2026 CVEs (page 78)
Page 78 of 448 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66759 | High | 7.1 | 2026-07-27 | A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer wi… |
CVE-2026-66758 | High | 7.8 | 2026-07-27 | A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers… |
CVE-2026-66757 | Medium | 5.5 | 2026-07-27 | A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dim… |
CVE-2026-66031 | Medium | 5.4 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary… |
CVE-2026-64647 | Medium | 5.4 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with… |
CVE-2026-64646 | Medium | 5.3 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.j… |
CVE-2026-17612 | | 2026-07-27 | Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains an audit log disclosure Vulnerability … | |
CVE-2026-16481 | | 2026-07-27 | A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. … | |
CVE-2026-12383 | High | 7.5 | 2026-07-27 | A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authe… |
CVE-2026-10683 | Low | 2.4 | 2026-07-27 | In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback… |
CVE-2026-10682 | Medium | 6.6 | 2026-07-27 | The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the int16_t sr… |
CVE-2026-66030 | Medium | 5.4 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrar… |
CVE-2026-66029 | Medium | 5.4 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary… |
CVE-2026-66028 | Medium | 6.7 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create dupli… |
CVE-2026-64645 | Medium | 6.1 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirect… |
CVE-2026-64644 | Medium | 5.3 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js… |
CVE-2026-64643 | Medium | 5.3 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications usin… |
CVE-2026-64642 | High | 8.2 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications usin… |
CVE-2026-64641 | High | 7.5 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targetin… |
CVE-2026-59239 | | 2026-07-27 | Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute… | |
CVE-2026-55579 | Critical | 9.8 | 2026-07-27 | Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password… |
CVE-2026-55578 | High | 8.8 | 2026-07-27 | Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomple… |
CVE-2026-54540 | High | 8.8 | 2026-07-27 | Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The term… |
CVE-2026-54272 | | 2026-07-27 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through miscl… | |
CVE-2026-48052 | Medium | 5.4 | 2026-07-27 | Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can dele… |
CVE-2026-48051 | Low | 3.5 | 2026-07-27 | Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass… |
CVE-2026-48030 | Critical | 9.9 | 2026-07-27 | Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the term… |
CVE-2026-45623 | High | 7.5 | 2026-07-27 | PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and pri… |
CVE-2026-17570 | Medium | 4.3 | 2026-07-27 | Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credentia… |
CVE-2026-17569 | Medium | 4.3 | 2026-07-27 | Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored… |
CVE-2026-17568 | High | 8.8 | 2026-07-27 | Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group… |
CVE-2026-17552 | Critical | 9.1 | 2026-07-27 | Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewrite base i… |
CVE-2026-66731 | High | 7.5 | 2026-07-27 | facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote att… |
CVE-2026-66730 | High | 7.5 | 2026-07-27 | facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanen… |
CVE-2026-66729 | High | 7.5 | 2026-07-27 | facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to cras… |
CVE-2026-66391 | Medium | 6.5 | 2026-07-27 | Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0… |
CVE-2026-66390 | Medium | 6.1 | 2026-07-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9… |
CVE-2026-63077 | Critical | 9.8 | 2026-07-27 | In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol |
CVE-2026-24252 | High | 7.8 | 2026-07-27 | NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code ex… |
CVE-2026-17531 | Medium | 5.0 | 2026-07-27 | A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts… |
CVE-2026-17192 | High | 8.5 | 2026-07-27 | A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal service… |
CVE-2026-17191 | Critical | 9.1 | 2026-07-27 | An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, wh… |
CVE-2026-66399 | Medium | 6.5 | 2026-07-27 | phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management p… |
CVE-2026-66398 | | 2026-07-27 | phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT… | |
CVE-2026-66397 | | 2026-07-27 | phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attackers to delet… | |
CVE-2026-66396 | High | 8.4 | 2026-07-27 | SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site s… |
CVE-2026-66395 | Critical | 9.6 | 2026-07-27 | SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbit… |
CVE-2026-66394 | High | 8.7 | 2026-07-27 | SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scri… |
CVE-2026-59251 | High | 7.5 | 2026-07-27 | Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service… |
CVE-2026-59250 | | 2026-07-27 | Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially… | |
CVE-2026-58227 | High | 7.5 | 2026-07-27 | The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certifica… |
CVE-2026-55953 | High | 7.4 | 2026-07-27 | The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offer… |
CVE-2026-55737 | High | 7.5 | 2026-07-27 | Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term f… |
CVE-2026-54890 | High | 7.5 | 2026-07-27 | Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Ex… |
CVE-2026-47078 | | 2026-07-27 | Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archiv… | |
CVE-2026-42792 | High | 7.5 | 2026-07-27 | Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erla… |
CVE-2026-17574 | | 2026-07-27 | HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type fi… | |
CVE-2026-17573 | | 2026-07-27 | A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause… | |
CVE-2026-17572 | | 2026-07-27 | Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (cr… | |
CVE-2026-17530 | Medium | 6.3 | 2026-07-27 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file Astr… |
CVE-2026-17529 | Medium | 6.3 | 2026-07-27 | A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulati… |
CVE-2026-16812 | Critical | 10.0 | 2026-07-27 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact t… |
CVE-2026-66477 | Medium | 5.3 | 2026-07-27 | Unauthenticated Broken Access Control in Gillion <= 4.13 versions. |
CVE-2026-66476 | Medium | 4.9 | 2026-07-27 | Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions. |
CVE-2026-66475 | Medium | 5.9 | 2026-07-27 | Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 versions. |
CVE-2026-66474 | Medium | 4.3 | 2026-07-27 | Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions. |
CVE-2026-66448 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions. |
CVE-2026-66445 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions. |
CVE-2026-66442 | Medium | 5.4 | 2026-07-27 | Subscriber Broken Access Control in YayPricing <= 3.5.6 versions. |
CVE-2026-66438 | Medium | 5.3 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions. |
CVE-2026-66437 | Medium | 4.9 | 2026-07-27 | Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions. |
CVE-2026-66434 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions. |
CVE-2026-66433 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions. |
CVE-2026-66428 | Medium | 4.3 | 2026-07-27 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions. |
CVE-2026-66427 | High | 7.6 | 2026-07-27 | Administrator SQL Injection in WP Google Review Slider <= 18.4 versions. |
CVE-2026-66050 | High | 7.5 | 2026-07-27 | NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same netw… |
CVE-2026-65568 | Medium | 5.0 | 2026-07-27 | Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions. |
CVE-2026-65567 | Medium | 5.3 | 2026-07-27 | Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions. |
CVE-2026-65564 | Medium | 5.3 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions. |
CVE-2026-65563 | Medium | 5.9 | 2026-07-27 | Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions. |
CVE-2026-65562 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions. |
CVE-2026-65561 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions. |
CVE-2026-65558 | Medium | 5.4 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions. |
CVE-2026-65557 | Medium | 5.9 | 2026-07-27 | Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions. |
CVE-2026-65436 | Medium | 6.8 | 2026-07-27 | Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions. |
CVE-2026-65435 | Medium | 6.5 | 2026-07-27 | Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions. |
CVE-2026-65434 | Medium | 6.5 | 2026-07-27 | Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions. |
CVE-2026-65433 | Medium | 6.5 | 2026-07-27 | Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions. |
CVE-2026-59560 | Medium | 6.5 | 2026-07-27 | Subscriber Broken Access Control in FundEngine <= 1.7.8 versions. |
CVE-2026-59559 | Medium | 6.5 | 2026-07-27 | Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions. |
CVE-2026-59558 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions. |
CVE-2026-59557 | Medium | 6.5 | 2026-07-27 | Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions. |
CVE-2026-59556 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 versions. |
CVE-2026-59553 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions. |
CVE-2026-59552 | High | 7.2 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 versions. |
CVE-2026-59551 | High | 8.5 | 2026-07-27 | Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions. |
CVE-2026-59550 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions. |
CVE-2026-59549 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions. |
CVE-2026-59548 | High | 7.5 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking <= 1.0.0 versions. |
CVE-2026-59546 | High | 7.4 | 2026-07-27 | Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions. |