2026 CVEs (page 93)
Page 93 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-91778 | | 2026-09-15 | In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server bui… | |
CVE-2026-91091 | Medium | 4.3 | 2026-09-15 | A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_node_list_insert_child of the file scenegraph/base_scenegraph.c… |
CVE-2026-91090 | Low | 3.9 | 2026-09-15 | A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This… |
CVE-2026-91089 | Medium | 6.3 | 2026-09-15 | A vulnerability was found in GPAC up to f1219cde. Impacted is the function gf_node_get_name_and_id of the file scenegraph/base_scenegraph.c. The manipulation r… |
CVE-2026-91088 | Medium | 4.8 | 2026-09-15 | A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gf_url_concatenate_ex of the file utils/url.c of the component URL Handl… |
CVE-2026-91087 | High | 7.3 | 2026-09-15 | A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Co… |
CVE-2026-91086 | Medium | 6.3 | 2026-09-15 | A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmx_process of the file filters/reframe_mpgvid… |
CVE-2026-91005 | Medium | 6.3 | 2026-09-15 | A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded_file of the file production/edit_pictu… |
CVE-2026-90711 | Critical | 9.1 | 2026-09-15 | proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions… |
CVE-2026-89141 | Medium | 6.5 | 2026-09-15 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and… |
CVE-2026-75983 | High | 7.5 | 2026-09-15 | The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, an… |
CVE-2026-18063 | Medium | 6.4 | 2026-09-15 | The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position_button' parameter in all versions up to, and including, 2… |
CVE-2026-15402 | Medium | 6.4 | 2026-09-15 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_she… |
CVE-2026-91004 | High | 7.3 | 2026-09-15 | A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete_faculty1… |
CVE-2026-91003 | Critical | 9.1 | 2026-09-15 | A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI Service. This manipulat… |
CVE-2026-91002 | Medium | 5.3 | 2026-09-15 | A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function _blacklist of the file core/httpd.py of the component… |
CVE-2026-91001 | Critical | 9.9 | 2026-09-15 | A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS Configuration. Perf… |
CVE-2026-86701 | Low | 2.5 | 2026-09-15 | Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on… |
CVE-2026-81320 | Medium | 5.5 | 2026-09-15 | A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object… |
CVE-2026-81303 | Medium | 6.3 | 2026-09-15 | A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName val… |
CVE-2026-18232 | Medium | 5.3 | 2026-09-15 | The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public… |
CVE-2026-17495 | Medium | 5.9 | 2026-09-15 | moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-str… |
CVE-2026-16593 | Medium | 6.8 | 2026-09-15 | The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authentica… |
CVE-2026-16592 | Low | 2.7 | 2026-09-15 | The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as… |
CVE-2026-15758 | Medium | 5.3 | 2026-09-15 | The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all version… |
CVE-2026-90881 | Medium | 5.3 | 2026-09-15 | A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Execut… |
CVE-2026-90880 | High | 7.4 | 2026-09-15 | A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of t… |
CVE-2026-90879 | High | 7.3 | 2026-09-15 | A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Pu… |
CVE-2026-90878 | Medium | 4.3 | 2026-09-15 | A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template… |
CVE-2026-90877 | High | 7.3 | 2026-09-15 | A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update_requi… |
CVE-2026-90876 | High | 7.3 | 2026-09-15 | A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /d… |
CVE-2026-90858 | High | 7.3 | 2026-09-15 | A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the fun… |
CVE-2026-90857 | Medium | 6.3 | 2026-09-15 | A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown function of the file /dashboard/userprofile… |
CVE-2026-90856 | High | 7.3 | 2026-09-15 | A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts an unknown function of the file signup.p… |
CVE-2026-90855 | High | 7.3 | 2026-09-15 | A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown function of the file /web/order.php. Thi… |
CVE-2026-90854 | High | 7.3 | 2026-09-15 | A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /we… |
CVE-2026-90852 | High | 7.3 | 2026-09-15 | A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.j… |
CVE-2026-88262 | | 2026-09-15 | Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass. This issue affects xClick: R2, R3, and R3.1. | |
CVE-2026-88261 | | 2026-09-15 | Improper input validation vulnerability in bizwell xClick allows Stored XSS. This issue affects xClick: R2, R3, and R3.1. | |
CVE-2026-91774 | Medium | 4.3 | 2026-09-15 | Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers… |
CVE-2026-91773 | Medium | 4.3 | 2026-09-15 | Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories… |
CVE-2026-91772 | Medium | 6.1 | 2026-09-15 | Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can c… |
CVE-2026-91771 | High | 8.8 | 2026-09-15 | Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Atta… |
CVE-2026-91770 | Medium | 6.5 | 2026-09-15 | IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR rec… |
CVE-2026-90851 | Medium | 6.3 | 2026-09-15 | A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of… |
CVE-2026-90850 | Low | 2.4 | 2026-09-15 | A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-student… |
CVE-2026-90849 | High | 7.3 | 2026-09-15 | A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown function… |
CVE-2026-90848 | Medium | 4.3 | 2026-09-15 | A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a ma… |
CVE-2026-91752 | High | 7.5 | 2026-09-15 | GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array… |
CVE-2026-91751 | High | 8.3 | 2026-09-15 | Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or… |
CVE-2026-91750 | Medium | 6.5 | 2026-09-15 | WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from… |
CVE-2026-90847 | Critical | 9.1 | 2026-09-15 | A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. Th… |
CVE-2026-90846 | High | 7.3 | 2026-09-15 | A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manip… |
CVE-2026-90845 | Low | 3.5 | 2026-09-15 | A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Execut… |
CVE-2026-90844 | High | 7.3 | 2026-09-15 | A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the compone… |
CVE-2026-90843 | High | 8.3 | 2026-09-15 | A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the function nmap_newscan of t… |
CVE-2026-85657 | Medium | 5.4 | 2026-09-15 | The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-85575 | Medium | 6.4 | 2026-09-15 | The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable… |
CVE-2026-90842 | Low | 3.7 | 2026-09-15 | A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/mo… |
CVE-2026-90841 | High | 7.3 | 2026-09-15 | A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ap… |
CVE-2026-90840 | High | 7.3 | 2026-09-15 | A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function __construct of the file /application/controllers/admin… |
CVE-2026-91201 | Medium | 5.4 | 2026-09-14 | DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attac… |
CVE-2026-91200 | High | 8.8 | 2026-09-14 | DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can… |
CVE-2026-91199 | Medium | 5.0 | 2026-09-14 | Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validat… |
CVE-2026-91198 | Medium | 5.3 | 2026-09-14 | GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experime… |
CVE-2026-91197 | Medium | 6.5 | 2026-09-14 | Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable… |
CVE-2026-90835 | Low | 3.5 | 2026-09-14 | A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Pag… |
CVE-2026-90831 | Medium | 5.3 | 2026-09-14 | A vulnerability was detected in GNU Binutils 2.47. The affected element is the function _bfd_elf_strtab_delref of the file bfd/elf-strtab.c of the component EL… |
CVE-2026-90830 | Medium | 5.3 | 2026-09-14 | A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Se… |
CVE-2026-90829 | Medium | 5.3 | 2026-09-14 | A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component SHT_GROU… |
CVE-2026-81900 | Medium | 6.1 | 2026-09-14 | Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escapi… |
CVE-2026-77191 | Low | 2.6 | 2026-09-14 | An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (millis… |
CVE-2026-75945 | Low | 2.6 | 2026-09-14 | A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued. |
CVE-2026-75944 | Low | 2.6 | 2026-09-14 | A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale… |
CVE-2026-75943 | Low | 2.6 | 2026-09-14 | A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to… |
CVE-2026-18116 | Medium | 6.1 | 2026-09-14 | Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion noti… |
CVE-2026-14986 | Medium | 6.8 | 2026-09-14 | The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied wr… |
CVE-2026-91181 | Medium | 6.5 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention team… |
CVE-2026-91146 | Medium | 6.1 | 2026-09-14 | Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascr… |
CVE-2026-91145 | High | 7.1 | 2026-09-14 | Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers… |
CVE-2026-91144 | High | 7.5 | 2026-09-14 | ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can… |
CVE-2026-91143 | High | 7.2 | 2026-09-14 | goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requireme… |
CVE-2026-90828 | Medium | 5.3 | 2026-09-14 | A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elf_orphan_compatible of the file ld/ldelf.c of the component… |
CVE-2026-90827 | Low | 3.3 | 2026-09-14 | A vulnerability was identified in GPAC 26.07.0. This affects the function gf_node_deactivate_ex of the file scenegraph/base_scenegraph.c of the component MP4Bo… |
CVE-2026-90826 | Low | 2.8 | 2026-09-14 | A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gf_node_del of the file scenegraph/base_scenegraph.c of the component MP… |
CVE-2026-90825 | Low | 3.3 | 2026-09-14 | A vulnerability was found in GPAC 26.07.0. Affected by this vulnerability is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the co… |
CVE-2026-76081 | Medium | 5.5 | 2026-09-14 | ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are delet… |
CVE-2026-73449 | Medium | 5.9 | 2026-09-14 | On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privile… |
CVE-2026-18117 | Medium | 5.4 | 2026-09-14 | Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because the Edit Alias dialog applied only trim()… |
CVE-2026-13265 | Medium | 6.8 | 2026-09-14 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-12944 | Critical | 9.6 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting co… |
CVE-2026-12759 | Medium | 6.5 | 2026-09-14 | IBM Cloud Pak for Business Automation could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption. |
CVE-2026-12758 | Medium | 5.4 | 2026-09-14 | IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP… |
CVE-2026-12756 | High | 7.1 | 2026-09-14 | IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote a… |
CVE-2026-90896 | | 2026-09-14 | Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /… | |
CVE-2026-90824 | Low | 3.3 | 2026-09-14 | A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box… |
CVE-2026-90820 | Medium | 4.3 | 2026-09-14 | A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks… |
CVE-2026-90819 | High | 7.3 | 2026-09-14 | A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file s… |
CVE-2026-90818 | Medium | 4.3 | 2026-09-14 | A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowser… |
CVE-2026-86924 | Medium | 5.5 | 2026-09-14 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gat… |