2026 CVEs (page 716)
Page 716 of 725 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-21986 | High | 7.1 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easi… |
CVE-2026-21985 | Medium | 6.0 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easi… |
CVE-2026-21984 | High | 7.5 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Diff… |
CVE-2026-21983 | High | 7.5 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Diff… |
CVE-2026-21982 | High | 7.5 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Diff… |
CVE-2026-21981 | Medium | 4.6 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easi… |
CVE-2026-21980 | Medium | 6.5 | 2026-01-20 | Vulnerability in the Oracle Life Sciences Central Coding product of Oracle Health Sciences Applications (component: Platform). The supported version that is… |
CVE-2026-21979 | Medium | 4.2 | 2026-01-20 | Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion (component: EPM Agent). The supported version that is affected is… |
CVE-2026-21978 | Medium | 6.5 | 2026-01-20 | Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Relationship Pricing). Supported versions… |
CVE-2026-21977 | Low | 3.1 | 2026-01-20 | Vulnerability in the Oracle Zero Data Loss Recovery Appliance Software product of Oracle Zero Data Loss Recovery Appliance (component: Security). Supported ve… |
CVE-2026-21976 | High | 7.1 | 2026-01-20 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Oracle Analytics Cloud). Supported versions that… |
CVE-2026-21975 | Medium | 4.5 | 2026-01-20 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.29 and 21.3-21.20. Easily exploitable vuln… |
CVE-2026-21974 | Medium | 5.3 | 2026-01-20 | Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform). The supported version that i… |
CVE-2026-21973 | High | 8.1 | 2026-01-20 | Vulnerability in the Oracle FLEXCUBE Investor Servicing product of Oracle Financial Services Applications (component: Security Management System). Supported v… |
CVE-2026-21972 | Medium | 5.3 | 2026-01-20 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-21971 | Medium | 5.4 | 2026-01-20 | Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2… |
CVE-2026-21970 | Medium | 6.5 | 2026-01-20 | Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform). The supported version that i… |
CVE-2026-21969 | Critical | 9.8 | 2026-01-20 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Supplier Portal). The supported version… |
CVE-2026-21968 | Medium | 6.5 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 a… |
CVE-2026-21967 | High | 8.6 | 2026-01-20 | Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected ar… |
CVE-2026-21966 | Medium | 6.1 | 2026-01-20 | Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). Supported versions that are a… |
CVE-2026-21965 | Low | 2.7 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 9.0.0-9.5.0. Easily ex… |
CVE-2026-21964 | Medium | 4.9 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8… |
CVE-2026-21963 | Medium | 6.0 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easi… |
CVE-2026-21962 | Critical | 10.0 | 2026-01-20 | Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for… |
CVE-2026-21961 | Medium | 6.1 | 2026-01-20 | Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Company Dir / Org Chart Viewer, Employee Snapshot). T… |
CVE-2026-21960 | Medium | 6.5 | 2026-01-20 | Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-21959 | Medium | 4.9 | 2026-01-20 | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Loader). Supported versions that are affected are 12.2.3-12.2.15… |
CVE-2026-21957 | High | 7.5 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Diff… |
CVE-2026-21956 | High | 8.2 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easi… |
CVE-2026-21955 | High | 8.2 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easi… |
CVE-2026-21952 | Medium | 4.9 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitabl… |
CVE-2026-21951 | Medium | 6.1 | 2026-01-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that are affected are… |
CVE-2026-21950 | Medium | 6.5 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. Easily exploit… |
CVE-2026-21949 | Medium | 6.5 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. Easily exploit… |
CVE-2026-21948 | Medium | 4.9 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 a… |
CVE-2026-21947 | Low | 3.1 | 2026-01-20 | Vulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability al… |
CVE-2026-21946 | Medium | 6.1 | 2026-01-20 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0… |
CVE-2026-21945 | High | 7.5 | 2026-01-20 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2026-21944 | Medium | 6.5 | 2026-01-20 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The suppor… |
CVE-2026-21943 | Medium | 6.1 | 2026-01-20 | Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Scripting Admin). Supported versions that are affected are 12.2.3-12.2.15… |
CVE-2026-21942 | Medium | 5.0 | 2026-01-20 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). Supported versions that are affected are 10 and 11. Easily exploitabl… |
CVE-2026-21941 | Medium | 4.9 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 a… |
CVE-2026-21940 | High | 7.5 | 2026-01-20 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group). The supported version that is affected is 9.3.6. Easil… |
CVE-2026-21939 | High | 7.0 | 2026-01-20 | Vulnerability in the SQLcl component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.0. Difficult to exploit vulnerability al… |
CVE-2026-21938 | Medium | 6.1 | 2026-01-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.60, 8.61 a… |
CVE-2026-21937 | Medium | 4.9 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9… |
CVE-2026-21936 | Medium | 4.9 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9… |
CVE-2026-21935 | Medium | 5.8 | 2026-01-20 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Driver). The supported version that is affected is 11. Easily exploitable vulnerabi… |
CVE-2026-21934 | Medium | 5.4 | 2026-01-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications). Supported versions that are affected are… |
CVE-2026-21933 | Medium | 6.1 | 2026-01-20 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported ve… |
CVE-2026-21932 | High | 7.4 | 2026-01-20 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported v… |
CVE-2026-21931 | Medium | 5.4 | 2026-01-20 | Vulnerability in the Oracle APEX Sample Applications product of Oracle APEX (component: Brookstrut Sample App). Supported versions that are affected are 23.2… |
CVE-2026-21930 | Low | 2.3 | 2026-01-20 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). The supported version that is affected is 8.8. Easi… |
CVE-2026-21929 | Medium | 5.3 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 9.0.0-9.5.0. Difficult to expl… |
CVE-2026-21928 | Medium | 5.3 | 2026-01-20 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerabi… |
CVE-2026-21927 | Medium | 5.8 | 2026-01-20 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Driver). The supported version that is affected is 11. Easily exploitable vulnerabi… |
CVE-2026-21926 | High | 7.5 | 2026-01-20 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-25.2… |
CVE-2026-21925 | Medium | 4.8 | 2026-01-20 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions… |
CVE-2026-21924 | Medium | 5.4 | 2026-01-20 | Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: General). Supported versions that are affecte… |
CVE-2026-21923 | Medium | 6.5 | 2026-01-20 | Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform). The supported version that i… |
CVE-2026-21922 | Medium | 4.2 | 2026-01-20 | Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion (component: EPM Agent). The supported version that is affected is… |
CVE-2026-0865 | | 2026-01-20 | User-controlled header names and values containing newlines can allow injecting HTTP headers. | |
CVE-2026-0672 | | 2026-01-20 | When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characte… | |
CVE-2026-21664 | Medium | 6.1 | 2026-01-20 | HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Revive Adserver. An at… |
CVE-2026-21663 | Medium | 6.1 | 2026-01-20 | HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An attacker can craft… |
CVE-2026-21642 | Medium | 6.1 | 2026-01-20 | HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserv… |
CVE-2026-21641 | Medium | 6.5 | 2026-01-20 | HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. User… |
CVE-2026-21640 | Low | 2.7 | 2026-01-20 | HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinatio… |
CVE-2026-21637 | High | 7.5 | 2026-01-20 | A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Syn… |
CVE-2026-21636 | Critical | 10.0 | 2026-01-20 | A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `-… |
CVE-2026-0622 | Medium | 6.5 | 2026-01-20 | Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset |
CVE-2026-1245 | Medium | 6.5 | 2026-01-20 | A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in… |
CVE-2026-0726 | High | 8.1 | 2026-01-20 | The Nexter Extension – Site Enhancements Toolkit plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.6 via des… |
CVE-2026-0690 | Medium | 6.4 | 2026-01-20 | The FlatPM – Ad Manager, AdSense and Custom Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rank_math_description' custom field… |
CVE-2026-0608 | Medium | 6.4 | 2026-01-20 | The Head Meta Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head-meta-data' post meta field in all versions up to, and includ… |
CVE-2026-0554 | Medium | 4.3 | 2026-01-20 | The NotificationX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'regenerate' and 'reset' RES… |
CVE-2026-0548 | Medium | 5.4 | 2026-01-20 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check o… |
CVE-2026-22844 | Critical | 9.9 | 2026-01-20 | A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execu… |
CVE-2026-1183 | | 2026-01-20 | HTML injection vulnerability in multiple Botble products such as TransP, Athena, Martfury, and Homzen, consisting of an HTML injection due to a lack of proper… | |
CVE-2026-1180 | Medium | 5.8 | 2026-01-20 | A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using private_key_jwt. The issue allows a clie… |
CVE-2026-0895 | | 2026-01-20 | The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/… | |
CVE-2026-1223 | Medium | 4.9 | 2026-01-20 | PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers t… |
CVE-2026-1222 | High | 7.2 | 2026-01-20 | PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and ex… |
CVE-2026-1221 | Critical | 9.8 | 2026-01-20 | PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to… |
CVE-2026-1218 | Medium | 6.3 | 2026-01-20 | A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0. Impacted is the function initRCForm of the file RichClientService.class of the component com.arte… |
CVE-2026-1045 | Medium | 4.4 | 2026-01-20 | The Viet contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.2 due to insuff… |
CVE-2026-1042 | Medium | 4.4 | 2026-01-20 | The WP Hello Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'digit_one' and 'digit_two' parameters in all versions up to, and in… |
CVE-2026-0908 | High | 8.8 | 2026-01-20 | Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2026-0907 | Critical | 9.8 | 2026-01-20 | Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium… |
CVE-2026-0906 | Critical | 9.8 | 2026-01-20 | Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafte… |
CVE-2026-0905 | Critical | 9.8 | 2026-01-20 | Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to potentially obtain pote… |
CVE-2026-0904 | Medium | 5.4 | 2026-01-20 | Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing via a crafted HTML pa… |
CVE-2026-0903 | Medium | 5.4 | 2026-01-20 | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous file type protection… |
CVE-2026-0902 | High | 8.8 | 2026-01-20 | Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML… |
CVE-2026-0901 | Medium | 5.4 | 2026-01-20 | Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML pa… |
CVE-2026-0900 | High | 8.8 | 2026-01-20 | Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTM… |
CVE-2026-0899 | High | 8.8 | 2026-01-20 | Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML… |
CVE-2026-1051 | Medium | 4.3 | 2026-01-20 | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.1… |
CVE-2026-23950 | High | 8.8 | 2026-01-20 | node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path col… |