CVEs from 2026

14,172 normalized CVEs published or assigned in this year.

Total
14,172
critical
critical 1,106
high
high 3,898
medium
medium 3,930
low
low 413
% Critical
7.8%
% with KEV
0.4%
% with exploit
0.4%

Top vendors

Top products

  • firepower_threat_defense 298
  • chrome 298
  • firepower_threat_defense_software 295
  • gcp 221
  • openclaw 166
  • commerce 104
  • commerce_b2b 89
  • magento 74
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2026-6633 low 3.5 3.5 1mo ago A security flaw has been discovered in Yifang CMS up to 2.0.5. The impacted element is the function store of the file plugins/yifang_backend_account/logic/admin/L_rbac_admin.php of the component Exte…
CVE-2026-6619 low 3.5 3.5 1mo ago A vulnerability has been found in langgenius dify up to 1.13.3. Impacted is the function openInNewTab of the file web/app/components/base/image-uploader/image-preview.tsx of the component ImagePrevie…
CVE-2026-6600 low 3.5 3.5 1mo ago A flaw has been found in langflow-ai langflow up to 1.8.3. This affects an unknown function of the file src/frontend/src/modals/IOModal/components/chatView/chatMessage/components/edit-message.tsx of …
CVE-2026-6593 low 3.5 3.5 1mo ago A vulnerability was found in ComfyUI up to 0.13.0. Affected by this issue is some unknown functionality of the file server.py of the component View Endpoint. Performing a manipulation results in cros…
CVE-2026-6592 low 3.5 3.5 1mo ago A vulnerability has been found in ComfyUI up to 0.13.0. Affected by this vulnerability is the function getuserdata of the file app/user_manager.py of the component userdata Endpoint. Such manipulatio…
CVE-2026-6493 low 3.5 3.5 1mo ago A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/reset-password-form.tsx of the component…
CVE-2026-6486 low 3.5 3.5 1mo ago A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layout.php of the component User Display Name Handler. The manip…
CVE-2026-6216 low 3.5 3.5 1mo ago DbGate has cross site scripting via the SVG Icon String Handler component npm
CVE-2026-6162 low 3.5 3.5 2mo ago A vulnerability has been found in PHPGurukul Company Visitor Management System 2.0. This impacts an unknown function of the file /bwdates-reports-details.php. The manipulation of the argument fromdat…
CVE-2026-6106 low 3.5 3.5 2mo ago A vulnerability was detected in 1Panel-dev MaxKB up to 2.2.1. This vulnerability affects the function StaticHeadersMiddleware of the file apps/common/middleware/static_headers_middleware.py of the co…
CVE-2026-5810 low 3.5 3.5 2mo ago A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /delete.php of the component GET Parameter Handler. This manipulation of the argume…
CVE-2026-5806 low 3.5 3.5 2mo ago A security vulnerability has been detected in code-projects Easy Blog Site 1.0. This affects an unknown function of the file /posts/update.php. The manipulation of the argument postTitle leads to cro…
CVE-2026-35679 low 3.5 3.5 2mo ago Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool. It was someti…
CVE-2026-5568 low 3.5 3.5 2mo ago A vulnerability has been found in Akaunting up to 3.1.21. This issue affects some unknown processing of the component Invoice/Billing. The manipulation of the argument notes leads to cross site scrip…
CVE-2026-5370 low 3.5 3.5 2mo ago Krayin CRM is vulnerable to Cross-site Scripting (XSS) php
CVE-2026-5325 low 3.5 3.5 2mo ago A vulnerability was determined in SourceCodester Simple Customer Relationship Management System 1.0. This issue affects some unknown processing of the file /create-ticket.php of the component Create …
CVE-2026-5254 low 3.5 3.5 2mo ago A security vulnerability has been detected in welovemedia FFmate up to 2.0.15. Affected by this issue is some unknown functionality of the file /ui/app/components/AppJsonTreeView.vue of the component…
CVE-2026-5253 low 3.5 3.5 2mo ago A weakness has been identified in bufanyun HotGo 1.0/2.0. Affected by this vulnerability is an unknown functionality of the file /web/src/layout/components/Header/MessageList.vue of the component edi…
CVE-2026-5252 low 3.5 3.5 2mo ago A security flaw has been discovered in z-9527 admin 1.0/2.0. Affected is an unknown function of the file /server/routes/message.js of the component Message Create Endpoint. Performing a manipulation …
CVE-2026-5249 low 3.5 3.5 2mo ago A vulnerability was found in gougucms 4.08.18. This impacts an unknown function of the file \gougucms-master\app\admin\view\user\record.html of the component Record Endpoint. Performing a manipulatio…
CVE-2026-4995 low 3.5 3.5 2mo ago A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/public/annotator/index.html of the component Window Message E…
CVE-2026-4994 low 3.5 3.5 2mo ago A vulnerability was found in wandb OpenUI up to 1.0/3.5-turb. Affected is the function generic_exception_handler of the file backend/openui/server.py of the component APIStatusError Handler. The mani…
CVE-2026-4973 low 3.5 3.5 2mo ago A vulnerability was detected in SourceCodester Online Quiz System up to 1.0. Affected by this vulnerability is an unknown functionality of the file endpoint/add-question.php. Performing a manipulatio…
CVE-2026-4969 low 3.5 3.5 2mo ago A vulnerability was identified in code-projects Social Networking Site 1.0. The impacted element is an unknown function of the file /home.php of the component Alert Handler. The manipulation of the a…
CVE-2026-32984 low 3.5 3.5 2mo ago Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. Attackers can exploit this vulne…
CVE-2026-4835 low 3.5 3.5 2mo ago A security vulnerability has been detected in code-projects Accounting System 1.0. Impacted is an unknown function of the file /my_account/add_costumer.php of the component Web Application Interface.…
CVE-2026-4495 low 3.5 3.5 2mo ago A security flaw has been discovered in atjiu pybbs 6.0.0. This impacts the function create of the file src/main/java/co/yiiu/pybbs/controller/api/CommentApiController.java. The manipulation results i…
CVE-2026-4494 low 3.5 3.5 2mo ago A vulnerability was identified in atjiu pybbs 6.0.0. This affects the function create of the file src/main/java/co/yiiu/pybbs/controller/api/TopicApiController.java. The manipulation leads to cross s…
CVE-2026-4355 low 3.5 3.5 2mo ago A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar_servidor_curso_lst.php of the component Endpoint. Performing a manipulation of …
CVE-2026-4354 low 3.5 3.5 2mo ago A vulnerability was identified in TRENDnet TEW-824DRU 1.010B01/1.04B01. The impacted element is the function sub_420A78 of the file apply_sec.cgi of the component Web Interface. Such manipulation of …
CVE-2026-4239 low 3.5 3.5 2mo ago A vulnerability was found in Lagom WHMCS Template up to 2.3.7. Impacted is an unknown function of the component Datatables. The manipulation results in improperly controlled modification of object pr…
CVE-2026-4186 low 3.5 3.5 2mo ago A vulnerability was determined in UEditor up to 1.4.3.2. This issue affects some unknown processing of the file php/controller.php?action=uploadimage of the component JSONP Callback Handler. This man…
CVE-2026-4166 low 3.5 3.5 2mo ago A vulnerability was found in Wavlink WL-NU516U1 240425. The impacted element is the function sub_404F68 of the file /cgi-bin/login.cgi. The manipulation of the argument homepage/hostname results in c…
CVE-2026-3984 low 3.5 3.5 3mo ago A weakness has been identified in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This vulnerability affects unknown code of the file save_up_athlete.php. This manipulation o…
CVE-2026-3983 low 3.5 3.5 3mo ago A security flaw has been discovered in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This affects an unknown part of the file save-games.php. The manipulation of the argume…
CVE-2026-3946 low 3.5 3.5 3mo ago A vulnerability was detected in PHPEMS 11.0. The affected element is an unknown function of the file /index.php?ask=app-ask. Performing a manipulation of the argument askcontent results in cross site…
CVE-2026-2825 low 3.5 3.5 3mo ago A vulnerability has been found in rachelos WeRSS we-mp-rss up to 1.4.8. This impacts the function fix_html of the file tools/fix.py of the component Article Module. The manipulation leads to cross si…
CVE-2026-2709 low 3.5 3.5 3mo ago A flaw has been found in busy up to 2.5.5. The affected element is an unknown function of the file source-code/busy-master/src/server/app.js of the component Callback Handler. Executing a manipulatio…
CVE-2026-1406 low 3.5 3.5 4mo ago A vulnerability was determined in lcg0124 BootDo up to 5ccd963c74058036b466e038cff37de4056c1600. Affected by this vulnerability is the function redirectToLogin of the file AccessControlFilter.java of…
CVE-2026-1161 low 3.5 3.5 4mo ago A vulnerability was detected in pbrong hrms 1.0.1. The affected element is the function UpdateRecruitmentById of the file /handler/recruitment.go. The manipulation results in cross site scripting. Th…
CVE-2026-1136 low 3.5 3.5 4mo ago A weakness has been identified in lcg0124 BootDo up to e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb. Affected is the function Save of the file /blog/bContent/save of the component ContentController. This…
CVE-2026-0824 low 3.5 3.5 5mo ago QuestDB UI's Web Console is Vulnerable to Cross-Site Scripting npm
CVE-2026-34685 low 3.4 3.4 15d ago Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier [NEEDS REVIEW: impact mismatch — ticket says 'Arbitrary file system write', CIA triad derives 'Sec…
CVE-2026-40131 low 3.4 3.4 16d ago SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user input without proper parameterization or prepared statements. Successful exploi…
CVE-2026-42195 low 3.4 3.4 19d ago draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAut…
CVE-2026-44405 low 3.4 3.4 22d ago Paramiko rsakey.py allows the SHA-1 algorithm susedebianpython
CVE-2026-9572 low 3.3 3.3 1d ago A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function Media_GetSample of the file src/isomedia/media.c of the component MP4Box. Such manipulation of t… debian
CVE-2026-9567 low 3.3 3.3 1d ago A security flaw has been discovered in GPAC up to 2.4.0. Affected is the function MergeFragment of the file src/isomedia/isom_intern.c of the component MP4Box. The manipulation results in null pointe… debian
CVE-2026-9530 low 3.3 3.3 2d ago A weakness has been identified in GNU LibreDWG up to 0.14. The impacted element is the function read_2004_compressed_section of the file src/decode.c of the component Dwgbmp Utility. Executing a mani…
CVE-2026-9529 low 3.3 3.3 2d ago A security flaw has been discovered in GNU LibreDWG up to 0.14. The affected element is the function match_BLOCK_HEADER of the file dwggrep.c of the component Dwggrep Utility. Performing a manipulati…
CVE-2026-9504 low 3.3 3.3 2d ago A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bou…
CVE-2026-9503 low 3.3 3.3 2d ago A security flaw has been discovered in GNU LibreDWG up to 0.14. This impacts the function dwg_next_entity of the file src/decode.c of the component DWG File Handler. The manipulation results in null …
CVE-2026-9501 low 3.3 3.3 2d ago A vulnerability was determined in GNU LibreDWG up to 0.14. The impacted element is the function decompress_R2004_section of the file src/decode.c of the component Dwgread Utility. Executing a manipul…
CVE-2026-39824 low 3.3 3.3 5d ago NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated strin… debiangolang
CVE-2026-47782 low 3.3 3.3 7d ago Android App "RoboForm Password Manager" provided by Siber Systems, Inc. handles Android intents without sufficient URL validation, user confirmation nor notification. If a URL to some malicious web p…
CVE-2026-33565 low 3.3 3.3 9d ago in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.
CVE-2026-28751 low 3.3 3.3 9d ago in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.
CVE-2026-27781 low 3.3 3.3 9d ago in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.
CVE-2026-25110 low 3.3 3.3 9d ago in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.
CVE-2026-0965 low 3.3 3.3 9d ago Moderate: libssh security update redhatdebiansuse
CVE-2026-47091 low 3.3 3.3 9d ago Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unvalidated transcript_path value via stdin…
CVE-2026-8770 low 3.3 3.3 10d ago A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulat…
CVE-2026-41611 low 3.3 3.3 15d ago Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally. windows
CVE-2026-20793 low 3.3 3.3 15d ago Unchecked return value for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an a… intel
CVE-2026-41530 low 3.3 3.3 16d ago The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic folder creation fe…
CVE-2026-28910 low 3.3 3.3 16d ago This issue was addressed with improved permissions checking. This issue is fixed in macOS Tahoe 26.4. A malicious app may be able to access arbitrary files. macos
CVE-2026-28957 low 3.3 3.3 17d ago An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to capt… macos
CVE-2026-32803 low 3.3 3.3 20d ago Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0 through 9.12.0.1 contains an Insufficient Logging vulnerability. A low privileg…
CVE-2026-41498 low 3.3 3.3 20d ago Kimai has Missing Object-Level Authorization in the Team API php
CVE-2026-7740 low 3.3 3.3 24d ago A security vulnerability has been detected in justdan96 tsMuxer up to 2.7.0. This issue affects the function VvcVpsUnit::setFPS of the file tsMuxer/vvc.cpp. Such manipulation of the argument track_id…
CVE-2026-7739 low 3.3 3.3 24d ago A weakness has been identified in justdan96 tsMuxer up to 2.7.0. This vulnerability affects the function HevcVpsUnit::setFPS of the file /AFLplusplus/tsMuxer_prev/tsMuxer/hevc.cpp. This manipulation …
CVE-2026-33448 low 3.3 3.3 27d ago CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.50. Attackers with control of a modified server can force the client to dump t… macos
CVE-2026-41357 low 3.3 3.3 1mo ago OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized process.env to child processes. Attackers can exploit this by leve…
CVE-2026-35379 low 3.3 3.3 1mo ago uutils coreutils has an Incorrect Provision of Specified Functionality Issue debianrust
CVE-2026-35378 low 3.3 3.3 1mo ago uutils coreutils has an Incorrect Short Circuit Evaluation Issue debianrust
CVE-2026-35375 low 3.3 3.3 1mo ago uutils coreutils has an Improper Handling of Unicode Encoding Issue debianrust
CVE-2026-35371 low 3.3 3.3 1mo ago uutils coreutils's User Interface (UI) Misrepresents Critical Information debianrust
CVE-2026-35344 low 3.3 3.3 1mo ago uutils coreutils has an Unchecked Return Value Issue debianrust
CVE-2026-35343 low 3.3 3.3 1mo ago uutils coreutils has an Issue With its Always-Incorrect Control Flow Implementation debianrust
CVE-2026-35342 low 3.3 3.3 1mo ago uutils coreutils' mktemp utility doesn't properly handle an empty TMPDIR environment variable debianrust
CVE-2026-40505 low 3.3 3.3 1mo ago MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious… debian
CVE-2026-6192 low 3.3 3.3 1mo ago A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. T… susedebian
CVE-2026-40228 low 3.3 3.3 2mo ago In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set. susedebian
CVE-2026-5037 low 3.3 3.3 2mo ago A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr c… susedebian
CVE-2026-4833 low 3.3 3.3 2mo ago A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled r… debian
CVE-2026-20684 low 3.3 3.3 2mo ago A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.4. An app may bypass Gatekeeper checks. macos
CVE-2026-4539 low 3.3 3.3 2mo ago A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular e… susedebianpython
CVE-2026-4159 low 3.3 3.3 2mo ago 1-byte OOB heap read in wc_PKCS7_DecodeEnvelopedData via zero-length encrypted content. A vulnerability existed in wolfSSL 5.8.4 and earlier, where a 1-byte out-of-bounds heap read in wc_PKCS7_Decode… debian
CVE-2026-4174 low 3.3 3.3 2mo ago A vulnerability has been found in Radare2 5.9.9. This issue affects the function walk_exports_trie of the file libr/bin/format/mach0/mach0.c of the component Mach-O File Parser. Such manipulation lea… debian
CVE-2026-4010 low 3.3 3.3 3mo ago A vulnerability was found in ThakeeNathees pocketlang up to cc73ca61b113d48ee130d837a7a8b145e41de5ce. The affected element is the function pkByteBufferAddString. The manipulation of the argument leng…
CVE-2026-4009 low 3.3 3.3 3mo ago A vulnerability has been found in jarikomppa soloud up to 20200207. Impacted is the function drwav_read_pcm_frames_s16__msadpcm in the library src/audiosource/wav/dr_wav.h of the component WAV File P…
CVE-2026-3950 low 3.3 3.3 3mo ago A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track::load of the file libheif/sequences/track.cc of the component stsz/stts. The manipulation leads to o… debiansuse
CVE-2026-3949 low 3.3 3.3 3mo ago A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing… debiansuse
CVE-2026-21791 low 3.3 3.3 3mo ago HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL
CVE-2026-3449 low 3.3 3.3 3mo ago @tootallnate/once vulnerable to Incorrect Control Flow Scoping susenpm
CVE-2026-3407 low 3.3 3.3 3mo ago A vulnerability was determined in YosysHQ yosys up to 0.62. This affects the function Yosys::RTLIL::Const::set of the file kernel/rtlil.h of the component BLIF File Parser. This manipulation causes h…
CVE-2026-2903 low 3.3 3.3 3mo ago A flaw has been found in skvadrik re2c up to 4.4. Impacted is the function check_and_merge_special_rules of the file src/parse/ast.cc. This manipulation causes null pointer dereference. The attack ca… susedebian
CVE-2026-2889 low 3.3 3.3 3mo ago A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation results in use after free. The attack is only… debian
CVE-2026-2642 low 3.3 3.3 3mo ago A security vulnerability has been detected in ggreer the_silver_searcher up to 2.2.0. The impacted element is the function search_stream of the file src/search.c. The manipulation leads to null point…
CVE-2026-2641 low 3.3 3.3 3mo ago A weakness has been identified in universal-ctags ctags up to 6.2.1. The affected element is the function parseExpression/parseExprList of the file parsers/v.c of the component V Language Parser. Exe… debian