96,609 indexed
CVECVE vulnerabilities
96,609 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 6,151–6,200 of 96,609 · page 124 of 1933
| ID | Title | Summary |
|---|---|---|
| CVE-2026-89151 | CVE-2026-89151 CVSS 3.5 | Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature. |
| CVE-2026-8915 | CVE-2026-8915 CVSS 8.8samsung | Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 36f5fb58366a67b713c02f6fd985e924fcc09e… |
| CVE-2026-89148 | CVE-2026-89148 CVSS 5.4 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a *.json.php … |
| CVE-2026-89147 | CVE-2026-89147 CVSS 7.5 | Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read without ti… |
| CVE-2026-89146 | CVE-2026-89146 CVSS 7.5 | libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A m… |
| CVE-2026-89145 | CVE-2026-89145 CVSS 4.2 | Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependenci… |
| CVE-2026-89141 | CVE-2026-89141 CVSS 6.5 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and… |
| CVE-2026-89140 | CVE-2026-89140 | Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in … |
| CVE-2026-8914 | CVE-2026-8914 | In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eva… |
| CVE-2026-89139 | CVE-2026-89139 | Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose funct… |
| CVE-2026-89138 | CVE-2026-89138 CVSS 4.3 | The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not proper… |
| CVE-2026-89136 | CVE-2026-89136 | When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allo… |
| CVE-2026-89135 | CVE-2026-89135 CVSS 6.5wolfssl | A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sib… |
| CVE-2026-89134 | CVE-2026-89134 CVSS 9.1wolfssl | A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-a… |
| CVE-2026-89133 | CVE-2026-89133 CVSS 5.3wolfssl | wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when … |
| CVE-2026-8913 | CVE-2026-8913 | A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v5 due to improper neutralization of user-controlled input withi… |
| CVE-2026-89124 | CVE-2026-89124 CVSS 4.3 | Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an aut… |
| CVE-2026-89122 | CVE-2026-89122 CVSS 6.1 | SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link th… |
| CVE-2026-89121 | CVE-2026-89121 CVSS 4.7 | SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker… |
| CVE-2026-89120 | CVE-2026-89120 CVSS 7.1 | A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single t… |
| CVE-2026-89118 | CVE-2026-89118 CVSS 5.3 | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which lead… |
| CVE-2026-89117 | CVE-2026-89117 CVSS 6.1 | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server re… |
| CVE-2026-89116 | CVE-2026-89116 CVSS 5.9 | The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary … |
| CVE-2026-89113 | CVE-2026-89113 CVSS 8.8 | SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send… |
| CVE-2026-89112 | CVE-2026-89112 CVSS 6.5 | The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is s… |
| CVE-2026-89111 | CVE-2026-89111 CVSS 10.0 | The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain param… |
| CVE-2026-89110 | CVE-2026-89110 CVSS 9.9 | SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke in… |
| CVE-2026-89108 | CVE-2026-89108 CVSS 9.1 | SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker … |
| CVE-2026-89107 | CVE-2026-89107 CVSS 9.9 | SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-speci… |
| CVE-2026-89106 | CVE-2026-89106 CVSS 4.4 | SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that … |
| CVE-2026-89105 | CVE-2026-89105 CVSS 4.2 | The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potent… |
| CVE-2026-89102 | CVE-2026-89102 CVSS 6.5wolfssl | In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate … |
| CVE-2026-89100 | CVE-2026-89100 CVSS 6.1 | The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL Fragment in all versions up… |
| CVE-2026-8910 | CVE-2026-8910 CVSS 6.1 | The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or … |
| CVE-2026-89099 | CVE-2026-89099 CVSS 7.5mongodb | A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronizati… |
| CVE-2026-89097 | CVE-2026-89097 CVSS 4.3 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 vi… |
| CVE-2026-89094 | CVE-2026-89094 CVSS 9.9 | Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled. |
| CVE-2026-89093 | CVE-2026-89093 CVSS 5.3 | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all ver… |
| CVE-2026-89092 | CVE-2026-89092 CVSS 4.2 | The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS quer… |
| CVE-2026-89091 | CVE-2026-89091 CVSS 8.8 | A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lex… |
| CVE-2026-89090 | CVE-2026-89090 CVSS 5.9 | An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to te… |
| CVE-2026-8909 | CVE-2026-8909 CVSS 4.3 | The WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3. This is due to missing or incorrect no… |
| CVE-2026-89089 | CVE-2026-89089 CVSS 6.5 | A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authen… |
| CVE-2026-89087 | CVE-2026-89087 CVSS 7.3 | The cstruct package before 6.3.0 for OCaml mishandles indexes. |
| CVE-2026-89086 | CVE-2026-89086 CVSS 9.1 | In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the… |
| CVE-2026-89084 | CVE-2026-89084 | HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary fil… |
| CVE-2026-89083 | CVE-2026-89083 | HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary fil… |
| CVE-2026-89082 | CVE-2026-89082 | HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary fil… |
| CVE-2026-89081 | CVE-2026-89081 CVSS 6.1 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all ver… |
| CVE-2026-89080 | CVE-2026-89080 CVSS 7.5 | The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor en… |