2026 CVEs (page 717)
Page 717 of 725 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-23949 | High | 8.6 | 2026-01-20 | jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `… |
CVE-2026-23947 | Critical | 9.8 | 2026-01-20 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to… |
CVE-2026-23876 | High | 8.1 | 2026-01-20 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow… |
CVE-2026-23874 | Medium | 5.5 | 2026-01-20 | ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-13 have a stack overflow via infinite re… |
CVE-2026-22770 | Medium | 6.5 | 2026-01-20 | ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buff… |
CVE-2026-1203 | Medium | 5.6 | 2026-01-20 | A weakness has been identified in CRMEB up to 5.6.3. The impacted element is the function remoteRegister of the file crmeb/app/services/user/LoginServices.php… |
CVE-2026-1202 | High | 7.3 | 2026-01-20 | A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginControll… |
CVE-2026-1197 | Low | 3.1 | 2026-01-20 | A vulnerability was detected in MineAdmin 1.x/2.x. Affected by this vulnerability is an unknown functionality of the file /system/downloadById. Performing a ma… |
CVE-2026-1196 | Low | 3.1 | 2026-01-20 | A security vulnerability has been detected in MineAdmin 1.x/2.x. Affected is an unknown function of the file /system/getFileInfoById. Such manipulation of the… |
CVE-2026-1195 | Medium | 5.0 | 2026-01-20 | A weakness has been identified in MineAdmin 1.x/2.x. This impacts the function refresh of the file /system/refresh of the component JWT Token Handler. This man… |
CVE-2026-22219 | High | 7.7 | 2026-01-20 | Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlc… |
CVE-2026-22218 | Medium | 6.5 | 2026-01-20 | Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom El… |
CVE-2026-1194 | Medium | 5.3 | 2026-01-20 | A security flaw has been discovered in MineAdmin 1.x/2.x. This affects an unknown function of the component Swagger. The manipulation results in information di… |
CVE-2026-1193 | Medium | 6.3 | 2026-01-19 | A vulnerability was identified in MineAdmin 1.x/2.x. The impacted element is an unknown function of the file /system/cache/view of the component View Interface… |
CVE-2026-1192 | High | 7.3 | 2026-01-19 | A vulnerability was determined in Tosei Online Store Management System ネット店舗管理システム 1.01. The affected element is an unknown function of the file /cgi-bin/imode… |
CVE-2026-1179 | High | 7.3 | 2026-01-19 | A vulnerability was detected in Yonyou KSOA 9.0. This affects an unknown part of the file /kmf/user_popedom.jsp of the component HTTP GET Parameter Handler. Th… |
CVE-2026-23944 | Critical | 9.8 | 2026-01-19 | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests could be proxied to rem… |
CVE-2026-23885 | Medium | 6.4 | 2026-01-19 | Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()`… |
CVE-2026-1178 | High | 7.3 | 2026-01-19 | A security vulnerability has been detected in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /kmf/select.jsp of the componen… |
CVE-2026-1177 | High | 7.3 | 2026-01-19 | A weakness has been identified in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /kmf/save_folder.jsp of the component… |
CVE-2026-23886 | Medium | 5.3 | 2026-01-19 | Swift W3C TraceContext is a Swift implementation of the W3C Trace Context standard, and Swift OTel is an OpenTelemetry Protocol (OTLP) backend for Swift Log, S… |
CVE-2026-23880 | High | 7.3 | 2026-01-19 | OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software pri… |
CVE-2026-23877 | Medium | 4.3 | 2026-01-19 | Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()` function in the `/folder/dir-browser` e… |
CVE-2026-23875 | Medium | 5.4 | 2026-01-19 | CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots. Prior to version 0.0.8, a non-existing perm… |
CVE-2026-23849 | Medium | 5.3 | 2026-01-19 | File Browser provides a file managing interface within a specified directory and can be used to upload, delete, preview, rename, and edit files. Prior to versi… |
CVE-2026-23848 | Medium | 6.5 | 2026-01-19 | MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.7.71, a rate limiting bypass via `X-Forwarded-For` header spoofing… |
CVE-2026-23844 | Medium | 4.3 | 2026-01-19 | Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulnerability. A user can update/create accou… |
CVE-2026-23837 | Critical | 9.8 | 2026-01-19 | MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows una… |
CVE-2026-1176 | High | 7.3 | 2026-01-19 | A security flaw has been discovered in itsourcecode School Management System 1.0. Affected is an unknown function of the file /subject/index.php. Performing a… |
CVE-2026-1175 | Medium | 5.3 | 2026-01-19 | A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql of the component GraphQL Directive Han… |
CVE-2026-23852 | Critical | 9.6 | 2026-01-19 | SiYuan is a personal knowledge management system. Versions prior to 3.5.4 have a stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to inj… |
CVE-2026-23851 | Medium | 6.5 | 2026-01-19 | SiYuan is a personal knowledge management system. Versions prior to 3.5.4 contain a logic vulnerability in the /api/file/globalCopyFiles endpoint. The function… |
CVE-2026-23850 | High | 7.5 | 2026-01-19 | SiYuan is a personal knowledge management system. In versions prior to 3.5.4, the markdown feature allows unrestricted server side html-rendering which allows… |
CVE-2026-23847 | Medium | 6.1 | 2026-01-19 | SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to u… |
CVE-2026-23846 | High | 8.1 | 2026-01-19 | Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwo… |
CVE-2026-21696 | Medium | 6.5 | 2026-01-19 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Win… |
CVE-2026-1174 | Medium | 5.3 | 2026-01-19 | A vulnerability was determined in birkir prime up to 0.4.0.beta.0. This affects an unknown function of the file /graphql of the component GraphQL Alias Handler… |
CVE-2026-1173 | Medium | 5.3 | 2026-01-19 | A vulnerability was found in birkir prime up to 0.4.0.beta.0. The impacted element is an unknown function of the file /graphql of the component GraphQL Array B… |
CVE-2026-23878 | Medium | 6.5 | 2026-01-19 | HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ceacd5f1476458792c44c6a993670f02c984b4a0… |
CVE-2026-23845 | Medium | 5.8 | 2026-01-19 | Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Downl… |
CVE-2026-23843 | High | 7.1 | 2026-01-19 | teklifolustur_app is a web-based PHP application that allows users to create, manage, and track quotes for their clients. Prior to commit dd082a134a225b8dcd401… |
CVE-2026-23842 | High | 7.5 | 2026-01-19 | ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service c… |
CVE-2026-23841 | Critical | 9.3 | 2026-01-19 | Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripti… |
CVE-2026-23840 | Critical | 9.3 | 2026-01-19 | Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripti… |
CVE-2026-23839 | Critical | 9.3 | 2026-01-19 | Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripti… |
CVE-2026-23838 | | 2026-01-19 | Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the de… | |
CVE-2026-1172 | Medium | 5.3 | 2026-01-19 | A vulnerability has been found in birkir prime up to 0.4.0.beta.0. The affected element is an unknown function of the file /graphql of the component GraphQL Di… |
CVE-2026-1171 | Medium | 5.3 | 2026-01-19 | A flaw has been found in birkir prime up to 0.4.0.beta.0. Impacted is an unknown function of the file /graphql of the component GraphQL Field Handler. Executin… |
CVE-2026-23884 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed mem… |
CVE-2026-23883 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free`… |
CVE-2026-23836 | Critical | 9.9 | 2026-01-19 | HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which… |
CVE-2026-23833 | High | 7.5 | 2026-01-19 | ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the AP… |
CVE-2026-23732 | High | 7.5 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validate… |
CVE-2026-23721 | Medium | 4.3 | 2026-01-19 | OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visibl… |
CVE-2026-23646 | Medium | 6.5 | 2026-01-19 | OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end… |
CVE-2026-23625 | High | 8.7 | 2026-01-19 | OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerabilit… |
CVE-2026-23534 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands dec… |
CVE-2026-23533 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec de… |
CVE-2026-22797 | Critical | 9.9 | 2026-01-19 | An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. T… |
CVE-2026-1170 | Medium | 5.3 | 2026-01-19 | A vulnerability was detected in birkir prime up to 0.4.0.beta.0. This issue affects some unknown processing of the file /graphql of the component GraphQL API… |
CVE-2026-1169 | Medium | 4.3 | 2026-01-19 | A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code. Such manipulation leads to cross-site r… |
CVE-2026-23532 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `g… |
CVE-2026-23531 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls… |
CVE-2026-23530 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrc… |
CVE-2026-23522 | Low | 3.7 | 2026-01-19 | LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, `knowledgeBase.removeFilesFromKnowledgeBase` tRPC ep allows authenticate… |
CVE-2026-22850 | High | 8.3 | 2026-01-19 | Koko Analytics is an open-source analytics plugin for WordPress. Versions prior to 2.1.3 are vulnerable to arbitrary SQL execution through unescaped analytics… |
CVE-2026-22037 | High | 8.4 | 2026-01-19 | The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middle… |
CVE-2026-1162 | Critical | 9.8 | 2026-01-19 | A flaw has been found in UTT HiPER 810 1.7.4-141218. The impacted element is the function strcpy of the file /goform/setSysAdm. This manipulation of the argume… |
CVE-2026-22031 | High | 8.4 | 2026-01-19 | @fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 wh… |
CVE-2026-1161 | Low | 3.5 | 2026-01-19 | A vulnerability was detected in pbrong hrms 1.0.1. The affected element is the function UpdateRecruitmentById of the file /handler/recruitment.go. The manipula… |
CVE-2026-1160 | High | 7.3 | 2026-01-19 | A security vulnerability has been detected in PHPGurukul Directory Management System 1.0. Impacted is an unknown function of the file /index.php of the compone… |
CVE-2026-21618 | Medium | 6.1 | 2026-01-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthoriz… |
CVE-2026-1159 | High | 7.3 | 2026-01-19 | A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This issue affects some unknown processing of the file /order_online.ph… |
CVE-2026-1158 | High | 8.8 | 2026-01-19 | A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWizardCfg of the file /cgi-bin/cstecgi… |
CVE-2026-1007 | High | 7.6 | 2026-01-19 | Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: fr… |
CVE-2026-0610 | Critical | 9.8 | 2026-01-19 | SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12 |
CVE-2026-1157 | High | 8.8 | 2026-01-19 | A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This affects the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi. Such manipul… |
CVE-2026-1156 | High | 8.8 | 2026-01-19 | A vulnerability was determined in Totolink LR350 9.3.5u.6369_B20220309. Affected by this issue is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-1181 | Critical | 9.0 | 2026-01-19 | Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin req… |
CVE-2026-1155 | High | 8.8 | 2026-01-19 | A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. Affected by this vulnerability is the function setWiFiEasyGuestCfg of the file /cgi-bin/cste… |
CVE-2026-1154 | Medium | 4.3 | 2026-01-19 | A flaw has been found in SourceCodester E-Learning System 1.0. This impacts an unknown function of the file /admin/modules/lesson/index.php of the component Le… |
CVE-2026-1153 | Medium | 4.3 | 2026-01-19 | A vulnerability was detected in technical-laohu mpay up to 1.2.4. This affects an unknown function. Performing a manipulation results in cross-site request for… |
CVE-2026-1152 | Medium | 4.7 | 2026-01-19 | A security vulnerability has been detected in technical-laohu mpay up to 1.2.4. The impacted element is an unknown function of the component QR Code Image Hand… |
CVE-2026-1151 | Low | 2.4 | 2026-01-19 | A weakness has been identified in technical-laohu mpay up to 1.2.4. The affected element is an unknown function of the component User Center. This manipulation… |
CVE-2026-1150 | Medium | 6.3 | 2026-01-19 | A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. Impacted is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-1149 | Medium | 6.3 | 2026-01-19 | A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-1148 | Medium | 4.3 | 2026-01-19 | A vulnerability was determined in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This vulnerability affects unknown code. Exec… |
CVE-2026-1147 | Low | 3.5 | 2026-01-19 | A vulnerability was found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This affects an unknown part of the file /php/api_… |
CVE-2026-1146 | Low | 3.5 | 2026-01-19 | A vulnerability has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this issue is some unknown functi… |
CVE-2026-1145 | Medium | 6.3 | 2026-01-19 | A flaw has been found in quickjs-ng quickjs up to 0.11.0. Affected by this vulnerability is the function js_typed_array_constructor_ta of the file quickjs.c. T… |
CVE-2026-1144 | Medium | 6.3 | 2026-01-19 | A vulnerability was detected in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component Atomics Ops Handler. Th… |
CVE-2026-1143 | High | 8.8 | 2026-01-19 | A weakness has been identified in TOTOLINK A3700R 9.1.2u.5822_B20200513. This affects the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. Execut… |
CVE-2026-1142 | Medium | 4.3 | 2026-01-19 | A security flaw has been discovered in PHPGurukul News Portal 1.0. The impacted element is an unknown function. Performing a manipulation results in cross-site… |
CVE-2026-1141 | Medium | 6.3 | 2026-01-19 | A vulnerability was identified in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /admin/add-subadmins.php of the component… |
CVE-2026-1140 | High | 8.8 | 2026-01-19 | A vulnerability was found in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/ConfigExceptAli. The manipulation results in… |
CVE-2026-1139 | High | 8.8 | 2026-01-19 | A vulnerability has been found in UTT 进取 520W 1.7.7-180627. This vulnerability affects the function strcpy of the file /goform/ConfigExceptMSN. The manipulatio… |
CVE-2026-1138 | High | 8.8 | 2026-01-19 | A flaw has been found in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/ConfigExceptQQ. Executing a manipulation can lead to bu… |
CVE-2026-1137 | High | 8.8 | 2026-01-19 | A vulnerability was detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formWebAuthGlobalConfig. Performing… |
CVE-2026-1136 | Low | 3.5 | 2026-01-19 | A weakness has been identified in lcg0124 BootDo up to e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb. Affected is the function Save of the file /blog/bContent/save… |
CVE-2026-1135 | Medium | 4.3 | 2026-01-19 | A security flaw has been discovered in itsourcecode Society Management System 1.0. This impacts an unknown function of the file /admin/activity.php. The manipu… |