2026 CVEs (page 73)
Page 73 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-92605 | Medium | 6.5 | 2026-09-16 | IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers wi… |
CVE-2026-92604 | High | 8.1 | 2026-09-16 | Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacke… |
CVE-2026-92416 | Medium | 4.3 | 2026-09-16 | A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smf_n4_handle_session_report_request of the file src/smf/n4-handl… |
CVE-2026-92413 | Medium | 4.3 | 2026-09-16 | A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the fi… |
CVE-2026-92406 | High | 7.3 | 2026-09-16 | A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown function of the file /admins/assessments… |
CVE-2026-88593 | Medium | 6.1 | 2026-09-16 | kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent re… |
CVE-2026-85387 | High | 7.1 | 2026-09-16 | Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been is… |
CVE-2026-84397 | Medium | 5.4 | 2026-09-16 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-69147 | Medium | 6.5 | 2026-09-16 | vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.v… |
CVE-2026-51990 | Critical | 9.8 | 2026-09-16 | An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe component |
CVE-2026-47094 | High | 8.8 | 2026-09-16 | SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to access and modify arbitrary employee r… |
CVE-2026-18120 | Medium | 5.9 | 2026-09-16 | Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries() permissio… |
CVE-2026-92603 | Medium | 6.5 | 2026-09-16 | ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete o… |
CVE-2026-92602 | High | 7.1 | 2026-09-16 | TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attac… |
CVE-2026-92601 | Medium | 6.5 | 2026-09-16 | Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by… |
CVE-2026-92600 | Medium | 6.5 | 2026-09-16 | Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermiss… |
CVE-2026-92405 | High | 7.3 | 2026-09-16 | A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element is an unknown function of the file /inde… |
CVE-2026-92402 | Medium | 6.3 | 2026-09-16 | A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the function index of the file UserCo… |
CVE-2026-92401 | High | 7.3 | 2026-09-16 | A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects the function top.upstudy.crm.utils… |
CVE-2026-92399 | High | 7.3 | 2026-09-16 | A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/utils/rmt_ws.c of the component WebSocket… |
CVE-2026-92398 | Critical | 9.1 | 2026-09-16 | A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this issue is some unknown functionality of the file /etc/rg_config/admin of the… |
CVE-2026-87031 | Low | 2.7 | 2026-09-16 | n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Controller/Users.php) di… |
CVE-2026-87028 | Medium | 6.5 | 2026-09-16 | Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the request… |
CVE-2026-86359 | High | 8.5 | 2026-09-16 | Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privileged attacker with remote access could p… |
CVE-2026-86358 | Medium | 6.5 | 2026-09-16 | Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with adjacent netw… |
CVE-2026-85756 | High | 7.5 | 2026-09-16 | SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to run scp on the serv… |
CVE-2026-85732 | Medium | 4.7 | 2026-09-16 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-… |
CVE-2026-85731 | High | 8.8 | 2026-09-16 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true ca… |
CVE-2026-85386 | Medium | 6.1 | 2026-09-16 | Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated b… |
CVE-2026-85385 | Critical | 9.6 | 2026-09-16 | Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashboard user management… |
CVE-2026-84993 | Medium | 6.5 | 2026-09-16 | MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 and 7.1.7, the shared SQL layer validate… |
CVE-2026-76420 | Critical | 9.0 | 2026-09-16 | A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow an unauthenticated, r… |
CVE-2026-71182 | Low | 3.0 | 2026-09-16 | Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A high pri… |
CVE-2026-71181 | Low | 3.0 | 2026-09-16 | Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A high pri… |
CVE-2026-71180 | High | 8.2 | 2026-09-16 | Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local access could… |
CVE-2026-71179 | High | 7.3 | 2026-09-16 | Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection… |
CVE-2026-69200 | Low | 3.7 | 2026-09-16 | node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-… |
CVE-2026-68904 | High | 7.0 | 2026-09-16 | node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can… |
CVE-2026-59974 | High | 7.8 | 2026-09-16 | Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.co… |
CVE-2026-59944 | Medium | 6.1 | 2026-09-16 | Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the… |
CVE-2026-57173 | Medium | 6.5 | 2026-09-16 | vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v1/chat/completions calls AudioMediaIO.l… |
CVE-2026-42784 | High | 7.4 | 2026-09-16 | A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discre… |
CVE-2026-20331 | Critical | 9.6 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall T… |
CVE-2026-20307 | Critical | 9.9 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlyin… |
CVE-2026-20306 | Critical | 9.1 | 2026-09-16 | A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying o… |
CVE-2026-20305 | Critical | 9.1 | 2026-09-16 | A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the unde… |
CVE-2026-20234 | Critical | 9.9 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connec… |
CVE-2026-92627 | | 2026-09-16 | A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype containing floating-p… | |
CVE-2026-92626 | High | 7.5 | 2026-09-16 | Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/dguardintegration/dguardVersion endpoint derefer… |
CVE-2026-92625 | High | 7.5 | 2026-09-16 | Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/license/restartService endpoint is reachable wit… |
CVE-2026-92615 | Medium | 6.6 | 2026-09-16 | A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include Insecu… |
CVE-2026-92397 | Critical | 9.1 | 2026-09-16 | A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this vulnerability is the function cc_set of the file unifyframe-sgi.elf of… |
CVE-2026-92385 | Low | 2.4 | 2026-09-16 | A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/update_categor… |
CVE-2026-90999 | Critical | 9.8 | 2026-09-16 | Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed b… |
CVE-2026-76104 | Medium | 5.5 | 2026-09-16 | Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability in the OS. A high privileged attac… |
CVE-2026-70416 | Critical | 10.0 | 2026-09-16 | Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticated attacker with remote access could p… |
CVE-2026-61595 | High | 7.7 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, `djust.tenants` isolatio… |
CVE-2026-61593 | High | 8.1 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server PO… |
CVE-2026-26947 | Medium | 6.7 | 2026-09-16 | Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Improper Privilege Management vulnerability. A high priv… |
CVE-2026-19607 | Medium | 5.3 | 2026-09-16 | A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when… |
CVE-2026-17526 | High | 7.2 | 2026-09-16 | Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a r… |
CVE-2026-92616 | Medium | 6.8 | 2026-09-16 | FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and wr… |
CVE-2026-92570 | Medium | 6.5 | 2026-09-16 | reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled rec… |
CVE-2026-92569 | Medium | 4.3 | 2026-09-16 | Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress param… |
CVE-2026-92568 | Medium | 5.4 | 2026-09-16 | MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows authenticated users to make the API se… |
CVE-2026-92567 | Medium | 6.5 | 2026-09-16 | TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated user… |
CVE-2026-92566 | High | 8.2 | 2026-09-16 | DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to exec… |
CVE-2026-92565 | Medium | 5.3 | 2026-09-16 | Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addr… |
CVE-2026-92395 | Critical | 9.1 | 2026-09-16 | @fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request… |
CVE-2026-92383 | Medium | 4.3 | 2026-09-16 | A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserController::mod of the fil… |
CVE-2026-92381 | Low | 3.5 | 2026-09-16 | A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/controller/content/ContentController.ph… |
CVE-2026-92380 | High | 7.3 | 2026-09-16 | A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the c… |
CVE-2026-92366 | High | 7.3 | 2026-09-16 | A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the file /search.php of the component Regular Search. T… |
CVE-2026-92087 | High | 8.1 | 2026-09-16 | @fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0… |
CVE-2026-89031 | Medium | 5.4 | 2026-09-16 | Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_po… |
CVE-2026-88976 | Medium | 6.1 | 2026-09-16 | Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deseri… |
CVE-2026-88064 | High | 8.8 | 2026-09-16 | Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insuff… |
CVE-2026-84997 | High | 7.5 | 2026-09-16 | react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter… |
CVE-2026-84860 | High | 8.8 | 2026-09-16 | ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself disp… |
CVE-2026-84859 | Medium | 6.5 | 2026-09-16 | ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing… |
CVE-2026-84858 | High | 8.8 | 2026-09-16 | ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataSourceEditDwr" clas… |
CVE-2026-82964 | High | 8.8 | 2026-09-16 | Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside th… |
CVE-2026-82410 | | 2026-09-16 | Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but… | |
CVE-2026-80274 | High | 7.5 | 2026-09-16 | If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 pro… |
CVE-2026-79651 | High | 7.5 | 2026-09-16 | A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and the… |
CVE-2026-77412 | | 2026-09-16 | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed… | |
CVE-2026-77411 | | 2026-09-16 | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared AMQP longstr len… | |
CVE-2026-77410 | | 2026-09-16 | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the message body slice with the uint64 ch.header… | |
CVE-2026-77409 | | 2026-09-16 | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.dispatch in channel.go, confirms.confirm in confirms.go, and Connection.dispatch0 in co… | |
CVE-2026-77408 | | 2026-09-16 | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values t… | |
CVE-2026-77407 | | 2026-09-16 | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection… | |
CVE-2026-77406 | | 2026-09-16 | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts th… | |
CVE-2026-77405 | | 2026-09-16 | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionT… | |
CVE-2026-77404 | | 2026-09-16 | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly… | |
CVE-2026-77403 | | 2026-09-16 | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameM… | |
CVE-2026-77401 | Medium | 6.8 | 2026-09-16 | Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessCon… |
CVE-2026-77119 | Medium | 5.9 | 2026-09-16 | A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned ans… |
CVE-2026-76825 | High | 8.4 | 2026-09-16 | RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPyth… |
CVE-2026-76163 | High | 7.5 | 2026-09-16 | If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion… |
CVE-2026-75029 | Medium | 5.3 | 2026-09-16 | In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on… |