2026-09-17 | The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unk… |
CVE-2026-86788 | Medium | 6.8 | 2026-09-17 | The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widge… |
CVE-2026-86710 | Critical | 9.8 | 2026-09-17 | The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value… |
CVE-2026-86709 | Critical | 9.8 | 2026-09-17 | The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attacke… |
CVE-2026-86707 | Critical | 9.8 | 2026-09-17 | The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user m… |
CVE-2026-86446 | Low | 3.7 | 2026-09-17 | The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attack… |
CVE-2026-85130 | High | 8.8 | 2026-09-17 | The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later outpu… |
CVE-2026-85128 | High | 7.5 | 2026-09-17 | The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chos… |
CVE-2026-87935 | High | 8.1 | 2026-09-17 | The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler functio… |
CVE-2026-87796 | Critical | 9.8 | 2026-09-17 | The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file… |
CVE-2026-50604 | | 2026-09-17 | A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not prope… | |
CVE-2026-25294 | High | 7.4 | 2026-09-17 | Transient DOS while parsing frame during channel usage. |
CVE-2026-25290 | High | 7.8 | 2026-09-17 | Memory Corruption when validating large data buffers from external sources using addition to check buffer length. |
CVE-2026-25284 | High | 7.3 | 2026-09-17 | Information Disclosure when a pointer is reused after being deallocated. |
CVE-2026-25283 | High | 8.8 | 2026-09-17 | Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size. |
CVE-2026-25282 | High | 7.9 | 2026-09-17 | Transient DOS when processing unverified data from a neighboring system causes out of bound memory access. |
CVE-2026-25281 | High | 7.4 | 2026-09-17 | Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation. |
CVE-2026-25280 | High | 7.8 | 2026-09-17 | Memory corruption when processing escape handling flow with insufficient user buffer sizes. |
CVE-2026-25278 | High | 7.8 | 2026-09-17 | Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying. |
CVE-2026-25275 | High | 7.5 | 2026-09-17 | Transient DOS when processing authentication frames with invalid FILS information element header lengths. |
CVE-2026-25261 | Medium | 6.7 | 2026-09-17 | Memory corruption while processing rear sensor IOCTL calls. |
CVE-2026-24081 | High | 7.4 | 2026-09-17 | Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled. |
CVE-2026-24075 | High | 7.8 | 2026-09-17 | Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions. |
CVE-2026-24074 | High | 7.8 | 2026-09-17 | Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations. |
CVE-2026-24073 | High | 7.8 | 2026-09-17 | Memory corruption when processing decode statistics due to insufficient validation of offset against structure size. |
CVE-2026-92839 | Medium | 4.3 | 2026-09-17 | Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin conte… |
CVE-2026-86311 | Medium | 6.4 | 2026-09-17 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in al… |
CVE-2026-50603 | | 2026-09-17 | A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a… | |
CVE-2026-89064 | Medium | 5.3 | 2026-09-17 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This i… |
CVE-2026-92838 | High | 7.8 | 2026-09-17 | A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries (DLLs) from… |
CVE-2026-81546 | High | 7.7 | 2026-09-17 | The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity document files leading t… |
CVE-2026-65388 | High | 7.5 | 2026-09-16 | A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim'… |
CVE-2026-61599 | | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport… | |
CVE-2026-61596 | High | 7.1 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object autho… |
CVE-2026-61589 | Medium | 6.3 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mo… |
CVE-2026-61588 | Medium | 6.5 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django `Model` in… |
CVE-2026-92599 | High | 7.5 | 2026-09-16 | joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().is… |
CVE-2026-92598 | Medium | 6.5 | 2026-09-16 | Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punyco… |
CVE-2026-92597 | Medium | 6.5 | 2026-09-16 | Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break… |
CVE-2026-92596 | High | 7.5 | 2026-09-16 | Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of servi… |
CVE-2026-92595 | Medium | 5.9 | 2026-09-16 | Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message conte… |
CVE-2026-92594 | High | 7.5 | 2026-09-16 | Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-dat… |
CVE-2026-92593 | High | 8.8 | 2026-09-16 | Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate()… |
CVE-2026-92592 | High | 8.8 | 2026-09-16 | Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used… |
CVE-2026-92591 | Medium | 5.9 | 2026-09-16 | Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — includin… |
CVE-2026-92590 | Medium | 5.4 | 2026-09-16 | Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescapin… |
CVE-2026-92589 | Medium | 4.3 | 2026-09-16 | Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control… |
CVE-2026-92588 | Medium | 4.4 | 2026-09-16 | n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push f… |
CVE-2026-92587 | Medium | 5.0 | 2026-09-16 | n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured rep… |
CVE-2026-92586 | Medium | 4.3 | 2026-09-16 | AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authen… |
CVE-2026-92585 | Medium | 4.3 | 2026-09-16 | AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in u… |
CVE-2026-92584 | Medium | 6.1 | 2026-09-16 | AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoA… |
CVE-2026-92583 | Medium | 6.5 | 2026-09-16 | AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to… |
CVE-2026-92582 | High | 7.1 | 2026-09-16 | AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF… |
CVE-2026-92581 | Medium | 4.3 | 2026-09-16 | In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchroni… |
CVE-2026-92580 | High | 8.8 | 2026-09-16 | In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php (line ~270) the stored SSH… |
CVE-2026-92579 | Medium | 5.4 | 2026-09-16 | In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin file… |
CVE-2026-92578 | High | 8.1 | 2026-09-16 | WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two ind… |
CVE-2026-92577 | High | 7.5 | 2026-09-16 | In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns user-group-restric… |
CVE-2026-92576 | High | 8.6 | 2026-09-16 | HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the _validate_url() function fails to block… |
CVE-2026-89034 | Medium | 6.5 | 2026-09-16 | TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows a… |
CVE-2026-85469 | High | 8.0 | 2026-09-16 | A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release… |
CVE-2026-64684 | Medium | 6.8 | 2026-09-16 | RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common… |
CVE-2026-61597 | | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in comp… | |
CVE-2026-61594 | Critical | 9.1 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) tra… |
CVE-2026-61592 | High | 7.4 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed… |
CVE-2026-61591 | High | 8.1 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into… |
CVE-2026-92816 | High | 7.8 | 2026-09-16 | ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output direct… |
CVE-2026-92815 | High | 7.5 | 2026-09-16 | changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Atta… |
CVE-2026-92814 | Medium | 4.2 | 2026-09-16 | changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malici… |
CVE-2026-92813 | Medium | 4.9 | 2026-09-16 | Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopbac… |
CVE-2026-92812 | Medium | 6.8 | 2026-09-16 | decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator valid… |
CVE-2026-92811 | Medium | 6.5 | 2026-09-16 | browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders t… |
CVE-2026-92810 | Medium | 4.3 | 2026-09-16 | PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retriev… |
CVE-2026-92809 | Medium | 4.3 | 2026-09-16 | PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers c… |
CVE-2026-92806 | High | 8.1 | 2026-09-16 | phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in a… |
CVE-2026-92805 | Critical | 9.8 | 2026-09-16 | UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unaut… |
CVE-2026-92804 | High | 7.1 | 2026-09-16 | Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated… |
CVE-2026-92803 | Medium | 5.3 | 2026-09-16 | LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. Attackers can… |
CVE-2026-92802 | Medium | 4.3 | 2026-09-16 | kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking… |
CVE-2026-92801 | High | 8.8 | 2026-09-16 | cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatc… |
CVE-2026-92800 | Medium | 6.8 | 2026-09-16 | Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can re… |
CVE-2026-92796 | High | 8.8 | 2026-09-16 | Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to exe… |
CVE-2026-92795 | Medium | 6.5 | 2026-09-16 | Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch inter… |