CVE-2026-14193
DVP80ES300T with Improper Validation of Array Index Vulnerability
PUBLISHED
- Vendor
- deltaww
- Product
- DVP80ES300T
- Provider severity
- HIGH
- Conflicts
- 0
Data & Insights
CVE Explorer
Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Exact snapshot results
353,537 CVE records
CVE-2026-14191
An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated against that file's own TotalCount field but never against the actual size of RecItems. A crafted set of two or more .rev files can therefore write an attacker-controlled 32-bit value (the header's RevCRC
PUBLISHED
- Vendor
- RARLAB, RARLAB, RARLAB, RARLAB
- Product
- WinRAR, UnRAR, UnRAR.dll, RAR
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-14190
The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who triggers a crafted request.
PUBLISHED
- Vendor
- Unknown
- Product
- Sina Extension for Elementor
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-1419
A weakness has been identified in D-Link DCS700l 1.03.09. Affected is an unknown function of the file /setDayNightMode of the component Web Form Handler. Executing a manipulation of the argument LightSensorControl can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
PUBLISHED
- Vendor
- D-Link
- Product
- DCS700l
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2026-14189
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search.
PUBLISHED
- Vendor
- Unknown
- Product
- WPBot
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-14188
The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.
PUBLISHED
- Vendor
- Unknown
- Product
- Easy Appointments
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-14185
The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration.
PUBLISHED
- Vendor
- Unknown
- Product
- WPBot
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14184
The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as completed.
PUBLISHED
- Vendor
- Unknown
- Product
- Academy LMS
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14183
The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.
PUBLISHED
- Vendor
- Unknown
- Product
- Classified Listing
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14181
@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder to throw synchronously, and the exception escapes the middie normalize step and terminates the Node.js process. The bypass affects applications that call middie.run directly on the standalone engine API,
PUBLISHED
- Vendor
- @fastify/middie
- Product
- @fastify/middie
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-1418
A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gf_text_import_srt_bifs of the file src/scene_manager/text_to_bifs.c of the component SRT Subtitle Import. Such manipulation leads to out-of-bounds write. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 10c73b82cf0e367383d091db38566a0e4fe71772. It is best practice to apply a patch to resolve this issue.
PUBLISHED
- Vendor
- n/a
- Product
- GPAC
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2026-14178
openGauss 在处理带 NLS 参数的 to_timestamp 调用时，to_timestamp_with_fmt_nls() 会将 nls_fmt_str 保存到 u_sess->parser_cxt.nls_fmt_str。在 seqscan + sort 执行路径下，该字符串原本被分配在 SeqScan 的表达式上下文中；当 SeqScan 完成后，该内存上下文会被 reset，但后续结果输出阶段 timestamp_out() 仍会通过 CheckNlsFormat() 访问 u_sess->parser_cxt.nls_fmt_str，导致访问已释放内存。攻击者在具备数据库 SQL 执行权限的情况下，可构造特定 to_timestamp(..., ..., nlsparam) 查询触发 heap-use-after-free。在 ASan/Memcheck 环境下表现为数据库服务退出；在实际运行环境中可能造成后端进程异常退出，影响数据库服务可用性，形成拒绝服务风险。该问题在openGauss-server-7.0.0-RC1版本和openGauss-server-7.
PUBLISHED
- Vendor
- openGauss-server, openGauss-server, openGauss-server
- Product
- openGauss-server-7.0.0-RC1, openGauss-server-7.0.0-RC2, openGauss-server-7.0.0-RC3
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14172
Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.
PUBLISHED
- Vendor
- Rapid7, Rapid7, Rapid7
- Product
- InsightVM, Nexpose, Insight Agent
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-14171
An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability.
PUBLISHED
- Vendor
- ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT
- Product
- DVG-IRF3421, DVG-IRF3801, DVG-IRF1421, DVG-IRF3821, DVG-IRF1401, DVG-IRF3401
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-1417
A weakness has been identified in GPAC up to 2.4.0. Affected by this issue is the function dump_isom_rtp of the file applications/mp4box/filedump.c. This manipulation causes null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: f96bd57c3ccdcde4335a0be28cd3e8fe296993de. Applying a patch is the recommended action to fix this issue.
PUBLISHED
- Vendor
- n/a
- Product
- GPAC
- Provider severity
- LOW, MEDIUM
- Conflicts
- 2
CVE-2026-14169
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device.
PUBLISHED
- Vendor
- ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT
- Product
- DVG-IRF3401, DVG-IRF3821, DVG-IRF1401, DVG-IRF3801, DVG-IRF3421, DVG-IRF1421
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-14168
A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access.
PUBLISHED
- Vendor
- ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT
- Product
- DVG-IRF3821, DVG-IRF3801, DVG-IRF3421, DVG-IRF1421, DVG-IRF3401, DVG-IRF1401
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-14167
A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization.
PUBLISHED
- Vendor
- ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT, ads-tec Industrial IT
- Product
- DVG-IRF1421, DVG-IRF3821, DVG-IRF1401, DVG-IRF3401, DVG-IRF3421, DVG-IRF3801
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-14165
An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access data of other users without authorization.
PUBLISHED
- Vendor
- Dassault Systèmes
- Product
- Tuleap Enterprise Edition
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-14164
A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service
PUBLISHED
- Vendor
- Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
- Product
- Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Hardened Images
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-14162
Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation.
PUBLISHED
- Vendor
- Advantech
- Product
- Hospital Quering Management
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-14161
Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation.
PUBLISHED
- Vendor
- Advantech
- Product
- Hospital Queuing Management
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-14160
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Escargot allows Leveraging Race Conditions. This issue affects Escargot: bab3a5797557014ce3c2e28419a6310cfba90d0d.
PUBLISHED
- Vendor
- Samsung Open Source
- Product
- Escargot
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-1416
A security flaw has been discovered in GPAC up to 2.4.0. Affected by this vulnerability is the function DumpMovieInfo of the file applications/mp4box/filedump.c. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as d45c264c20addf0c1cc05124ede33f8ffa800e68. It is advisable to implement a patch to correct this issue.
PUBLISHED
- Vendor
- n/a
- Product
- GPAC
- Provider severity
- LOW, MEDIUM
- Conflicts
- 2
CVE-2026-14158
The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.52 via the widget_logic_visual_check_visibility function. This is due to missing capability check and nonce verification on the widget-logic-update-conditional-tags AJAX action combined with insufficient sanitization of the 'nwlv[cod-tag]' parameter before storage and subsequent use in an eval() call. This makes it possible for authenticated attackers, with subscriber-level
PUBLISHED
- Vendor
- totalbounty
- Product
- Widget Logic Visual
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-14156
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14155
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14154
Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14153
Inappropriate implementation in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14152
Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-14151
Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-14150
Insufficient validation of untrusted input in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-1415
A vulnerability was identified in GPAC up to 2.4.0. Affected is the function gf_media_export_webvtt_metadata of the file src/media_tools/media_export.c. The manipulation of the argument Name leads to null pointer dereference. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is af951b892dfbaaa38336ba2eba6d6a42c25810fd. To fix this issue, it is recommended to deploy a patch.
PUBLISHED
- Vendor
- n/a
- Product
- GPAC
- Provider severity
- LOW, MEDIUM
- Conflicts
- 2
CVE-2026-14149
Use after free in Audio in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-14148
Type Confusion in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-14147
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14146
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14145
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14144
Incorrect security UI in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14143
Incorrect security UI in Passwords in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14142
Inappropriate implementation in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14141
Incorrect security UI in Document Picture-in-Picture in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14140
Insufficient validation of untrusted input in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-1414
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the file /equipment/get_Information of the component HTTP POST Request Handler. Executing a manipulation of the argument fortEquipmentIp can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
PUBLISHED
- Vendor
- Sangfor
- Product
- Operation and Maintenance Security Management System
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2026-14139
Inappropriate implementation in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14138
Inappropriate implementation in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14137
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-14136
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-14135
Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-14134
Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1