96,609 indexed
CVECVE vulnerabilities
96,609 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 6,101–6,150 of 96,609 · page 123 of 1933
| ID | Title | Summary |
|---|---|---|
| CVE-2026-89236 | CVE-2026-89236 CVSS 8.6 | The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowi… |
| CVE-2026-89235 | CVE-2026-89235 CVSS 6.8 | The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticate… |
| CVE-2026-89234 | CVE-2026-89234 CVSS 8.6 | The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to ap… |
| CVE-2026-89232 | CVE-2026-89232 CVSS 8.6 | The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to… |
| CVE-2026-8922 | CVE-2026-8922 CVSS 5.4redhat | A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspec… |
| CVE-2026-89214 | CVE-2026-89214 CVSS 8.6 | The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenti… |
| CVE-2026-89213 | CVE-2026-89213 CVSS 8.6 | The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticate… |
| CVE-2026-89212 | CVE-2026-89212 CVSS 8.6 | A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The… |
| CVE-2026-8921 | CVE-2026-8921 | External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampere… |
| CVE-2026-89208 | CVE-2026-89208 CVSS 5.3 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PX… |
| CVE-2026-89207 | CVE-2026-89207 CVSS 6.5 | A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17). Affected devices… |
| CVE-2026-89206 | CVE-2026-89206 CVSS 6.3 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for … |
| CVE-2026-89205 | CVE-2026-89205 CVSS 6.3 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for … |
| CVE-2026-89204 | CVE-2026-89204 CVSS 5.4 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for … |
| CVE-2026-89203 | CVE-2026-89203 CVSS 4.3 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, … |
| CVE-2026-89202 | CVE-2026-89202 CVSS 6.5 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disco… |
| CVE-2026-89201 | CVE-2026-89201 CVSS 7.5 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or… |
| CVE-2026-89200 | CVE-2026-89200 CVSS 6.7 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Va… |
| CVE-2026-8920 | CVE-2026-8920 | Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to p… |
| CVE-2026-89199 | CVE-2026-89199 CVSS 8.8 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration it… |
| CVE-2026-89198 | CVE-2026-89198 CVSS 8.8 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware… |
| CVE-2026-89197 | CVE-2026-89197 CVSS 8.8 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field… |
| CVE-2026-89196 | CVE-2026-89196 CVSS 8.8 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names … |
| CVE-2026-89195 | CVE-2026-89195 CVSS 8.6 | The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthe… |
| CVE-2026-89193 | CVE-2026-89193 CVSS 7.5 | The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-defaul… |
| CVE-2026-89191 | CVE-2026-89191 CVSS 6.8 | Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without pr… |
| CVE-2026-89190 | CVE-2026-89190 CVSS 4.3 | The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request… |
| CVE-2026-8919 | CVE-2026-8919 | Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user t… |
| CVE-2026-89186 | CVE-2026-89186 | Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.… |
| CVE-2026-89182 | CVE-2026-89182 CVSS 5.4gitea | With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push opti… |
| CVE-2026-89180 | CVE-2026-89180 CVSS 7.5 | EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands … |
| CVE-2026-8918 | CVE-2026-8918 | A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system cras… |
| CVE-2026-89179 | CVE-2026-89179 CVSS 4.3 | WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerability. Unauthenticated attackers on the… |
| CVE-2026-89178 | CVE-2026-89178 CVSS 8.8 | WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same netwo… |
| CVE-2026-89177 | CVE-2026-89177 CVSS 8.8 | WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unau… |
| CVE-2026-89176 | CVE-2026-89176 CVSS 8.8 | WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the sa… |
| CVE-2026-89175 | CVE-2026-89175 CVSS 5.3 | Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can … |
| CVE-2026-89174 | CVE-2026-89174 CVSS 7.5 | Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers … |
| CVE-2026-89173 | CVE-2026-89173 CVSS 5.3 | Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enu… |
| CVE-2026-89172 | CVE-2026-89172 | Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052. This issue affects AN1044: through A… |
| CVE-2026-8917 | CVE-2026-8917 | Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific valu… |
| CVE-2026-89169 | CVE-2026-89169 | live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing. |
| CVE-2026-89162 | CVE-2026-89162 CVSS 2.9pcre | In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is… |
| CVE-2026-89161 | CVE-2026-89161 CVSS 7.4pcre | In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur. |
| CVE-2026-89160 | CVE-2026-89160 CVSS 3.7pcre | PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject. |
| CVE-2026-8916 | CVE-2026-8916 CVSS 6.1 | Out-of-bounds write vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects rlottie: before dcfde72eae1b0464dc0dd760aec00ada6… |
| CVE-2026-89158 | CVE-2026-89158 CVSS 6.5pcre | PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write. |
| CVE-2026-89157 | CVE-2026-89157 CVSS 5.7pcre | PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern. |
| CVE-2026-89156 | CVE-2026-89156 CVSS 2.9pcre | PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data. |
| CVE-2026-89155 | CVE-2026-89155 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |