2026 CVEs (page 72)
Page 72 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20222 | High | 7.4 | 2026-09-16 | A vulnerability in the EIGRP implementation in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD)… |
CVE-2026-20154 | High | 8.6 | 2026-09-16 | A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Sec… |
CVE-2026-20135 | High | 8.6 | 2026-09-16 | A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a… |
CVE-2026-20121 | Medium | 5.3 | 2026-09-16 | A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software a… |
CVE-2026-20120 | Medium | 5.8 | 2026-09-16 | A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software a… |
CVE-2026-20072 | Medium | 4.9 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from network u… |
CVE-2026-20071 | Low | 3.8 | 2026-09-16 | A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboa… |
CVE-2026-92808 | | 2026-09-16 | A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated network attacker can caus… | |
CVE-2026-92526 | Medium | 6.3 | 2026-09-16 | A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/leave/index.php. Executing a manipulati… |
CVE-2026-92475 | Medium | 5.3 | 2026-09-16 | A weakness has been identified in GPAC 26.08-DEV. This impacts the function wait_for_header_and_parse of the file src/utils/downloader.c. This manipulation of… |
CVE-2026-92474 | Low | 3.3 | 2026-09-16 | A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gf_inline_get_proto_lib of the file src/compositor/mpeg4_inline.c of the compo… |
CVE-2026-89084 | | 2026-09-16 | HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary fil… | |
CVE-2026-89083 | | 2026-09-16 | HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary fil… | |
CVE-2026-89082 | | 2026-09-16 | HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary fil… | |
CVE-2026-88592 | Critical | 9.1 | 2026-09-16 | kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter agai… |
CVE-2026-87976 | High | 8.1 | 2026-09-16 | Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates… |
CVE-2026-87116 | Medium | 6.5 | 2026-09-16 | Tanium addressed a server-side request forgery vulnerability in Threat Response. |
CVE-2026-87113 | Medium | 6.3 | 2026-09-16 | Tanium addressed an improper access controls vulnerability in Threat Response. |
CVE-2026-87105 | High | 8.8 | 2026-09-16 | Tanium addressed a SQL injection vulnerability in Threat Response. |
CVE-2026-87076 | Medium | 6.5 | 2026-09-16 | Tanium addressed an information disclosure vulnerability in Discover. |
CVE-2026-87026 | Low | 3.8 | 2026-09-16 | Tanium addressed an improper access controls vulnerability in Threat Response. |
CVE-2026-87024 | High | 7.2 | 2026-09-16 | Tanium addressed a SQL injection vulnerability in Asset. |
CVE-2026-86865 | High | 7.2 | 2026-09-16 | Tanium addressed a SQL injection vulnerability in Asset. |
CVE-2026-86831 | High | 8.7 | 2026-09-16 | Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remo… |
CVE-2026-86089 | High | 7.1 | 2026-09-16 | Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration s… |
CVE-2026-82561 | Medium | 6.5 | 2026-09-16 | Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering… |
CVE-2026-81870 | | 2026-09-16 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal I… | |
CVE-2026-81866 | Medium | 4.3 | 2026-09-16 | Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets… |
CVE-2026-76646 | High | 7.5 | 2026-09-16 | A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service co… |
CVE-2026-76423 | Critical | 10.0 | 2026-09-16 | A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected dev… |
CVE-2026-70469 | High | 7.5 | 2026-09-16 | Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encodi… |
CVE-2026-62949 | Medium | 6.5 | 2026-09-16 | AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prio… |
CVE-2026-20361 | High | 8.8 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive inter… |
CVE-2026-20341 | Critical | 9.1 | 2026-09-16 | A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software could allow an authenticated, remote attacker to obtain r… |
CVE-2026-20330 | Critical | 9.9 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall T… |
CVE-2026-20329 | Critical | 9.9 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall T… |
CVE-2026-20326 | Critical | 9.8 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive inter… |
CVE-2026-20325 | Critical | 9.9 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive… |
CVE-2026-20324 | Critical | 9.9 | 2026-09-16 | A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, rem… |
CVE-2026-20322 | Critical | 9.9 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive… |
CVE-2026-20242 | Critical | 9.8 | 2026-09-16 | A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attack… |
CVE-2026-20237 | Critical | 9.1 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connec… |
CVE-2026-20211 | Critical | 9.1 | 2026-09-16 | A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected devi… |
CVE-2026-20194 | Critical | 9.1 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connec… |
CVE-2026-20192 | Critical | 10.0 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connec… |
CVE-2026-20176 | Critical | 9.1 | 2026-09-16 | A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected devi… |
CVE-2026-20130 | Critical | 10.0 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connec… |
CVE-2026-92729 | High | 8.2 | 2026-09-16 | SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers… |
CVE-2026-92473 | Low | 3.3 | 2026-09-16 | A vulnerability was identified in GPAC 26.08-DEV. The impacted element is the function gf_sg_command_del of the file src/scenegraph/commands.c of the component… |
CVE-2026-92472 | Low | 3.3 | 2026-09-16 | A vulnerability was determined in GPAC 26.08-DEV. The affected element is the function gf_node_deactivate_ex of the file src/scenegraph/base_scenegraph.c of th… |
CVE-2026-92418 | Low | 3.5 | 2026-09-16 | A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of the file src/main/… |
CVE-2026-92417 | Medium | 6.5 | 2026-09-16 | A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogs_pfcp_parse_volume_measurement in the library lib/pfcp/types.c of the component… |
CVE-2026-91106 | Critical | 9.8 | 2026-09-16 | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
CVE-2026-91105 | Critical | 9.8 | 2026-09-16 | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
CVE-2026-91104 | Critical | 9.8 | 2026-09-16 | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
CVE-2026-91103 | Critical | 9.8 | 2026-09-16 | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
CVE-2026-91102 | Critical | 9.8 | 2026-09-16 | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
CVE-2026-91101 | Critical | 9.8 | 2026-09-16 | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
CVE-2026-91100 | Critical | 9.8 | 2026-09-16 | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
CVE-2026-91099 | Critical | 9.8 | 2026-09-16 | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
CVE-2026-91098 | Critical | 9.8 | 2026-09-16 | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
CVE-2026-91097 | Critical | 9.8 | 2026-09-16 | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
CVE-2026-86071 | Low | 3.7 | 2026-09-16 | Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java ca… |
CVE-2026-86043 | High | 7.5 | 2026-09-16 | Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversize… |
CVE-2026-86003 | High | 7.5 | 2026-09-16 | CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.g… |
CVE-2026-82399 | High | 7.5 | 2026-09-16 | CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in plugin/pkg/doh/d… |
CVE-2026-81876 | High | 7.5 | 2026-09-16 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/… |
CVE-2026-81875 | High | 7.5 | 2026-09-16 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/… |
CVE-2026-81176 | Medium | 5.3 | 2026-09-16 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does… |
CVE-2026-79298 | High | 8.4 | 2026-09-16 | An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcker to execute arbitrary code via the BOOT… |
CVE-2026-77360 | | 2026-09-16 | oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/… | |
CVE-2026-75516 | | 2026-09-16 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start()… | |
CVE-2026-75025 | Medium | 4.7 | 2026-09-16 | Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing loca… |
CVE-2026-73462 | Medium | 6.5 | 2026-09-16 | On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjace… |
CVE-2026-73457 | Medium | 5.3 | 2026-09-16 | Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials… |
CVE-2026-73456 | Critical | 10.0 | 2026-09-16 | Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI clie… |
CVE-2026-73443 | Medium | 4.7 | 2026-09-16 | On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on wh… |
CVE-2026-73442 | Low | 3.0 | 2026-09-16 | On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an… |
CVE-2026-68536 | Critical | 9.8 | 2026-09-16 | Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade… |
CVE-2026-63325 | High | 7.8 | 2026-09-16 | Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respe… |
CVE-2026-63225 | Medium | 4.4 | 2026-09-16 | Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths unde… |
CVE-2026-63126 | High | 7.5 | 2026-09-16 | Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently valid… |
CVE-2026-59823 | | 2026-09-16 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtu… | |
CVE-2026-46352 | High | 7.5 | 2026-09-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to ve… |
CVE-2026-38999 | High | 7.5 | 2026-09-16 | A Null Pointer Dereference in the mk_sched_event_close function (mk_server/mk_scheduler.c) of Monkey through commit 4fb0c16 allows attackers to cause a Denial… |
CVE-2026-92720 | Critical | 9.1 | 2026-09-16 | Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and se… |
CVE-2026-92719 | High | 7.5 | 2026-09-16 | Quickwit through 0.9.0 fails to validate the host and scheme of the queue_url parameter in SQS file sources, allowing attackers to make the node issue requests… |
CVE-2026-92718 | High | 7.3 | 2026-09-16 | Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verif… |
CVE-2026-92717 | Critical | 9.1 | 2026-09-16 | Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and re… |
CVE-2026-92716 | Critical | 9.6 | 2026-09-16 | Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and re… |
CVE-2026-92605 | Medium | 6.5 | 2026-09-16 | IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers wi… |
CVE-2026-92604 | High | 8.1 | 2026-09-16 | Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacke… |
CVE-2026-92416 | Medium | 4.3 | 2026-09-16 | A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smf_n4_handle_session_report_request of the file src/smf/n4-handl… |
CVE-2026-92413 | Medium | 4.3 | 2026-09-16 | A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the fi… |
CVE-2026-92406 | High | 7.3 | 2026-09-16 | A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown function of the file /admins/assessments… |
CVE-2026-88593 | Medium | 6.1 | 2026-09-16 | kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent re… |
CVE-2026-85387 | High | 7.1 | 2026-09-16 | Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been is… |
CVE-2026-84397 | Medium | 5.4 | 2026-09-16 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-69147 | Medium | 6.5 | 2026-09-16 | vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.v… |
CVE-2026-51990 | Critical | 9.8 | 2026-09-16 | An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe component |