2026 CVEs (page 74)
Page 74 of 448 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48390 | High | 8.2 | 2026-07-28 | Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain… |
CVE-2026-48374 | High | 7.8 | 2026-07-28 | Bridge is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system… |
CVE-2026-48058 | | 2026-07-28 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc… | |
CVE-2026-47768 | Medium | 5.5 | 2026-07-28 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redi… |
CVE-2026-47726 | | 2026-07-28 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog… | |
CVE-2026-47725 | | 2026-07-28 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route… | |
CVE-2026-18107 | High | 7.8 | 2026-07-28 | A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq crit… |
CVE-2026-16771 | High | 8.8 | 2026-07-28 | In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/*.ha management endpoints… |
CVE-2026-16498 | Critical | 10.0 | 2026-07-28 | The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may a… |
CVE-2026-16496 | High | 8.9 | 2026-07-28 | The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who… |
CVE-2026-15992 | High | 8.8 | 2026-07-28 | The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorizati… |
CVE-2026-15304 | Medium | 6.5 | 2026-07-28 | The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in versions up to, and including, 10.2.4. This is d… |
CVE-2026-14869 | High | 8.6 | 2026-07-28 | The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthent… |
CVE-2026-59933 | High | 7.5 | 2026-07-28 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0… |
CVE-2026-59931 | High | 7.7 | 2026-07-28 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0… |
CVE-2026-54635 | High | 7.5 | 2026-07-28 | pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher f… |
CVE-2026-48388 | High | 8.6 | 2026-07-28 | Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context… |
CVE-2026-48372 | High | 7.8 | 2026-07-28 | Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Expl… |
CVE-2026-48025 | | 2026-07-28 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a C… | |
CVE-2026-67185 | High | 7.5 | 2026-07-28 | TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the… |
CVE-2026-67184 | High | 7.5 | 2026-07-28 | TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a mal… |
CVE-2026-67183 | High | 7.5 | 2026-07-28 | TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HT… |
CVE-2026-67182 | High | 7.5 | 2026-07-28 | Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed… |
CVE-2026-54620 | | 2026-07-28 | sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while sti… | |
CVE-2026-54619 | | 2026-07-28 | sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the p… | |
CVE-2026-54609 | High | 8.6 | 2026-07-28 | QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQ… |
CVE-2026-54605 | High | 7.2 | 2026-07-28 | OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw… |
CVE-2026-54603 | High | 8.6 | 2026-07-28 | OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirec… |
CVE-2026-54345 | High | 7.5 | 2026-07-28 | gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fi… |
CVE-2026-54332 | High | 7.5 | 2026-07-28 | gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attack… |
CVE-2026-18085 | Medium | 6.9 | 2026-07-28 | An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential De… |
CVE-2026-18084 | Medium | 6.1 | 2026-07-28 | Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site Scripting (X… |
CVE-2026-16313 | High | 7.6 | 2026-07-28 | A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control charact… |
CVE-2026-8058 | Medium | 4.5 | 2026-07-28 | IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password i… |
CVE-2026-7868 | Medium | 6.5 | 2026-07-28 | IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privile… |
CVE-2026-7775 | Medium | 5.5 | 2026-07-28 | IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2… |
CVE-2026-67181 | Medium | 5.4 | 2026-07-28 | Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploitin… |
CVE-2026-66754 | Medium | 5.9 | 2026-07-28 | Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to… |
CVE-2026-66753 | Low | 3.7 | 2026-07-28 | tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into… |
CVE-2026-66752 | Medium | 5.4 | 2026-07-28 | tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-E… |
CVE-2026-66751 | Medium | 5.4 | 2026-07-28 | Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending… |
CVE-2026-66750 | Medium | 4.3 | 2026-07-28 | Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and… |
CVE-2026-66749 | Medium | 6.5 | 2026-07-28 | Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-charac… |
CVE-2026-66748 | High | 8.8 | 2026-07-28 | Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission… |
CVE-2026-66746 | Medium | 5.4 | 2026-07-28 | Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding ca… |
CVE-2026-62828 | Medium | 5.4 | 2026-07-28 | Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-61609 | High | 7.5 | 2026-07-28 | Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::conf… |
CVE-2026-54593 | High | 8.1 | 2026-07-28 | Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accept… |
CVE-2026-54545 | High | 7.1 | 2026-07-28 | wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before wri… |
CVE-2026-47483 | High | 8.2 | 2026-07-28 | NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption… |
CVE-2026-47427 | High | 7.5 | 2026-07-28 | GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first ch… |
CVE-2026-45293 | High | 8.6 | 2026-07-28 | WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.Enqu… |
CVE-2026-43910 | High | 8.2 | 2026-07-28 | Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnec… |
CVE-2026-8164 | High | 7.3 | 2026-07-28 | Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijackin… |
CVE-2026-7521 | Medium | 5.5 | 2026-07-28 | Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deletion path which allows an admin with SAML… |
CVE-2026-6879 | | 2026-07-28 | `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last(… | |
CVE-2026-67178 | | 2026-07-28 | MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent /… | |
CVE-2026-67174 | | 2026-07-28 | Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement… | |
CVE-2026-66713 | Critical | 9.8 | 2026-07-28 | Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache… |
CVE-2026-66299 | High | 7.5 | 2026-07-28 | Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24… |
CVE-2026-63727 | High | 8.8 | 2026-07-28 | Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated… |
CVE-2026-67173 | | 2026-07-28 | Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to sup… | |
CVE-2026-66922 | | 2026-07-28 | Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. … | |
CVE-2026-66921 | | 2026-07-28 | Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name a… | |
CVE-2026-61487 | Medium | 6.5 | 2026-07-28 | Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-de… |
CVE-2026-59878 | High | 7.5 | 2026-07-28 | Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed… |
CVE-2026-7187 | High | 8.8 | 2026-07-28 | Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly Constrained by ACLs. Th… |
CVE-2026-66920 | | 2026-07-28 | Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traver… | |
CVE-2026-66919 | | 2026-07-28 | Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data were inter… | |
CVE-2026-66918 | | 2026-07-28 | Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When ren… | |
CVE-2026-66913 | | 2026-07-28 | Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted Z… | |
CVE-2026-65882 | Medium | 6.1 | 2026-07-28 | Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS… |
CVE-2026-65881 | High | 7.5 | 2026-07-28 | Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1 - The default configuration of the ext… |
CVE-2026-62436 | Medium | 6.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Gran… |
CVE-2026-62435 | Medium | 6.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Gran… |
CVE-2026-62434 | Medium | 5.3 | 2026-07-28 | A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory manage… |
CVE-2026-62433 | High | 7.3 | 2026-07-28 | Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a… |
CVE-2026-62432 | High | 7.3 | 2026-07-28 | The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset… |
CVE-2026-62431 | High | 7.5 | 2026-07-28 | The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a #DE fault. |
CVE-2026-62430 | High | 7.5 | 2026-07-28 | Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of th… |
CVE-2026-62429 | Medium | 6.5 | 2026-07-28 | Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration informa… |
CVE-2026-62428 | High | 7.8 | 2026-07-28 | When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy… |
CVE-2026-62427 | High | 8.8 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl… |
CVE-2026-62426 | High | 8.8 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl… |
CVE-2026-62425 | Medium | 5.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge… |
CVE-2026-62424 | Medium | 5.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge… |
CVE-2026-62423 | Medium | 5.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge… |
CVE-2026-49332 | High | 8.5 | 2026-07-28 | A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip und… |
CVE-2026-42495 | Medium | 5.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge… |
CVE-2026-42494 | Medium | 6.1 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge… |
CVE-2026-42493 | High | 7.5 | 2026-07-28 | Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costl… |
CVE-2026-42492 | High | 7.5 | 2026-07-28 | Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XEN_DOMCTL_… |
CVE-2026-41874 | | 2026-07-28 | Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve… | |
CVE-2026-18047 | Medium | 6.5 | 2026-07-28 | A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints… |
CVE-2026-18038 | Medium | 4.3 | 2026-07-28 | A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.Execute of the file goclaw/internal/http… |
CVE-2026-15393 | Medium | 6.4 | 2026-07-28 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2026-15016 | Medium | 6.4 | 2026-07-28 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via R… |
CVE-2026-4648 | | 2026-07-28 | Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. (version used at Resur… | |
CVE-2026-21047 | | 2026-07-28 | Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code. | |
CVE-2026-16774 | Medium | 5.3 | 2026-07-28 | The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is… |