CVEs from 2026

13,840 normalized CVEs published or assigned in this year.

Total
13,840
critical
critical 1,207
high
high 4,497
medium
medium 4,324
low
low 469
% Critical
8.7%
% with KEV
0.4%
% with exploit
0.8%

Top vendors

Top products

  • chrome 503
  • firepower_threat_defense 298
  • firepower_threat_defense_software 295
  • gcp 229
  • openclaw 172
  • commerce 104
  • commerce_b2b 89
  • saml_sso_-_service_provider 77
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Flags OS Vendor Published Description
CVE-2026-30950 high 7.1 7.1 14d ago AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.6.36 through 0.6.50 are vulnerable to Authenticated Session Hijac…
CVE-2026-45242 high 7.1 7.1 14d ago Summarize contains a path traversal vulnerability
CVE-2026-6495 high 7.1 7.1 15d ago The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used again…
CVE-2026-44569 high 7.1 7.1 17d ago Open WebUI's Insecure Message Access Breaks Authorization
CVE-2026-45399 high 7.1 7.1 17d ago Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
CVE-2026-45349 high 7.1 7.1 17d ago Open WebUI has Broken Access Control for Completions API
CVE-2026-44556 high 7.1 7.1 17d ago Open WebUI's responses passthrough endpoint lacks access control authorization
CVE-2026-45037 high 7.1 7.1 17d ago Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without …
CVE-2026-44641 high 7.1 7.1 17d ago Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install
CVE-2026-45350 high 7.1 7.1 18d ago Open WebUI's chat completion API allows tool restrictions to be bypassed
CVE-2026-44637 high 7.1 7.1 18d ago libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a signed integer overflow in the SIXEL parser's image-buffer doubling loop can lead to an out-of-boun…
CVE-2026-44501 high 7.1 7.1 18d ago DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend (datahub-frontend-react) deserializes attacker-controlled Java objects from the REDIRECT_URL HTTP cookie during the…
CVE-2026-41935 high 7.1 7.1 18d ago Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite rec…
CVE-2026-46446 high 7.1 7.1 19d ago SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
CVE-2026-46445 high 7.1 7.1 19d ago SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
CVE-2026-32991 high 7.1 7.1 19d ago Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.
CVE-2026-44376 medium 6.1 7.1 19d ago CubeCart is an ecommerce software solution. Prior to 6.7.0, an unauthenticated Reflected XSS vulnerability exists in the CubeCart v6.x search feature. Due to a logic flaw in classes/catalogue.class.p…
CVE-2026-33377 high 7.1 7.1 19d ago An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
CVE-2026-42586 high 7.1 7.1 19d ago Netty Redis Codec Encoder has a CRLF Injection Issue
CVE-2026-44798 high 7.1 7.1 19d ago Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to add/change a GitRepository record could use the REST API to directly set the cu…
CVE-2026-45134 high 7.1 7.1 19d ago LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_promp…
CVE-2026-4609 high 7.1 7.1 19d ago The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the pm_invite_user function in all versions up t…
CVE-2026-5371 high 7.1 7.1 20d ago The MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability…
CVE-2026-45226 high 7.1 7.1 20d ago Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim workflow UUIDs without pro…
CVE-2026-44215 high 7.1 7.1 20d ago NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is …
CVE-2026-42446 high 7.1 7.1 20d ago NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-bounds read exists in the ZealFS filesystem image parser in NanaZip. The vulnerability is triggered …
CVE-2026-41102 high 7.1 7.1 20d ago Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.
CVE-2026-41101 high 7.1 7.1 20d ago Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.
CVE-2026-40401 high 7.1 7.1 20d ago Windows TCP/IP Denial of Service Vulnerability
CVE-2026-25789 high 7.1 7.1 21d ago Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user into selecting the modified firmware file…
CVE-2026-45430 high 7.1 7.1 21d ago The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.
CVE-2026-4887 high 7.1 7.1 21d ago Important: gimp security update
CVE-2026-45224 high 7.1 7.1 21d ago Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution
CVE-2026-2393 high 7.1 7.1 21d ago MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability
CVE-2026-45001 high 7.1 7.1 21d ago OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.apply endpoints that fails to protect operator-trusted settings including sandbox p…
CVE-2026-28941 high 7.1 7.1 22d ago The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Tahoe 26.5. Processing a maliciously crafted file may lead to a denial-o…
CVE-2026-44833 high 7.1 7.1 24d ago Snipe-IT has an open redirect vulnerability
CVE-2026-42339 high 7.1 7.1 24d ago QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0
CVE-2026-43453 high 7.1 7.1 24d ago In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() pipapo_drop() passes rulemap[i + 1].n to pipapo_unmap() …
CVE-2026-43450 high 7.1 7.1 24d ago In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() nfnl_cthelper_dump_table() has a 'goto restart' that ju…
CVE-2026-43449 high 7.1 7.1 24d ago In the Linux kernel, the following vulnerability has been resolved: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set dev->online_queues is a count incremented in nvme_init_queue. Thus, valid indi…
CVE-2026-43442 high 7.1 7.1 24d ago In the Linux kernel, the following vulnerability has been resolved: io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops When IORING_SETUP_SQE_MIXED is used without IORING_SETUP_NO_SQ…
CVE-2026-43427 high 7.1 7.1 24d ago In the Linux kernel, the following vulnerability has been resolved: usb: class: cdc-wdm: fix reordering issue in read code path Quoting the bug report: Due to compiler optimization or CPU out-of-o…
CVE-2026-43386 high 7.1 7.1 24d ago In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie The current code checks 'i + 5 < in_len' at the end o…
CVE-2026-43380 high 7.1 7.1 24d ago In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read The q54sj108a2_debugfs_read function suffers from a stack buffer ove…
CVE-2026-41576 high 7.1 7.1 24d ago Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible (no authentication required). User-supplied message text is passed through PHP's nl2br() function, wh…
CVE-2026-42261 high 7.1 7.1 25d ago PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From version 0.4.9 to before version 0.5.4, apps/web/src/routes/skills.ts exposes an authenticated endpoint POST /api/sk…
CVE-2026-41906 high 7.1 7.1 25d ago FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.214, the Change Customer modal correctly hides out-of-scope customers through the mailbox-filte…
CVE-2026-41554 high 7.1 7.1 25d ago Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricks Builder allows Reflected XSS. This issue affects Bricks Builder: from n/a through 1.9.2 t…
CVE-2026-41644 high 7.1 7.1 25d ago monetr: Server-side request forgery in Lunch Flow link creation and refresh
CVE-2026-44243 high 7.1 7.1 26d ago GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
CVE-2026-43281 high 7.1 7.1 26d ago In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Although it is guided that `#mbox-cells` must be at least 1, there…
CVE-2026-43280 high 7.1 7.1 26d ago In the Linux kernel, the following vulnerability has been resolved: drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise When user provides a bogus pat_index value through th…
CVE-2026-43241 high 7.1 7.1 26d ago In the Linux kernel, the following vulnerability has been resolved: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access Number of MW LUTs depends on NTB configuration and can be set to MAX_…
CVE-2026-43166 high 7.1 7.1 26d ago In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced plain identification for encoded extents Only plain data whose start position and on-disk physical length a…
CVE-2026-43141 high 7.1 7.1 26d ago In the Linux kernel, the following vulnerability has been resolved: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut Number of MW LUTs depends on NTB configuration and can be set to zero…
CVE-2026-43062 high 7.1 7.1 27d ago In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() l2cap_ecred_reconf_rsp() casts the incoming data to struct l2cap…
CVE-2026-4100 high 7.1 7.1 1mo ago The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to, and including, 3.6.5. This is due to mis…
CVE-2026-37535 high 7.1 7.1 1mo ago openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame receive handler, where the 4-bit payload length nibble is us…
CVE-2026-37532 high 7.1 7.1 1mo ago AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_length for a Single Frame is extracted fro…
CVE-2026-43052 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check tdls flag in ieee80211_tdls_oper When NL80211_TDLS_ENABLE_LINK is called, the code only checks if the stati…
CVE-2026-43042 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: mpls: add seqcount to protect the platform_label{,s} pair The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have a…
CVE-2026-43040 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak When processing Router…
CVE-2026-43028 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: ensure names are nul-terminated Reject names that lack a \0 character before feeding them to functions that …
CVE-2026-43006 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: reject zero-length fixed buffer import validate_fixed_range() admits buf_addr at the exact end of the registered r…
CVE-2026-43005 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: hwmon: (tps53679) Fix array access with zero-length block read i2c_smbus_read_block_data() can return 0, indicating a zero-length…
CVE-2026-42477 high 7.1 7.1 1mo ago A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows user-assisted attackers to cause a denial of service or …
CVE-2026-42476 high 7.1 7.1 1mo ago Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 exist in RWStl_Reader::ReadAscii because buffers returned by Standard_ReadL…
CVE-2026-31778 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix stack out-of-bounds read in init_card The loop creates a whitespace-stripped copy of the card shortname where `l…
CVE-2026-31774 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() sqe->len is __u32 but gets stored into sr->len which is int. When …
CVE-2026-31766 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate doorbell_offset in user queue creation amdgpu_userq_get_doorbell_index() passes the user-provided doorbell_o…
CVE-2026-31707 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate response sizes in ipc_validate_msg() ipc_validate_msg() computes the expected message size for each response type…
CVE-2026-31699 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed When retrieving the PEK CSR, don't attempt to copy the …
CVE-2026-31698 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed When retrieving the PDH cert, don't attempt to cop…
CVE-2026-31697 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed When retrieving the ID for the CPU, don't attempt to cop…
CVE-2026-41660 high 7.1 7.1 1mo ago Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP
CVE-2026-27105 high 7.1 7.1 1mo ago Dell/Alienware Purchased Apps, versions prior to 1.1.31.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could p…
CVE-2026-42652 high 7.1 7.1 1mo ago Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Reflected XSS.This issue affects User Regist…
CVE-2026-35155 high 7.1 7.1 1mo ago Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability. A race condition vulnerability exists that could allow an authenticated low‑privilege…
CVE-2026-42429 high 7.1 7.1 1mo ago OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`
CVE-2026-42428 high 7.1 7.1 1mo ago OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification
CVE-2026-41379 high 7.1 7.1 1mo ago OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send
CVE-2026-28747 high 7.1 7.1 1mo ago A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.
CVE-2026-5941 high 7.1 7.1 1mo ago Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memory writes and program crashes during inte…
CVE-2026-31679 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: openvswitch: validate MPLS set/set_masked payload length validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for …
CVE-2026-31674 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Reject rt match rules whose addrnr exceeds IP6T_RT_HOPS. rt_mt6() …
CVE-2026-31626 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Initialize le_tmp64 to zero in rtw_BIP_verify() to prevent using unin…
CVE-2026-31614 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: smb: client: fix off-by-8 bounds check in check_wsl_eas() The bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA n…
CVE-2026-31568 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: s390/mm: Add missing secure storage access fixups for donated memory There are special cases where secure storage access exceptio…
CVE-2026-41361 high 7.1 7.1 1mo ago OpenClaw before 2026.3.28 contains an SSRF guard bypass vulnerability that fails to block four IPv6 special-use ranges. Attackers can exploit this by crafting URLs targeting internal or non-routable …
CVE-2026-41347 high 7.1 7.1 1mo ago OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode
CVE-2026-6861 high 7.1 7.1 1mo ago A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG (Scalable Vector Graphics) CSS (Cascading Style Sheets) data. A local u…
CVE-2026-31486 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) Protect regulator operations with mutex The regulator operations pmbus_regulator_get_voltage(), pmbus_regulat…
CVE-2026-31484 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check __io_uring_show_fdinfo() iterates over pending SQEs and, for 128-byte SQEs …
CVE-2026-31470 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length Validate host controlled value `quote_buf->out_len` that d…
CVE-2026-6855 high 7.1 7.1 1mo ago InstructLab vulnerable to Path Traversal
CVE-2026-31430 high 7.1 7.1 1mo ago In the Linux kernel, the following vulnerability has been resolved: X.509: Fix out-of-bounds access when parsing extensions Leo reports an out-of-bounds access when parsing a certificate with empty…
CVE-2026-40917 high 7.1 7.1 2mo ago A flaw was found in GIMP. This vulnerability, a heap buffer over-read in the `icns_slurp()` function, occurs when processing specially crafted ICNS image files. An attacker could provide a malicious …
CVE-2026-32188 high 7.1 7.1 2mo ago Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVE-2026-26151 high 7.1 7.1 2mo ago Insufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized attacker to perform spoofing over a network.