2026 CVEs (page 720)
Page 720 of 725 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22239 | Medium | 5.3 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker could exploit this vulnerability by sendi… |
CVE-2026-22238 | Critical | 9.8 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs. An unauthenticated remote attacker could exploit this vulnerabi… |
CVE-2026-22237 | Critical | 9.8 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated remote attacker could exploit this vulnera… |
CVE-2026-22236 | Critical | 9.8 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs. An unauthenticated remote attacker could exploit this vulnera… |
CVE-2026-0532 | High | 8.6 | 2026-01-14 | External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure thr… |
CVE-2026-0529 | Medium | 6.5 | 2026-01-14 | Improper Validation of Array Index (CWE-129) in Packetbeat’s MongoDB protocol parser can allow an attacker to cause Overflow Buffers (CAPEC-100) through specia… |
CVE-2026-23550 | Critical | 9.8 | 2026-01-14 | Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a thr… |
CVE-2026-0813 | Medium | 4.4 | 2026-01-14 | The Short Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'short_link_post_title' and 'short_link_page_title' parameters in all… |
CVE-2026-0812 | Medium | 4.4 | 2026-01-14 | The LinkedIn SC plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'linkedin_sc_date_format', 'linkedin_sc_api_key', and 'linkedin_sc_se… |
CVE-2026-0741 | Medium | 4.4 | 2026-01-14 | The Electric Studio Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and inclu… |
CVE-2026-0739 | Medium | 4.4 | 2026-01-14 | The WMF Mobile Redirector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.2 d… |
CVE-2026-0734 | Medium | 4.4 | 2026-01-14 | The WP Allowed Hosts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allowed-hosts' parameter in all versions up to, and including… |
CVE-2026-0717 | Medium | 5.3 | 2026-01-14 | The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 v… |
CVE-2026-0694 | Medium | 6.4 | 2026-01-14 | The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all versions up to, and including, 1.0.0… |
CVE-2026-0680 | Medium | 4.4 | 2026-01-14 | The Real Post Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 2.4 d… |
CVE-2026-0678 | Medium | 4.9 | 2026-01-14 | The Flat Shipping Rate by City for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'cities' parameter in all versions up to… |
CVE-2026-0635 | Medium | 4.3 | 2026-01-14 | The Responsive Accordion Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resp_accordio… |
CVE-2026-0594 | Medium | 6.1 | 2026-01-14 | The List Site Contributors plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'alpha' parameter in versions up to, and including, 1.1… |
CVE-2026-22718 | Medium | 6.8 | 2026-01-14 | The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users machine. |
CVE-2026-22686 | Critical | 10.0 | 2026-01-14 | Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-v… |
CVE-2026-0716 | Medium | 4.8 | 2026-01-13 | A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming pay… |
CVE-2026-23478 | Critical | 9.8 | 2026-01-13 | Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gai… |
CVE-2026-22871 | Critical | 9.8 | 2026-01-13 | GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() functio… |
CVE-2026-22870 | High | 7.5 | 2026-01-13 | GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when e… |
CVE-2026-22869 | Critical | 9.8 | 2026-01-13 | Eigent is a multi-agent Workforce. A critical security vulnerability in the CI workflow (.github/workflows/ci.yml) allows arbitrary code execution from fork pu… |
CVE-2026-22868 | High | 7.5 | 2026-01-13 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially cra… |
CVE-2026-22862 | High | 7.5 | 2026-01-13 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially cra… |
CVE-2026-22861 | High | 8.8 | 2026-01-13 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21303 | Medium | 5.5 | 2026-01-13 | Substance3D - Modeler versions 1.22.4 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could lev… |
CVE-2026-21302 | Medium | 5.5 | 2026-01-13 | Substance3D - Modeler versions 1.22.4 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could lev… |
CVE-2026-21301 | Medium | 5.5 | 2026-01-13 | Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. Ex… |
CVE-2026-21300 | Medium | 5.5 | 2026-01-13 | Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. Ex… |
CVE-2026-21299 | High | 7.8 | 2026-01-13 | Substance3D - Modeler versions 1.22.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the con… |
CVE-2026-21298 | High | 7.8 | 2026-01-13 | Substance3D - Modeler versions 1.22.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the con… |
CVE-2026-0543 | Medium | 6.5 | 2026-01-13 | Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted e… |
CVE-2026-0531 | Medium | 6.5 | 2026-01-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrie… |
CVE-2026-0530 | Medium | 6.5 | 2026-01-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. Th… |
CVE-2026-0528 | Medium | 6.5 | 2026-01-13 | Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153… |
CVE-2026-22818 | High | 8.2 | 2026-01-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification midd… |
CVE-2026-22817 | High | 8.2 | 2026-01-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification midd… |
CVE-2026-22814 | | 2026-01-13 | @adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid… | |
CVE-2026-22809 | Medium | 4.4 | 2026-01-13 | tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in t… |
CVE-2026-21308 | Medium | 5.5 | 2026-01-13 | Substance3D - Designer versions 15.0.3 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could le… |
CVE-2026-21307 | High | 7.8 | 2026-01-13 | Substance3D - Designer versions 15.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-21306 | High | 7.8 | 2026-01-13 | Substance3D - Sampler versions 5.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2026-21305 | High | 7.8 | 2026-01-13 | Substance3D - Painter versions 11.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the con… |
CVE-2026-21287 | High | 7.8 | 2026-01-13 | Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-22791 | Medium | 6.6 | 2026-01-13 | openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP… |
CVE-2026-21304 | High | 7.8 | 2026-01-13 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in… |
CVE-2026-21288 | Medium | 5.5 | 2026-01-13 | Illustrator versions 29.8.3, 30.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An att… |
CVE-2026-21283 | High | 7.8 | 2026-01-13 | Bridge versions 15.1.2, 16.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contex… |
CVE-2026-21281 | High | 7.8 | 2026-01-13 | InCopy versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contex… |
CVE-2026-21280 | High | 8.6 | 2026-01-13 | Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-21278 | Medium | 5.5 | 2026-01-13 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could le… |
CVE-2026-21277 | High | 7.8 | 2026-01-13 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in… |
CVE-2026-21276 | High | 7.8 | 2026-01-13 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code executi… |
CVE-2026-21275 | High | 7.8 | 2026-01-13 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code executi… |
CVE-2026-21274 | High | 7.8 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the con… |
CVE-2026-21272 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An att… |
CVE-2026-21271 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the c… |
CVE-2026-21268 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the c… |
CVE-2026-21267 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul… |
CVE-2026-21226 | High | 7.5 | 2026-01-13 | Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network. |
CVE-2026-21265 | Medium | 6.4 | 2026-01-13 | Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affect… |
CVE-2026-21224 | High | 7.8 | 2026-01-13 | Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. |
CVE-2026-21221 | High | 7.0 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authoriz… |
CVE-2026-21219 | High | 7.0 | 2026-01-13 | Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. |
CVE-2026-20965 | High | 7.5 | 2026-01-13 | Improper verification of cryptographic signature in Windows Admin Center allows an authorized attacker to elevate privileges locally. |
CVE-2026-20963 | Critical | 9.8 | 2026-01-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. |
CVE-2026-20962 | Medium | 4.4 | 2026-01-13 | Use of uninitialized resource in Dynamic Root of Trust for Measurement (DRTM) allows an authorized attacker to disclose information locally. |
CVE-2026-20959 | Medium | 4.6 | 2026-01-13 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-20958 | Medium | 5.4 | 2026-01-13 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. |
CVE-2026-20957 | High | 7.8 | 2026-01-13 | Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-20956 | High | 7.8 | 2026-01-13 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-20955 | High | 7.8 | 2026-01-13 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-20953 | High | 8.4 | 2026-01-13 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-20952 | High | 8.4 | 2026-01-13 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-20951 | High | 7.8 | 2026-01-13 | Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. |
CVE-2026-20950 | High | 7.8 | 2026-01-13 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-20949 | High | 7.8 | 2026-01-13 | Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-20948 | High | 7.8 | 2026-01-13 | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-20947 | High | 8.8 | 2026-01-13 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute co… |
CVE-2026-20946 | High | 7.8 | 2026-01-13 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-20944 | High | 8.4 | 2026-01-13 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-20943 | High | 7.0 | 2026-01-13 | Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-20941 | High | 7.8 | 2026-01-13 | Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally. |
CVE-2026-20940 | High | 7.8 | 2026-01-13 | Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-20939 | Medium | 5.5 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-20938 | High | 7.8 | 2026-01-13 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
CVE-2026-20937 | Medium | 5.5 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-20936 | Medium | 4.3 | 2026-01-13 | Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack. |
CVE-2026-20935 | Medium | 6.2 | 2026-01-13 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an unauthorized attacker to disclose information locally. |
CVE-2026-20934 | High | 7.5 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate priv… |
CVE-2026-20932 | Medium | 5.5 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-20931 | High | 8.0 | 2026-01-13 | External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network. |
CVE-2026-20929 | High | 7.5 | 2026-01-13 | Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network. |
CVE-2026-20927 | Medium | 5.3 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to deny service… |
CVE-2026-20926 | High | 7.5 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate priv… |
CVE-2026-20925 | Medium | 6.5 | 2026-01-13 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-20924 | High | 7.8 | 2026-01-13 | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. |