2026 CVEs (page 99)
Page 99 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-90787 | High | 7.3 | 2026-09-14 | A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of… |
CVE-2026-90786 | Medium | 5.3 | 2026-09-14 | A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. This impacts the function align_order_members of the file src/compiler/semantics.c of the compo… |
CVE-2026-90785 | Medium | 5.3 | 2026-09-14 | A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyze_struct of the file src/compiler/semantics.c of the component Struc… |
CVE-2026-86349 | Medium | 4.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parse… |
CVE-2026-86348 | Medium | 4.3 | 2026-09-14 | Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a po… |
CVE-2026-84179 | Medium | 6.5 | 2026-09-14 | Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in th… |
CVE-2026-82920 | Medium | 5.5 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint… |
CVE-2026-82441 | Critical | 9.1 | 2026-09-14 | Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading… |
CVE-2026-82439 | Critical | 9.8 | 2026-09-14 | Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No code path ever rem… |
CVE-2026-7208 | Medium | 5.3 | 2026-09-14 | Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt activ… |
CVE-2026-73370 | Critical | 9.8 | 2026-09-14 | Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks performed by Reconciliation service's pull and push, being… |
CVE-2026-73236 | High | 7.5 | 2026-09-14 | Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix match… |
CVE-2026-73195 | High | 7.3 | 2026-09-14 | Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own pla… |
CVE-2026-73191 | Medium | 6.1 | 2026-09-14 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope. When the Syncope SRA is configured for CAS authentication, the target… |
CVE-2026-90957 | | 2026-09-14 | Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather… | |
CVE-2026-90955 | | 2026-09-14 | Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is desi… | |
CVE-2026-90938 | High | 8.6 | 2026-09-14 | LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated… |
CVE-2026-90937 | Critical | 9.9 | 2026-09-14 | froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apa… |
CVE-2026-90936 | Medium | 4.3 | 2026-09-14 | Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global s… |
CVE-2026-90935 | Medium | 4.3 | 2026-09-14 | Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers c… |
CVE-2026-90934 | Medium | 4.3 | 2026-09-14 | EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read… |
CVE-2026-90933 | High | 7.1 | 2026-09-14 | laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overw… |
CVE-2026-90932 | High | 7.2 | 2026-09-14 | LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService… |
CVE-2026-90931 | Medium | 5.4 | 2026-09-14 | LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permi… |
CVE-2026-90930 | Medium | 6.8 | 2026-09-14 | File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing auth… |
CVE-2026-90929 | High | 8.1 | 2026-09-14 | File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go)… |
CVE-2026-90928 | Medium | 6.5 | 2026-09-14 | File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory withou… |
CVE-2026-90927 | Medium | 6.5 | 2026-09-14 | filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buff… |
CVE-2026-90784 | Medium | 5.3 | 2026-09-14 | A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb_clear_parser of the file src/Compiler/semantics.c. The… |
CVE-2026-90716 | Medium | 5.5 | 2026-09-14 | A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c o… |
CVE-2026-90715 | High | 7.3 | 2026-09-14 | A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity_json.c of the co… |
CVE-2026-90714 | Medium | 6.3 | 2026-09-14 | A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the com… |
CVE-2026-90713 | Low | 3.3 | 2026-09-14 | A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/sr… |
CVE-2026-78336 | High | 7.5 | 2026-09-14 | Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers… |
CVE-2026-78330 | Critical | 9.8 | 2026-09-14 | Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least prot… |
CVE-2026-78318 | Medium | 6.1 | 2026-09-14 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope. The notification message, as optionall… |
CVE-2026-78299 | Critical | 9.1 | 2026-09-14 | In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations o… |
CVE-2026-77883 | Medium | 4.9 | 2026-09-14 | Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can cr… |
CVE-2026-77181 | Critical | 9.8 | 2026-09-14 | Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, wh… |
CVE-2026-77147 | Medium | 6.5 | 2026-09-14 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can… |
CVE-2026-77051 | Critical | 9.8 | 2026-09-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entit… |
CVE-2026-75030 | Critical | 9.8 | 2026-09-14 | Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass (de)provision group members… |
CVE-2026-75015 | Medium | 4.9 | 2026-09-14 | Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sen… |
CVE-2026-73668 | Critical | 9.8 | 2026-09-14 | Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the ful… |
CVE-2026-73579 | Critical | 9.8 | 2026-09-14 | Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, dependin… |
CVE-2026-73470 | Critical | 9.8 | 2026-09-14 | Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not f… |
CVE-2026-73178 | High | 7.5 | 2026-09-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can get access via RES… |
CVE-2026-12258 | | 2026-09-14 | Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number… | |
CVE-2026-90919 | Critical | 9.8 | 2026-09-14 | LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes th… |
CVE-2026-90712 | Medium | 4.3 | 2026-09-14 | A vulnerability was identified in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file src/services/api/xaiOAuthCallback.ts of… |
CVE-2026-90710 | High | 7.3 | 2026-09-14 | A vulnerability was determined in taisan tarzan-cms 1.0.0. This issue affects the function openConnection of the file com/tarzan/cms/modules/admin/service/biz/… |
CVE-2026-90709 | Medium | 4.7 | 2026-09-14 | A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the comp… |
CVE-2026-79701 | | 2026-09-14 | Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2… | |
CVE-2026-21391 | | 2026-09-14 | An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. I… | |
CVE-2026-9812 | Medium | 6.5 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified r… |
CVE-2026-90898 | Critical | 9.8 | 2026-09-14 | Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the clie… |
CVE-2026-90891 | Medium | 5.5 | 2026-09-14 | ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authenticated local attackers can send a spe… |
CVE-2026-90890 | Medium | 5.5 | 2026-09-14 | ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. Authenticated local attackers can send… |
CVE-2026-90708 | High | 7.3 | 2026-09-14 | A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Hand… |
CVE-2026-90707 | High | 8.3 | 2026-09-14 | A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amf_nnrf_try_old_amf_discovery_fallback of the file src/amf/nnrf-handler.c… |
CVE-2026-90706 | Medium | 6.6 | 2026-09-14 | A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targe… |
CVE-2026-90705 | Medium | 6.6 | 2026-09-14 | A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Tab… |
CVE-2026-8821 | High | 7.1 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during play… |
CVE-2026-89180 | High | 7.5 | 2026-09-14 | EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands… |
CVE-2026-87802 | Critical | 9.1 | 2026-09-14 | Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an att… |
CVE-2026-87785 | Critical | 9.1 | 2026-09-14 | Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least… |
CVE-2026-87779 | High | 7.5 | 2026-09-14 | Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length (not 16/24/32 bytes) is configured, Sy… |
CVE-2026-86460 | Critical | 9.8 | 2026-09-14 | Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0… |
CVE-2026-82232 | Critical | 9.8 | 2026-09-14 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate entitle… |
CVE-2026-81566 | | 2026-09-14 | Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The add-to-menu routine invo… | |
CVE-2026-81565 | | 2026-09-14 | Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The folder request paramete… | |
CVE-2026-81564 | | 2026-09-14 | Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9… | |
CVE-2026-79700 | | 2026-09-14 | Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0 - The opti… | |
CVE-2026-78375 | | 2026-09-14 | Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 - plgContentSp… | |
CVE-2026-5132 | Medium | 6.5 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib… |
CVE-2026-20773 | | 2026-09-14 | A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative… | |
CVE-2026-15814 | Medium | 6.5 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding upload… |
CVE-2026-14344 | Medium | 4.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission which allows an una… |
CVE-2026-14259 | Medium | 4.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive… |
CVE-2026-13417 | Medium | 4.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block creatio… |
CVE-2026-12882 | Medium | 4.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing… |
CVE-2026-11993 | Medium | 4.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being proc… |
CVE-2026-10556 | Medium | 5.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notifica… |
CVE-2026-10542 | Medium | 5.0 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership which allows channel ma… |
CVE-2026-90895 | | 2026-09-14 | Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsi… | |
CVE-2026-90894 | High | 7.8 | 2026-09-14 | Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accept… |
CVE-2026-90893 | | 2026-09-14 | MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle we… | |
CVE-2026-90704 | Medium | 6.6 | 2026-09-14 | A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulati… |
CVE-2026-90703 | Critical | 9.1 | 2026-09-14 | A vulnerability has been found in D-Link DWR-M921 1.1.52. The affected element is the function system of the file /boafrm/formDiskCreateShare. Such manipulatio… |
CVE-2026-90702 | Critical | 9.1 | 2026-09-14 | A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partitio… |
CVE-2026-90701 | High | 7.3 | 2026-09-14 | A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is an unknown… |
CVE-2026-72524 | High | 8.8 | 2026-09-14 | Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized… |
CVE-2026-68570 | Medium | 6.5 | 2026-09-14 | Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read… |
CVE-2026-90700 | Medium | 6.3 | 2026-09-14 | A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_edit1.php. Su… |
CVE-2026-90699 | Critical | 9.9 | 2026-09-14 | A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation o… |
CVE-2026-90698 | Medium | 5.3 | 2026-09-14 | A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_tex… |
CVE-2026-90697 | Medium | 4.3 | 2026-09-14 | A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the… |
CVE-2026-90696 | Low | 3.5 | 2026-09-14 | A vulnerability was determined in SourceCodester Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /api/product… |
CVE-2026-89321 | Medium | 4.3 | 2026-09-14 | Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry becomes when opene… |
CVE-2026-88932 | Medium | 5.3 | 2026-09-14 | multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-uplo… |