96,609 indexed
CVECVE vulnerabilities
96,609 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 6,051–6,100 of 96,609 · page 122 of 1933
| ID | Title | Summary |
|---|---|---|
| CVE-2026-89289 | CVE-2026-89289 CVSS 5.3 | The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated a… |
| CVE-2026-89287 | CVE-2026-89287 CVSS 8.6 | The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated … |
| CVE-2026-89285 | CVE-2026-89285 CVSS 8.6 | The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthe… |
| CVE-2026-89283 | CVE-2026-89283 CVSS 8.6 | The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an … |
| CVE-2026-89282 | CVE-2026-89282 CVSS 9.1 | The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default in… |
| CVE-2026-89281 | CVE-2026-89281 CVSS 8.4 | The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow… |
| CVE-2026-89279 | CVE-2026-89279 CVSS 6.5 | Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. Authtake allows Encryption Brute Forcing. This issue affects authtake: from v1.3 b… |
| CVE-2026-89278 | CVE-2026-89278 CVSS 5.3 | The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Expo… |
| CVE-2026-89277 | CVE-2026-89277 CVSS 5.5 | CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could… |
| CVE-2026-89276 | CVE-2026-89276 CVSS 9.9adobe | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code exec… |
| CVE-2026-89275 | CVE-2026-89275 CVSS 10.0adobe | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code exec… |
| CVE-2026-89274 | CVE-2026-89274 CVSS 9.1 | The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists … |
| CVE-2026-89271 | CVE-2026-89271 CVSS 5.3 | The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowin… |
| CVE-2026-8927 | CVE-2026-8927 CVSS 9.1haxx | When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication stat… |
| CVE-2026-89269 | CVE-2026-89269 CVSS 6.8 | The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, … |
| CVE-2026-89268 | CVE-2026-89268 CVSS 5.4 | QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attac… |
| CVE-2026-89267 | CVE-2026-89267 CVSS 4.3 | starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users t… |
| CVE-2026-89266 | CVE-2026-89266 CVSS 8.2 | stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. At… |
| CVE-2026-89265 | CVE-2026-89265 CVSS 4.3 | MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify ann… |
| CVE-2026-89264 | CVE-2026-89264 CVSS 4.3 | MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attribu… |
| CVE-2026-89263 | CVE-2026-89263 CVSS 5.3 | MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email no… |
| CVE-2026-89262 | CVE-2026-89262 CVSS 7.5 | MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields… |
| CVE-2026-89261 | CVE-2026-89261 CVSS 6.5 | MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, r… |
| CVE-2026-89260 | CVE-2026-89260 CVSS 7.5 | MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.inde… |
| CVE-2026-8926 | CVE-2026-8926 CVSS 9.1haxx | When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@exam… |
| CVE-2026-89259 | CVE-2026-89259 CVSS 9.8 | Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec… |
| CVE-2026-89258 | CVE-2026-89258 CVSS 6.3 | Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups… |
| CVE-2026-89257 | CVE-2026-89257 CVSS 5.4 | AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the… |
| CVE-2026-89256 | CVE-2026-89256 CVSS 8.7 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names … |
| CVE-2026-89255 | CVE-2026-89255 CVSS 8.7 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HT… |
| CVE-2026-89254 | CVE-2026-89254 CVSS 8.7 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the field… |
| CVE-2026-89253 | CVE-2026-89253 CVSS 8.7 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile fie… |
| CVE-2026-89252 | CVE-2026-89252 CVSS 6.5 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated use… |
| CVE-2026-89251 | CVE-2026-89251 CVSS 6.5 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.php, allowing logged-in users to submit… |
| CVE-2026-89250 | CVE-2026-89250 CVSS 7.5 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint tha… |
| CVE-2026-8925 | CVE-2026-8925 CVSS 9.8haxx | The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free(… |
| CVE-2026-89249 | CVE-2026-89249 CVSS 8.7 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied… |
| CVE-2026-89248 | CVE-2026-89248 CVSS 5.3 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebR… |
| CVE-2026-89247 | CVE-2026-89247 CVSS 6.1 | WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/AD_Server/VMAP.php, which is reach… |
| CVE-2026-89246 | CVE-2026-89246 CVSS 5.4 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that… |
| CVE-2026-89245 | CVE-2026-89245 CVSS 6.5 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attac… |
| CVE-2026-89244 | CVE-2026-89244 CVSS 6.1 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php… |
| CVE-2026-89243 | CVE-2026-89243 CVSS 8.1 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name() that fa… |
| CVE-2026-89242 | CVE-2026-89242 CVSS 7.2 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the _json_decode function that fetc… |
| CVE-2026-89241 | CVE-2026-89241 CVSS 6.1 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that cop… |
| CVE-2026-89240 | CVE-2026-89240 CVSS 6.1 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.… |
| CVE-2026-8924 | CVE-2026-8924 CVSS 9.1haxx | A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-… |
| CVE-2026-89239 | CVE-2026-89239 CVSS 6.1 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage() function … |
| CVE-2026-89238 | CVE-2026-89238 CVSS 9.1apache | WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality cove… |
| CVE-2026-89237 | CVE-2026-89237 CVSS 6.8 | The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated… |