2026 CVEs (page 711)
Page 711 of 725 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-23888 | Medium | 6.5 | 2026-01-26 | pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's binary fetcher allows malicious packages to write files outside t… |
CVE-2026-22709 | Critical | 9.8 | 2026-01-26 | vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be b… |
CVE-2026-22696 | | 2026-01-26 | dcap-qvl implements the quote verification logic for DCAP (Data Center Attestation Primitives). A vulnerability present in versions prior to 0.3.9 involves a c… | |
CVE-2026-1445 | Medium | 4.7 | 2026-01-26 | A vulnerability was found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This vulnerability affects unknown code of the file contr… |
CVE-2026-1444 | Low | 2.4 | 2026-01-26 | A vulnerability has been found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This affects an unknown part of the file controllers… |
CVE-2026-23864 | High | 7.5 | 2026-01-26 | Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbop… |
CVE-2026-1443 | High | 7.3 | 2026-01-26 | A flaw has been found in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP/AdminDeleteUs… |
CVE-2026-1190 | Low | 3.1 | 2026-01-26 | A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it f… |
CVE-2026-0810 | High | 7.1 | 2026-01-26 | A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates… |
CVE-2026-24440 | High | 8.8 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allow account passwords to be changed through the maintenance interface without… |
CVE-2026-24439 | Medium | 6.5 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) fail to include the X-Content-Type-Options: nosniff response header on web manag… |
CVE-2026-24437 | Medium | 5.5 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) serve sensitive administrative content without appropriate cache-control directi… |
CVE-2026-24436 | Critical | 9.8 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication end… |
CVE-2026-24435 | Medium | 6.5 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) implement an insecure Cross-Origin Resource Sharing (CORS) policy on authenticat… |
CVE-2026-24433 | Medium | 5.4 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain a stored cross-site scripting vulnerability in the user creation functio… |
CVE-2026-24432 | Medium | 4.3 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) lack cross-site request forgery (CSRF) protections on administrative endpoints… |
CVE-2026-24431 | Medium | 6.5 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) display stored user account passwords in plaintext within the administrative web… |
CVE-2026-24430 | High | 7.5 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses genera… |
CVE-2026-24429 | Critical | 9.8 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in authentication account th… |
CVE-2026-24428 | High | 8.8 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privi… |
CVE-2026-21509 | High | 7.8 | 2026-01-26 | Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-1446 | Medium | 5.0 | 2026-01-26 | There is a Cross‑Site Scripting (XSS) issue in Esri ArcGIS Pro versions 3.6.0 and earlier. ArcGIS Pro is a desktop application, and exploitation is limited to… |
CVE-2026-1224 | Medium | 4.9 | 2026-01-26 | Tanium addressed an uncontrolled resource consumption vulnerability in Discover. |
CVE-2026-0925 | Low | 2.7 | 2026-01-26 | Tanium addressed an improper input validation vulnerability in Discover. |
CVE-2026-1284 | High | 7.8 | 2026-01-26 | An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOL… |
CVE-2026-1283 | High | 7.8 | 2026-01-26 | A Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Relea… |
CVE-2026-24656 | Low | 3.7 | 2026-01-26 | Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If… |
CVE-2026-1429 | Medium | 5.4 | 2026-01-26 | Single Sign-On Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing authenticated remote attackers to execute arb… |
CVE-2026-1428 | High | 8.8 | 2026-01-26 | Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS c… |
CVE-2026-1427 | High | 8.8 | 2026-01-26 | Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS c… |
CVE-2026-1425 | Medium | 5.6 | 2026-01-26 | A security flaw has been discovered in pymumu SmartDNS up to 47.1. This vulnerability affects the function _dns_decode_rr_head/_dns_decode_SVCB_HTTPS of the fi… |
CVE-2026-1424 | Medium | 4.7 | 2026-01-26 | A vulnerability was identified in PHPGurukul News Portal 1.0. This affects an unknown part of the component Profile Pic Handler. The manipulation leads to unre… |
CVE-2026-1423 | Medium | 6.3 | 2026-01-26 | A vulnerability was determined in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /admin_pic.php… |
CVE-2026-1422 | High | 7.3 | 2026-01-26 | A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of… |
CVE-2026-1421 | Low | 3.5 | 2026-01-26 | A vulnerability has been found in code-projects Online Examination System 1.0. Affected is an unknown function of the component Add Pages. Such manipulation le… |
CVE-2026-1420 | High | 8.8 | 2026-01-26 | A flaw has been found in Tenda AC23 16.03.07.52. This impacts an unknown function of the file /goform/WifiExtraSet. This manipulation of the argument wpapsk_cr… |
CVE-2026-1419 | Medium | 4.7 | 2026-01-26 | A weakness has been identified in D-Link DCS700l 1.03.09. Affected is an unknown function of the file /setDayNightMode of the component Web Form Handler. Execu… |
CVE-2026-1418 | Medium | 5.3 | 2026-01-26 | A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gf_text_import_srt_bifs of the file src/scene_manager/text_to_bifs.c… |
CVE-2026-1417 | Low | 3.3 | 2026-01-26 | A weakness has been identified in GPAC up to 2.4.0. Affected by this issue is the function dump_isom_rtp of the file applications/mp4box/filedump.c. This manip… |
CVE-2026-1416 | Low | 3.3 | 2026-01-26 | A security flaw has been discovered in GPAC up to 2.4.0. Affected by this vulnerability is the function DumpMovieInfo of the file applications/mp4box/filedump… |
CVE-2026-1415 | Low | 3.3 | 2026-01-26 | A vulnerability was identified in GPAC up to 2.4.0. Affected is the function gf_media_export_webvtt_metadata of the file src/media_tools/media_export.c. The ma… |
CVE-2026-1414 | Medium | 6.3 | 2026-01-26 | A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the fi… |
CVE-2026-1413 | Medium | 6.3 | 2026-01-26 | A vulnerability was found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function portValidate of the file /for… |
CVE-2026-1412 | High | 7.3 | 2026-01-26 | A vulnerability has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. The impacted element is an unknown function of the… |
CVE-2026-1411 | Medium | 6.1 | 2026-01-26 | A flaw has been found in Beetel 777VR1 up to 01.00.09/01.00.09_55. The affected element is an unknown function of the component UART Interface. This manipulati… |
CVE-2026-1410 | Medium | 6.4 | 2026-01-26 | A vulnerability was detected in Beetel 777VR1 up to 01.00.09/01.00.09_55. Impacted is an unknown function of the component UART Interface. The manipulation res… |
CVE-2026-1409 | Low | 2.0 | 2026-01-26 | A security vulnerability has been detected in Beetel 777VR1 up to 01.00.09/01.00.09_55. This issue affects some unknown processing of the component UART Interf… |
CVE-2026-1408 | Low | 2.0 | 2026-01-25 | A weakness has been identified in Beetel 777VR1 up to 01.00.09/01.00.09_55. This vulnerability affects unknown code of the component UART Interface. Executing… |
CVE-2026-1407 | Low | 2.0 | 2026-01-25 | A security flaw has been discovered in Beetel 777VR1 up to 01.00.09/01.00.09_55. This affects an unknown part of the component UART Interface. Performing a man… |
CVE-2026-23013 | High | 7.0 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback octep_vf_request_irqs() r… |
CVE-2026-23012 | High | 7.8 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: remove call_control in inactive contexts If damon_call() is executed again… |
CVE-2026-23011 | Medium | 5.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_gre: make ipgre_header() robust Analog to commit db5b4e39c4e6 ("ip6_gre: make ip… |
CVE-2026-23010 | High | 7.8 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del(). syzbot reported use-after-free of inet6_ifa… |
CVE-2026-23009 | Medium | 5.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: don't dereference freed ring when removing sideband endpoint xhci_sideban… |
CVE-2026-23008 | Medium | 5.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix KMS with 3D on HW version 10 HW version 10 does not have GB Surfaces so t… |
CVE-2026-23007 | Medium | 5.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: block: zero non-PI portion of auto integrity buffer The auto-generated integrity buffer f… |
CVE-2026-23006 | Medium | 5.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: ASoC: tlv320adcx140: fix null pointer The "snd_soc_component" in "adcx140_priv" was only… |
CVE-2026-23005 | Medium | 5.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 When loading guest XSA… |
CVE-2026-23004 | High | 7.8 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() syzbot was able to c… |
CVE-2026-23003 | High | 7.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take car… |
CVE-2026-23002 | Medium | 5.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: lib/buildid: use __kernel_read() for sleepable context Prevent a "BUG: unable to handle k… |
CVE-2026-23001 | High | 7.8 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvl… |
CVE-2026-23000 | Medium | 5.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix crash on profile change rollback failure mlx5e_netdev_change_profile can f… |
CVE-2026-22999 | High | 7.8 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class() Fixes qfq_change_cla… |
CVE-2026-22998 | High | 7.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b… |
CVE-2026-22997 | High | 7.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the… |
CVE-2026-22996 | Medium | 5.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv mlx5e_priv is an unstable str… |
CVE-2026-1406 | Low | 3.5 | 2026-01-25 | A vulnerability was determined in lcg0124 BootDo up to 5ccd963c74058036b466e038cff37de4056c1600. Affected by this vulnerability is the function redirectToLogin… |
CVE-2026-0593 | Medium | 5.3 | 2026-01-24 | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the proce… |
CVE-2026-0862 | Medium | 6.1 | 2026-01-24 | The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘options’ parameter in all versions up to, and… |
CVE-2026-0911 | High | 7.5 | 2026-01-24 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validatio… |
CVE-2026-1302 | Medium | 4.4 | 2026-01-24 | The Meta-box GalleryMeta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.1 due t… |
CVE-2026-1300 | Medium | 4.4 | 2026-01-24 | The Responsive Header plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple plugin settings parameters in all versions up to, and incl… |
CVE-2026-1266 | Medium | 4.4 | 2026-01-24 | The Postalicious plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.1 due to insuff… |
CVE-2026-1208 | Medium | 4.3 | 2026-01-24 | The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to… |
CVE-2026-1191 | Medium | 4.4 | 2026-01-24 | The JavaScript Notifier plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 1.2.8. This… |
CVE-2026-1189 | Medium | 6.4 | 2026-01-24 | The LeadBI Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter of the 'leadbi_form' shortcode in… |
CVE-2026-1127 | Medium | 6.1 | 2026-01-24 | The Timeline Event History plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `id` parameter in all versions up to, and including, 3… |
CVE-2026-1098 | Medium | 6.4 | 2026-01-24 | The CM CSS Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' shortcode attribute in all versions up to, and including, 1… |
CVE-2026-0800 | High | 7.2 | 2026-01-24 | The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom fie… |
CVE-2026-0687 | Medium | 4.3 | 2026-01-24 | The Meta-box GalleryMeta plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mb_gallery' custom p… |
CVE-2026-0633 | Low | 3.7 | 2026-01-24 | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions… |
CVE-2026-1257 | High | 7.5 | 2026-01-24 | The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.3.4 via the 'slug' attribute o… |
CVE-2026-1103 | Medium | 5.4 | 2026-01-24 | The AIKTP plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the /aiktp/getToken REST API endpoint… |
CVE-2026-1099 | Medium | 6.4 | 2026-01-24 | The Administrative Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'login' and 'logout' shortcode attributes in all versio… |
CVE-2026-1097 | Medium | 6.4 | 2026-01-24 | The ThemeRuby Multi Authors – Assign Multiple Writers to Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before' and 'after' s… |
CVE-2026-1095 | Medium | 6.4 | 2026-01-24 | The Canto Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fx' shortcode attribute in all versions up to, and including… |
CVE-2026-1088 | Medium | 4.3 | 2026-01-24 | The Login Page Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing nonce… |
CVE-2026-1084 | Medium | 4.4 | 2026-01-24 | The Cookie consent for developers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple settings fields in all versions up to, and inc… |
CVE-2026-1081 | Medium | 4.3 | 2026-01-24 | The Set Bulk Post Categories plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing… |
CVE-2026-1076 | Medium | 4.3 | 2026-01-24 | The Star Review Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This is due to missing no… |
CVE-2026-1075 | Medium | 4.3 | 2026-01-24 | The ZT Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to improper nonce vali… |
CVE-2026-1070 | Medium | 4.3 | 2026-01-24 | The Alex User Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0. This is due to missing nonce… |
CVE-2026-0807 | High | 7.2 | 2026-01-24 | The Frontis Blocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.6. This is due to insufficient r… |
CVE-2026-0806 | Medium | 4.9 | 2026-01-24 | The WP-ClanWars plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.0.1 due to insufficient… |
CVE-2026-24469 | High | 7.5 | 2026-01-24 | C++ HTTP Server is an HTTP/1.1 server built to handle client connections and serve HTTP requests. Versions 1.0 and below are vulnerable to Path Traversal via t… |
CVE-2026-24422 | Medium | 5.3 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly expose sensitive user information due to… |
CVE-2026-24420 | Medium | 6.5 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attac… |
CVE-2026-24421 | Medium | 6.5 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any a… |
CVE-2026-24412 | High | 8.8 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have aHeap Buffe… |