CVE-2026-26xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
511 records · Page 4 of 6
- CVE-2026-26216: Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter 10.0 Critical
Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows
Updated manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code execution. The FastAPI endpoints /simple_execute/{method} and /execute/{method} deserialize attacker-controlled request bodies using pickle.loads() without validation. Although a nonce-based authorization check is intended to restrict ac
Updated- CVE-2026-26214: Xiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITM 9.1 Critical
Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuration). In GalaxyFDSClientImpl.createHttpClient(), the SDK configures Apache HttpClient with SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER, which accepts any valid TLS certificate regardless of hostname mismatch. Because HTTPS is enabled by defa
Updated - CVE-2026-26213: thingino-firmware api.cgi Unauthenticated Command Injection in Captive Portal 8.7 High
thingino-firmware versions up to the firmware-2026-03-16 release contains an unauthenticated os command injection vulnerability in the WiFi captive portal CGI script that allows remote attackers to execute arbitrary commands as root by injecting malicious code through unsanitized HTTP parameter names. Attackers can exploit the eval function in parse_query() and parse_post() functions to achieve re
Updated Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wp_handle_upload() that disables WordPress core's file type validation checks across all three file parameters in the process_uploaded_files() function. Attackers can
UpdatedEkushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that page: the content attribute of the description meta element, the title element, and the text of an h4 element in the page header. The h4 occurrence is parsed as markup, so HTML placed in the system name field is rendered a
UpdatedKTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve backend mode where the scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages using pickle.loads() without validation. Attackers can send a crafted pickle payload to the exposed ZMQ socket to execute arbitrary code on the server with
Updatedcbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding deeply nested CBOR structures. This vulnerability affects both the pure Python implementation and the C extension `_cbor2`. The C extension relies on Python's internal
Updated- CVE-2026-26208: ADB Explorer Vulnerable to Remote Code Execution via Insecure Deserialization 7.8 High
ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Execution. The application attempts to deserialize the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to Objects. This allows an attacker to supply a crafted JSON file containing a gadget chain (e.g., ObjectDataProvider) to ex
Updated Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `discourse-policy` plugin allows any authenticated user to interact with policies on posts they do not have permission to view. The `PolicyController` loads posts by ID without verifying the current user's access, enabling policy group members to accept/unaccept policies on posts in private catego
UpdatedWazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API brute-force protection for POST /security/user/authenticate can be bypassed by sending concurrent authentication requests. Although the configured threshold (max_login_attempts, default 50) is enforced correctly for sequential requests, a par
Updatedopa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes (`//`) as authority components, and therefore dropping them from the parsed path. This creates a path inter
UpdatedWazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occurs in GetAlertData, resulting in writing a NULL byte exactly 1 byte before the start of the buffer allocated by strdup. Due to unsigned integer underflow and pointer arithmetic wrapping, the write lands at offset -1 from the
UpdatedPJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contain
UpdatedPenpot is an open-source design tool for design and code collaboration. Prior to version 2.13.2, an authenticated user can read arbitrary files from the server by supplying a local file path (e.g. `/etc/passwd`) as a font data chunk in the `create-font-variant` RPC endpoint, resulting in the file contents being stored and retrievable as a "font" asset. This is an arbitrary file read vulnerability.
Updatedemp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 3.21.2, multiple shared maps are accessed without consistent synchronization across goroutines. Under concurrent activity, Go runtime can trigger `fatal error: concurrent map read and map write`, causing C2 process crash (availability loss). Version 3.21.2 fixes this issue.
UpdatedHDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an `h5` file parsed by HDF5 can trigger a write-based heap buffer overflow condition. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems. Real-world exploi
UpdatedHDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if `H5Iget_name` is invoked in a way where `size` can be forced to zero, and there is important data before the `name` buffer.
Updated- CVE-2026-26198: ormar is vulnerable to SQL Injection through aggregate functions min() and max() 9.8 Critical
Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into `sqlalchemy.text()` without any validation or sanitization. The `min()` and `max()` methods in the `QuerySet` class accept arbitrary string input as the column parameter. While `sum()` and `avg()` are par
Updated HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the full size of the datatype (`dt->shared->size`) separately from the number of elements (`dt->shared->u.
UpdatedGogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params like token and access_token, which can leak through logs, browser history, and referrers. This issue has been patched in version 0.14.2.
Updated- CVE-2026-26195: Gogs: Stored XSS in branch and wiki views through author and committer names 6.9 Medium
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls. This issue has been patched in version 0.14.2.
Updated Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been patched in version 0.14.2.
UpdatedOpen WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history allows setting the `embeds` property on a response message, the content of which is loaded into an iFrame with a sandbox that has `allow-scripts` and `allow-same-origin` set, ignoring the "iframe Sandbox Allow Same Origin" configuration. This e
UpdatedOpen WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.7.0, aanually modifying chat history allows setting the `html` property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponize
UpdatedFleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when an uninstall is triggered. When a software package (.pkg, .deb, .rpm, .exe, or .msi) is uploaded to Fleet, metadata is extracted from
UpdatedMilvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on
Updated- CVE-2026-26189: Trivy Action has a script injection via sourced env file in composite action 5.9 Medium
Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in `aquasecurity/trivy-action` versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting environment variables. The action writes `export VAR=<input>` lines to `trivy_envs.txt` based on user-supplied inputs and subsequently sources th
Updated Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. An authenticated, low-privilege user (able to create/edit forms) can inject arbitrary HTML/JS into the Craft Control Panel (CP) builder and integrations views. User-controlled form labels and integration metadata are rendered with dangerouslySetInnerHTML without sanitization, leading to stored XSS that executes when
UpdatedlakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage boundaries. The verifyRelPath function used strings.HasPrefix() to verify that requested paths fall within the configured storage directory. This check was
UpdatedFleet is open source device management software. A SQL injection vulnerability in versions prior to 4.80.1 allowed authenticated users to inject arbitrary SQL expressions via the `order_key` query parameter. Due to unsafe use of `goqu.I()` when constructing the `ORDER BY` clause, specially crafted input could escape identifier quoting and be interpreted as executable SQL. An authenticated attacker
UpdatedDirectus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1
UpdatedBuffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.
UpdatedImproper access control in Windows RPC API allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-26182: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 7.0 High
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Updated Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedDouble free in Windows Kernel allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-26178: Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability 8.8 High
Integer size truncation in Windows Advanced Rasterization Platform (WARP) allows an unauthorized attacker to elevate privileges locally.
Updated - CVE-2026-26177: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 7.0 High
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Updated - CVE-2026-26176: Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability 7.8 High
Heap-based buffer overflow in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to elevate privileges locally.
Updated Use of uninitialized resource in Windows Boot Manager allows an unauthorized attacker to bypass a security feature with a physical attack.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-26173: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 7.0 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Updated Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
UpdatedUncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.
UpdatedImproper input validation in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.
UpdatedBuffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally.
Updated- CVE-2026-26168: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 7.8 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Updated Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
UpdatedDouble free in Windows Shell allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Shell allows an authorized attacker to elevate privileges locally.
UpdatedImproper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
UpdatedDouble free in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedAccess of resource using incompatible type ('type confusion') in Windows OLE allows an authorized attacker to elevate privileges locally.
UpdatedUntrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
UpdatedMissing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally.
UpdatedMissing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally.
UpdatedA flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
UpdatedA flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.
UpdatedHeap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally.
UpdatedMicrosoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
UpdatedImproper input validation in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.
UpdatedOut-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.
UpdatedInsecure storage of sensitive information in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally.
UpdatedInsufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized attacker to perform spoofing over a network.
UpdatedServer-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.
UpdatedImproper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to perform spoofing over a network.
UpdatedExternal initialization of trusted variables or data stores in Azure Entra ID allows an unauthorized attacker to elevate privileges locally.
UpdatedImproper input validation in Azure Compute Gallery allows an authorized attacker to disclose information over a network.
UpdatedImproper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
UpdatedImproper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
UpdatedDeserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network.
UpdatedImproper authentication in Azure Arc allows an authorized attacker to elevate privileges locally.
UpdatedServer-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.
UpdatedServer-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.
UpdatedServer-side request forgery (ssrf) in Microsoft Exchange allows an authorized attacker to elevate privileges over a network.
UpdatedImproper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
Updated- CVE-2026-26135: Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability 9.6 Critical
Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network.
Updated Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.
UpdatedAI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
UpdatedUse after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedIncorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
UpdatedAllocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
UpdatedImproper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
UpdatedImproper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.
UpdatedPayment Orchestrator Service Elevation of Privilege Vulnerability
Updated- CVE-2026-26124: Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability 6.7 Medium
'.../...//' in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.
Updated Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally.
Updated- CVE-2026-26122: Microsoft ACI Confidential Containers Information Disclosure Vulnerability 6.5 Medium
Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose information over a network.
Updated Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network.
UpdatedServer-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to perform tampering over a network.
UpdatedImproper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
UpdatedServer-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.
UpdatedAuthentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.
UpdatedImproper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
UpdatedImproper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.
UpdatedDeserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Updated