2026 CVEs (page 712)
Page 712 of 725 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-24411 | High | 7.1 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined B… |
CVE-2026-24410 | High | 7.1 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined B… |
CVE-2026-24409 | High | 7.1 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined B… |
CVE-2026-24401 | Medium | 6.5 | 2026-01-24 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be… |
CVE-2026-24407 | High | 7.1 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined B… |
CVE-2026-24406 | High | 8.8 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buff… |
CVE-2026-24405 | High | 8.8 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buff… |
CVE-2026-24404 | High | 7.1 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, CIccXmlArray… |
CVE-2026-24403 | High | 7.1 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, an integer o… |
CVE-2026-24399 | Critical | 9.3 | 2026-01-24 | ChatterMate is a no-code AI chatbot agent framework. In versions 1.0.8 and below, the chatbot accepts and executes malicious HTML/JavaScript payloads when supp… |
CVE-2026-22586 | Critical | 9.8 | 2026-01-24 | Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsu… |
CVE-2026-22585 | Critical | 9.8 | 2026-01-24 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subsc… |
CVE-2026-22583 | Critical | 9.8 | 2026-01-24 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module… |
CVE-2026-22582 | Critical | 9.8 | 2026-01-24 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module)… |
CVE-2026-24474 | | 2026-01-24 | Dioxus Components is a shadcn-style component library for the Dioxus app framework. Prior to commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a, `use_animated_ope… | |
CVE-2026-24140 | Low | 2.7 | 2026-01-24 | MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings manage… |
CVE-2026-24139 | Medium | 6.5 | 2026-01-24 | MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization bypass, allowing gue… |
CVE-2026-24136 | High | 7.5 | 2026-01-24 | Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Re… |
CVE-2026-24128 | Medium | 6.1 | 2026-01-24 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-milestone-2 through 16.10.11, 17.0.0-rc-1… |
CVE-2026-24127 | Medium | 5.4 | 2026-01-23 | Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error… |
CVE-2026-1386 | Medium | 6.0 | 2026-01-23 | A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with w… |
CVE-2026-24423 | Critical | 9.8 | 2026-01-23 | SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attack… |
CVE-2026-1299 | | 2026-01-23 | The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for he… | |
CVE-2026-22995 | High | 7.8 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: ublk: fix use-after-free in ublk_partition_scan_work A race condition exists between the… |
CVE-2026-22994 | Medium | 5.5 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_xdp() syzbot is reporting unregiste… |
CVE-2026-22993 | Medium | 5.5 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL ptr issue after soft reset During soft reset, the RSS LUT is freed… |
CVE-2026-22992 | High | 7.5 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: libceph: return the handler error from mon_handle_auth_done() Currently any error from ce… |
CVE-2026-22991 | High | 7.5 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: libceph: make free_choose_arg_map() resilient to partial allocation free_choose_arg_map()… |
CVE-2026-22990 | High | 7.5 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (malic… |
CVE-2026-22989 | Medium | 5.5 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: nfsd: check that server is running in unlock_filesystem If we are trying to unlock the fi… |
CVE-2026-22988 | High | 7.8 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not change skb->head arp_create() is the only d… |
CVE-2026-22987 | Medium | 5.5 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy syzbot reported a… |
CVE-2026-22986 | Medium | 4.7 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix race condition for gdev->srcu If two drivers were calling gpiochip_add_data_… |
CVE-2026-22985 | Medium | 5.5 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations The RSS LUT is not initi… |
CVE-2026-22984 | Critical | 9.8 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit… |
CVE-2026-22983 | Medium | 5.5 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: net: do not write to msg_get_inq in callee NULL pointer dereference fix. msg_get_inq is… |
CVE-2026-22982 | Medium | 5.5 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: Fix crash when adding interface under a lag Commit 15faa1f67ab4 ("lan9… |
CVE-2026-22981 | Medium | 5.5 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: idpf: detach and close netdevs while handling a reset Protect the reset path from callbac… |
CVE-2026-22980 | High | 7.8 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_end_grace Writing to v4_end_grace can race with server shutd… |
CVE-2026-22979 | Medium | 5.5 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in skb_segment_list for GRO packets When skb_segment_list() is calle… |
CVE-2026-22978 | Low | 3.3 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: wifi: avoid kernel-infoleak from struct iw_point struct iw_point has a 32bit hole on 64bi… |
CVE-2026-24636 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-24635 | High | 7.5 | 2026-01-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DevsBlink EduBlink Core edublink-core… |
CVE-2026-24634 | Medium | 5.3 | 2026-01-23 | Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Exploiting Incorrectly Configured Access… |
CVE-2026-24633 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Passionate Brains Add Expires Headers & Optimized Minify add-expires-headers allows Exploiting Incorrectly Configured Ac… |
CVE-2026-24632 | Medium | 5.9 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jagdish1o1 Delay Redirects delay-redirects allows DOM-Bas… |
CVE-2026-24631 | Medium | 5.4 | 2026-01-23 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Rosebud rosebud allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-24630 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator al… |
CVE-2026-24629 | Medium | 5.9 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ability, Inc Web Accessibility with Max Access accessibil… |
CVE-2026-24627 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Trusona Trusona for WordPress trusona allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-24626 | Medium | 5.9 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LogicHunt Logo Slider logo-slider-wp allows Stored XSS.Th… |
CVE-2026-24625 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Imaginate Solutions File Uploads Addon for WooCommerce woo-addon-uploads allows Exploiting Incorrectly Configured Access… |
CVE-2026-24624 | High | 7.6 | 2026-01-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in saeros1984 Neoforum neoforum allows Blind SQL Injection.T… |
CVE-2026-24623 | High | 7.1 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in saeros1984 Neoforum neoforum allows Reflected XSS.This is… |
CVE-2026-24622 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in Sergiy Dzysyak Suggestion Toolkit suggestion-toolkit allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-24621 | Medium | 5.9 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Statsenko Terms descriptions terms-descriptions… |
CVE-2026-24620 | Medium | 5.9 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps Landing Page Builder page-builder-add allows St… |
CVE-2026-24619 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in PopCash PopCash.Net Code Integration Tool popcashnet-code-integration-tool allows Exploiting Incorrectly Configured Acce… |
CVE-2026-24617 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Iser Easy Modal easy-modal allows Stored XSS.This… |
CVE-2026-24616 | Medium | 6.5 | 2026-01-23 | Missing Authorization vulnerability in Damian WP Popups wp-popups-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2026-24615 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in themebeez Cream Magazine cream-magazine allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-24614 | Medium | 5.9 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Devsbrain Flex QR Code Generator flex-qr-code-generator a… |
CVE-2026-24613 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Config… |
CVE-2026-24612 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in themebeez Orchid Store orchid-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-24609 | High | 7.5 | 2026-01-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent laurent allows P… |
CVE-2026-24608 | High | 7.5 | 2026-01-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent Core laurent-cor… |
CVE-2026-24607 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in wptravelengine Travel Monster travel-monster allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-24606 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-24605 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-24604 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in themebeez Simple GDPR Cookie Compliance simple-gdpr-cookie-compliance allows Exploiting Incorrectly Configured Access Co… |
CVE-2026-24603 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in themebeez Universal Google Adsense and Ads manager universal-google-adsense-and-ads-manager allows Exploiting Incorrectl… |
CVE-2026-24601 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Pay Writer penci-pay-writer allows Stor… |
CVE-2026-24600 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Review penci-review allows Stored XSS.T… |
CVE-2026-24599 | Medium | 5.3 | 2026-01-23 | Authorization Bypass Through User-Controlled Key vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Config… |
CVE-2026-24598 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in bestwebsoft Multilanguage by BestWebSoft multilanguage allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-24596 | Medium | 4.3 | 2026-01-23 | Cross-Site Request Forgery (CSRF) vulnerability in marynixie Related Posts Thumbnails Plugin for WordPress related-posts-thumbnails allows Cross Site Request F… |
CVE-2026-24595 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-24594 | Medium | 5.9 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for WPBakery Page Builder addons… |
CVE-2026-24593 | Medium | 5.3 | 2026-01-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugi… |
CVE-2026-24591 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yasir129 Turn Yoast SEO FAQ Block to Accordion faq-schema… |
CVE-2026-24589 | Medium | 5.3 | 2026-01-23 | Insertion of Sensitive Information Into Sent Data vulnerability in Cargus eCommerce Cargus cargus allows Retrieve Embedded Sensitive Data.This issue affects Ca… |
CVE-2026-24588 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in topdevs Smart Product Viewer smart-product-viewer allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2026-24587 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in kutsy AJAX Hits Counter + Popular Posts Widget ajax-hits-counter allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-24585 | Medium | 6.5 | 2026-01-23 | Missing Authorization vulnerability in Hyyan Abo Fakher Hyyan WooCommerce Polylang Integration woo-poly-integration allows Exploiting Incorrectly Configured Ac… |
CVE-2026-24584 | Medium | 5.9 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS BunnyNet Integration tutor-lms-bunnynet… |
CVE-2026-24583 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in sumup SumUp Payment Gateway For WooCommerce sumup-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configur… |
CVE-2026-24581 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce points-and-rewards-for-woocommerce allows Exploiting Incorrectly Configured… |
CVE-2026-24580 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Config… |
CVE-2026-24579 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configure… |
CVE-2026-24578 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Jahid Hasan Admin login URL Change admin-login-url-change allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-24577 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Genetech Products Pie Register pie-register allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-24576 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in COP UX Flat ux-flat allows Stored XSS.This issue affects… |
CVE-2026-24572 | High | 8.5 | 2026-01-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio Content nelio-content allows Blind S… |
CVE-2026-24571 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in boxnow BOX NOW Delivery box-now-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-24570 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-24569 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Sully Media Library File Size media-library-file-size allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-24568 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-24567 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in briarinc Anything Order by Terms anything-order-by-terms allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-24566 | Medium | 6.5 | 2026-01-23 | Missing Authorization vulnerability in iNET iNET Webkit inet-webkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-24565 | Medium | 6.5 | 2026-01-23 | Insertion of Sensitive Information Into Sent Data vulnerability in bPlugins B Accordion b-accordion allows Retrieve Embedded Sensitive Data.This issue affects… |