31,509 indexed
CVECVE vulnerabilities
31,509 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 1,101–1,150 of 8,161 in High · page 23 of 164
| ID | Title | Summary |
|---|---|---|
| CVE-2026-40357 | CVE-2026-40357 CVSS 8.8 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
| CVE-2026-40352 | CVE-2026-40352 CVSS 8.8 | FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attack… |
| CVE-2026-40350 | CVE-2026-40350 CVSS 8.8 | Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-manageme… |
| CVE-2026-40349 | CVE-2026-40349 CVSS 8.8 | Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own accou… |
| CVE-2026-40344 | CVE-2026-40344 CVSS 8.2 | MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass… |
| CVE-2026-40321 | CVE-2026-40321 CVSS 8.0 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a sp… |
| CVE-2026-40318 | CVE-2026-40318 CVSS 8.5 | SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesys… |
| CVE-2026-40316 | CVE-2026-40316 CVSS 8.8 | OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Versions prior to 2.1.1 contain an… |
| CVE-2026-4030 | CVE-2026-4030 CVSS 8.1 | The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5… |
| CVE-2026-40291 | CVE-2026-40291 CVSS 8.8 | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api… |
| CVE-2026-40287 | CVE-2026-40287 CVSS 8.4 | PraisonAI is a multi-agent teams system. Versions 4.5.138 and below are vulnerable to arbitrary code execution through automatic, unsanitized import of a tools… |
| CVE-2026-40285 | CVE-2026-40285 CVSS 8.8 | WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in dao/memorando/UsuarioDAO.php. The cpf_usu… |
| CVE-2026-40262 | CVE-2026-40262 CVSS 8.7 | Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-… |
| CVE-2026-40261 | CVE-2026-40261 CVSS 8.8 | Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCode… |
| CVE-2026-40259 | CVE-2026-40259 CVSS 8.1 | SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, the /api/av/removeUnusedAttributeView endpoint is protected only by… |
| CVE-2026-40252 | CVE-2026-40252 CVSS 8.1 | FastGPT is an AI Agent building platform. Prior to 4.14.10.4, Broken Access Control vulnerability (IDOR/BOLA) allows any authenticated team to access and execu… |
| CVE-2026-40217 | CVE-2026-40217 CVSS 8.8 | LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI. |
| CVE-2026-4021 | CVE-2026-4021 CVSS 8.1 | The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, and including, 28.1… |
| CVE-2026-40200 | CVE-2026-40200 CVSS 8.1 | An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implem… |
| CVE-2026-40196 | CVE-2026-40196 CVSS 8.1 | HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned t… |
| CVE-2026-40193 | CVE-2026-40193 CVSS 8.2 | maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied user… |
| CVE-2026-40172 | CVE-2026-40172 CVSS 8.1 | authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, the PATCH /api/v3/core/users/{pk}/ API allows … |
| CVE-2026-40168 | CVE-2026-40168 CVSS 8.2 | Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the in… |
| CVE-2026-40165 | CVE-2026-40165 CVSS 8.7 | authentik is an open-source identity provider. Versions 2025.12.4 and prior, and versions 2026.2.0-rc1 through 2026.2.2 were vulnerable to Authentication Bypas… |
| CVE-2026-40163 | CVE-2026-40163 CVSS 8.2 | Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint … |
| CVE-2026-40157 | CVE-2026-40157 CVSS 8.8 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, cmd_unpack in the recipe CLI extracts .praison tar archives using raw tar.extract() without validati… |
| CVE-2026-40113 | CVE-2026-40113 CVSS 8.1 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argume… |
| CVE-2026-40111 | CVE-2026-40111 CVSS 8.8 | PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in praisonaiagents passes a user-controlled command string directly t… |
| CVE-2026-40104 | CVE-2026-40104 CVSS 8.2 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc-1, 17.0.0-rc-1 and 17.5.0-rc-1 and pri… |
| CVE-2026-40093 | CVE-2026-40093 CVSS 8.1 | nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp >=… |
| CVE-2026-4008 | CVE-2026-4008 CVSS 8.8 | A flaw has been found in Tenda W3 1.0.0.3(2204). This issue affects some unknown processing of the file /goform/wifiSSIDset of the component POST Parameter Han… |
| CVE-2026-40076 | CVE-2026-40076 CVSS 8.8 | OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the module upload end… |
| CVE-2026-40070 | CVE-2026-40070 CVSS 8.1 | BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.3.1 to before 0.8.2, BSV::Wallet::WalletClient#acquire_certificate persists certificate records to … |
| CVE-2026-4007 | CVE-2026-4007 CVSS 8.8 | A vulnerability was detected in Tenda W3 1.0.0.3(2204). This vulnerability affects unknown code of the file /goform/wifiSSIDget of the component POST Parameter… |
| CVE-2026-40068 | CVE-2026-40068 CVSS 8.8 | In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its contents. An… |
| CVE-2026-40066 | CVE-2026-40066 CVSS 8.8 | Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticate… |
| CVE-2026-40061 | CVE-2026-40061 CVSS 8.7 | When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated att… |
| CVE-2026-40040 | CVE-2026-40040 CVSS 8.8 | Pachno 1.0.6 contains an unrestricted file upload vulnerability that allows authenticated users to upload arbitrary file types by bypassing ineffective extensi… |
| CVE-2026-40033 | CVE-2026-40033 CVSS 8.8 | FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The … |
| CVE-2026-40022 | CVE-2026-40022 CVSS 8.2 | When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path su… |
| CVE-2026-39983 | CVE-2026-39983 CVSS 8.6 | basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high… |
| CVE-2026-39981 | CVE-2026-39981 CVSS 8.8 | AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to validate that resolved … |
| CVE-2026-39974 | CVE-2026-39974 CVSS 8.5 | n8n-MCP is a Model Context Protocol (MCP) server that provides AI assistants with comprehensive access to n8n node documentation, properties, and operations. P… |
| CVE-2026-39942 | CVE-2026-39942 CVSS 8.8 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled fil… |
| CVE-2026-39911 | CVE-2026-39911 CVSS 8.8 | Hashgraph Guardian through version 3.5.1, fixed in commit 45fbe2f, contains an unsandboxed JavaScript execution vulnerability in the Custom Logic policy block … |
| CVE-2026-39891 | CVE-2026-39891 CVSS 8.8 | PraisonAI is a multi-agent teams system. Prior to 4.5.115, the create_agent_centric_tools() function returns tools (like acp_create_file) that process file con… |
| CVE-2026-39884 | CVE-2026-39884 CVSS 8.1 | mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior contain an argument injection vulnerabilit… |
| CVE-2026-39866 | CVE-2026-39866 CVSS 8.8 | Lawnchair is a free, open-source home app for Android. Prior to commit fcba413f55dd47f8a3921445252849126c6266b2, command injection in release_update.yml workfl… |
| CVE-2026-39862 | CVE-2026-39862 CVSS 8.8 | Tophat is a mobile applications testing harness. Prior to 2.5.1, Tophat is affected by remote code execution via crafted tophat:// or http://localhost:29070 UR… |
| CVE-2026-39860 | CVE-2026-39860 CVSS 8.4 | Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix pr… |