96,609 indexed
CVECVE vulnerabilities
96,609 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 6,001–6,050 of 96,609 · page 121 of 1933
| ID | Title | Summary |
|---|---|---|
| CVE-2026-89438 | CVE-2026-89438 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical … |
| CVE-2026-89437 | CVE-2026-89437 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: int1092: Fix potential memory leak in sar_probe() The memory allocated for … |
| CVE-2026-89436 | CVE-2026-89436 CVSS 7.8 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] acpi_pcc_retrieve_bio… |
| CVE-2026-89430 | CVE-2026-89430 CVSS 8.1gitea | Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed t… |
| CVE-2026-89427 | CVE-2026-89427 CVSS 6.1 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to,… |
| CVE-2026-89426 | CVE-2026-89426 CVSS 8.8 | The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, … |
| CVE-2026-89425 | CVE-2026-89425 CVSS 7.5 | UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier char… |
| CVE-2026-89424 | CVE-2026-89424 CVSS 6.4 | The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, and including, 1.5.6… |
| CVE-2026-89422 | CVE-2026-89422 | Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended s… |
| CVE-2026-89420 | CVE-2026-89420 | Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charge… |
| CVE-2026-89418 | CVE-2026-89418 | google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START… |
| CVE-2026-89417 | CVE-2026-89417 CVSS 7.2 | The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comm… |
| CVE-2026-89413 | CVE-2026-89413 CVSS 8.1 | The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not proper… |
| CVE-2026-89412 | CVE-2026-89412 CVSS 7.2 | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory … |
| CVE-2026-89411 | CVE-2026-89411 CVSS 5.3 | The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauth… |
| CVE-2026-89407 | CVE-2026-89407 CVSS 7.5 | NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[… |
| CVE-2026-89406 | CVE-2026-89406 CVSS 7.5 | The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up … |
| CVE-2026-8940 | CVE-2026-8940 CVSS 4.3 | The WP Meta Sort Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or in… |
| CVE-2026-8937 | CVE-2026-8937 CVSS 4.3gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain co… |
| CVE-2026-8936 | CVE-2026-8936 | Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested directories on a bind-mounted host folder a… |
| CVE-2026-8935 | CVE-2026-8935 CVSS 9.8 | The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page… |
| CVE-2026-89334 | CVE-2026-89334 CVSS 6.5 | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to,… |
| CVE-2026-89333 | CVE-2026-89333 CVSS 6.5 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin… |
| CVE-2026-89332 | CVE-2026-89332 CVSS 5.5amazon | Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthentic… |
| CVE-2026-89331 | CVE-2026-89331 CVSS 5.3 | The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthe… |
| CVE-2026-89330 | CVE-2026-89330 CVSS 6.1 | The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cr… |
| CVE-2026-8933 | CVE-2026-8933 CVSS 7.8 | A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure… |
| CVE-2026-89329 | CVE-2026-89329 CVSS 6.2 | A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid commands… |
| CVE-2026-89328 | CVE-2026-89328 CVSS 3.8 | The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management… |
| CVE-2026-89327 | CVE-2026-89327 CVSS 3.8 | The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing an… |
| CVE-2026-89325 | CVE-2026-89325 CVSS 7.8 | An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary… |
| CVE-2026-89322 | CVE-2026-89322 CVSS 7.2 | Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated … |
| CVE-2026-89321 | CVE-2026-89321 CVSS 4.3 | Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry becomes when opene… |
| CVE-2026-8932 | CVE-2026-8932 CVSS 7.5haxx | libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keep… |
| CVE-2026-8931 | CVE-2026-8931 | A critical Remote Code Execution (RCE) vulnerability exists in Disig Web Signer versions 2.0.3 through 2.5.3. |
| CVE-2026-89309 | CVE-2026-89309 | Vulnerability in tbc. This issue affects tbc: before 1. |
| CVE-2026-89308 | CVE-2026-89308 | An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to execute arbitrary commands on the underlyin… |
| CVE-2026-89307 | CVE-2026-89307 | The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, e… |
| CVE-2026-89305 | CVE-2026-89305 CVSS 6.5 | The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to… |
| CVE-2026-89304 | CVE-2026-89304 CVSS 6.5 | The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to … |
| CVE-2026-89303 | CVE-2026-89303 CVSS 6.4 | The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticate… |
| CVE-2026-89302 | CVE-2026-89302 CVSS 8.6 | The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated … |
| CVE-2026-89301 | CVE-2026-89301 CVSS 7.5 | The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the p… |
| CVE-2026-89300 | CVE-2026-89300 CVSS 5.3 | The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbi… |
| CVE-2026-89299 | CVE-2026-89299 CVSS 8.6 | The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated use… |
| CVE-2026-89298 | CVE-2026-89298 CVSS 4.9 | A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user w… |
| CVE-2026-89297 | CVE-2026-89297 CVSS 8.6 | The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated u… |
| CVE-2026-89296 | CVE-2026-89296 CVSS 8.6 | The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated user… |
| CVE-2026-89294 | CVE-2026-89294 CVSS 7.5 | The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale… |
| CVE-2026-89290 | CVE-2026-89290 CVSS 3.5 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzami… |