2026 CVEs (page 8)
Page 8 of 658 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47489 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where permissions on read-only memory might not be preserved. A successfu… |
CVE-2026-103470 | | 2026-09-30 | In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges. | |
CVE-2026-103442 | | 2026-09-30 | External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issu… | |
CVE-2026-103441 | | 2026-09-30 | Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable File… | |
CVE-2026-103436 | Low | 3.7 | 2026-09-30 | apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On th… |
CVE-2026-103432 | High | 8.1 | 2026-09-30 | apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi)… |
CVE-2026-103231 | High | 7.3 | 2026-09-30 | A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the funct… |
CVE-2026-103230 | High | 7.3 | 2026-09-30 | A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_q… |
CVE-2026-103229 | High | 7.3 | 2026-09-30 | A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli… |
CVE-2026-102427 | Critical | 10.0 | 2026-09-30 | Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s… |
CVE-2026-100280 | Low | 3.1 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible |
CVE-2026-100279 | Medium | 6.5 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials |
CVE-2026-100278 | Medium | 4.9 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments |
CVE-2026-100277 | High | 8.9 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature |
CVE-2026-100276 | Medium | 5.9 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action |
CVE-2026-100275 | Medium | 6.9 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible |
CVE-2026-100274 | Medium | 6.5 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template |
CVE-2026-100273 | High | 8.2 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution |
CVE-2026-100272 | Medium | 4.9 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues |
CVE-2026-100271 | Low | 2.7 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects |
CVE-2026-100270 | Low | 3.3 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations |
CVE-2026-100269 | Medium | 4.3 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed |
CVE-2026-100268 | High | 7.7 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates |
CVE-2026-100267 | Medium | 5.9 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters |
CVE-2026-100266 | High | 7.7 | 2026-09-30 | In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address |
CVE-2026-100265 | Medium | 4.8 | 2026-09-30 | In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation |
CVE-2026-100264 | Low | 2.7 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host |
CVE-2026-100263 | Medium | 4.7 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible |
CVE-2026-100262 | High | 7.6 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates |
CVE-2026-100261 | Medium | 5.4 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission |
CVE-2026-100260 | Medium | 5.3 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset |
CVE-2026-100259 | Medium | 4.3 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access |
CVE-2026-100258 | Medium | 4.3 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings |
CVE-2026-100257 | Medium | 4.3 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export |
CVE-2026-100256 | High | 7.8 | 2026-09-30 | In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects |
CVE-2026-100255 | High | 8.1 | 2026-09-30 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset |
CVE-2026-100254 | High | 8.8 | 2026-09-30 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git con… |
CVE-2026-100253 | High | 8.8 | 2026-09-30 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL |
CVE-2026-97259 | | 2026-09-30 | Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access… | |
CVE-2026-94545 | | 2026-09-30 | Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values befo… | |
CVE-2026-76570 | | 2026-09-30 | Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no J… | |
CVE-2026-62097 | High | 7.6 | 2026-09-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allo… |
CVE-2026-62084 | Medium | 6.5 | 2026-09-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This… |
CVE-2026-47097 | High | 7.5 | 2026-09-30 | AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bun… |
CVE-2026-18783 | High | 8.8 | 2026-09-30 | Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass. This issue… |
CVE-2026-18782 | Critical | 9.8 | 2026-09-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES al… |
CVE-2026-103398 | High | 8.1 | 2026-09-30 | OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary director… |
CVE-2026-103397 | Medium | 5.6 | 2026-09-30 | OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing… |
CVE-2026-103396 | Medium | 4.3 | 2026-09-30 | bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission r… |
CVE-2026-103395 | Critical | 9.8 | 2026-09-30 | LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments i… |
CVE-2026-103389 | | 2026-09-30 | MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any s… | |
CVE-2026-103388 | | 2026-09-30 | MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTE… | |
CVE-2026-103270 | High | 7.5 | 2026-09-30 | LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call en… |
CVE-2026-103243 | Medium | 5.8 | 2026-09-30 | LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side… |
CVE-2026-103227 | Medium | 6.3 | 2026-09-30 | A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of t… |
CVE-2026-103226 | Medium | 6.3 | 2026-09-30 | A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the compo… |
CVE-2026-103222 | Medium | 5.6 | 2026-09-30 | A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz… |
CVE-2026-102984 | | 2026-09-30 | Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed por… | |
CVE-2026-102983 | | 2026-09-30 | Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN… | |
CVE-2026-102717 | High | 7.5 | 2026-09-30 | MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash |
CVE-2026-101295 | High | 7.3 | 2026-09-30 | Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1)… |
CVE-2026-93903 | | 2026-09-30 | LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case." | |
CVE-2026-93547 | | 2026-09-30 | A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace c… | |
CVE-2026-91860 | | 2026-09-30 | A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not con… | |
CVE-2026-82307 | Critical | 9.8 | 2026-09-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injectio… |
CVE-2026-103118 | Medium | 4.3 | 2026-09-30 | A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the c… |
CVE-2026-97302 | Medium | 5.3 | 2026-09-30 | Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions. |
CVE-2026-97301 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. |
CVE-2026-97299 | Medium | 5.4 | 2026-09-30 | Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions. |
CVE-2026-97298 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions. |
CVE-2026-97293 | High | 8.5 | 2026-09-30 | Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions. |
CVE-2026-97292 | Medium | 6.5 | 2026-09-30 | Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions. |
CVE-2026-97289 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.2.6 versions. |
CVE-2026-97288 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions. |
CVE-2026-97287 | High | 8.5 | 2026-09-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows… |
CVE-2026-97286 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in Strong Testimonials <= 3.3.11 versions. |
CVE-2026-97285 | Medium | 5.4 | 2026-09-30 | Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions. |
CVE-2026-97282 | Medium | 5.3 | 2026-09-30 | Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions. |
CVE-2026-97279 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions. |
CVE-2026-97274 | Critical | 9.8 | 2026-09-30 | Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions. |
CVE-2026-97272 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions. |
CVE-2026-97271 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. |
CVE-2026-97270 | Medium | 6.5 | 2026-09-30 | Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions. |
CVE-2026-97267 | Medium | 4.3 | 2026-09-30 | Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions. |
CVE-2026-97266 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions. |
CVE-2026-97262 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions. |
CVE-2026-97261 | Medium | 5.3 | 2026-09-30 | Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions. |
CVE-2026-97253 | High | 7.1 | 2026-09-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue af… |
CVE-2026-97250 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. |
CVE-2026-97249 | Medium | 5.3 | 2026-09-30 | Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions. |
CVE-2026-97248 | Critical | 9.8 | 2026-09-30 | Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions. |
CVE-2026-97247 | Medium | 6.5 | 2026-09-30 | Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions. |
CVE-2026-97246 | Medium | 4.9 | 2026-09-30 | Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 versions. |
CVE-2026-97245 | High | 7.2 | 2026-09-30 | Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions. |
CVE-2026-97244 | High | 7.5 | 2026-09-30 | Contributor Path Traversal in Creator LMS <= 1.2.19 versions. |
CVE-2026-97243 | Medium | 5.4 | 2026-09-30 | Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions. |
CVE-2026-97242 | Medium | 6.8 | 2026-09-30 | Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions. |
CVE-2026-97241 | High | 7.5 | 2026-09-30 | Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions. |
CVE-2026-97240 | High | 7.5 | 2026-09-30 | Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions. |
CVE-2026-97239 | Medium | 6.5 | 2026-09-30 | Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions. |