96,609 indexed
CVECVE vulnerabilities
96,609 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 6,201–6,250 of 96,609 · page 125 of 1933
| ID | Title | Summary |
|---|---|---|
| CVE-2026-89078 | CVE-2026-89078 CVSS 9.9gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain co… |
| CVE-2026-8907 | CVE-2026-8907 CVSS 6.1 | The WP-Ultimate-Map plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1. This is due to missing nonce valida… |
| CVE-2026-89066 | CVE-2026-89066 CVSS 7.8 | Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attack… |
| CVE-2026-89065 | CVE-2026-89065 CVSS 7.1 | Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delet… |
| CVE-2026-89064 | CVE-2026-89064 CVSS 5.3 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This i… |
| CVE-2026-89063 | CVE-2026-89063 CVSS 7.5 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and… |
| CVE-2026-89060 | CVE-2026-89060 CVSS 7.7 | A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn config… |
| CVE-2026-89059 | CVE-2026-89059 CVSS 7.5 | A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensi… |
| CVE-2026-89058 | CVE-2026-89058 CVSS 7.4 | A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-A… |
| CVE-2026-89055 | CVE-2026-89055 CVSS 9.1 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to t… |
| CVE-2026-89054 | CVE-2026-89054 CVSS 8.2 | A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST A… |
| CVE-2026-89050 | CVE-2026-89050 CVSS 4.3 | The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an… |
| CVE-2026-8905 | CVE-2026-8905 CVSS 6.1 | The Osiris Signature Banner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing … |
| CVE-2026-89049 | CVE-2026-89049 CVSS 9.9 | A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Am… |
| CVE-2026-89047 | CVE-2026-89047 CVSS 6.1 | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and i… |
| CVE-2026-89046 | CVE-2026-89046 CVSS 8.2 | zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition … |
| CVE-2026-89045 | CVE-2026-89045 CVSS 4.0 | zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infi… |
| CVE-2026-89044 | CVE-2026-89044 CVSS 6.5netty | Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-En… |
| CVE-2026-89043 | CVE-2026-89043 CVSS 7.4 | passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent X… |
| CVE-2026-89042 | CVE-2026-89042 CVSS 9.1 | passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by… |
| CVE-2026-89040 | CVE-2026-89040 CVSS 9.8 | Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on th… |
| CVE-2026-8904 | CVE-2026-8904 CVSS 4.3 | The FastPicker, an order picker and order management system (oms) for WooCommerce on steroids plugin for WordPress is vulnerable to Cross-Site Request Forgery … |
| CVE-2026-89039 | CVE-2026-89039 CVSS 6.5 | A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of … |
| CVE-2026-89038 | CVE-2026-89038 CVSS 6.2 | Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to wri… |
| CVE-2026-89036 | CVE-2026-89036 CVSS 8.8 | Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute a… |
| CVE-2026-89034 | CVE-2026-89034 CVSS 6.5 | TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows a… |
| CVE-2026-89032 | CVE-2026-89032 CVSS 7.7 | BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other … |
| CVE-2026-89031 | CVE-2026-89031 CVSS 5.4 | Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_po… |
| CVE-2026-89030 | CVE-2026-89030 CVSS 4.3 | Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2s_search_… |
| CVE-2026-89029 | CVE-2026-89029 CVSS 4.3 | Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX ha… |
| CVE-2026-89028 | CVE-2026-89028 CVSS 7.5 | MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap… |
| CVE-2026-89027 | CVE-2026-89027 CVSS 6.5 | miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthen… |
| CVE-2026-89026 | CVE-2026-89026 CVSS 9.8 | The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index… |
| CVE-2026-89025 | CVE-2026-89025 CVSS 7.5 | Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of HTTP(S) content. A … |
| CVE-2026-89023 | CVE-2026-89023 CVSS 8.6 | ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthentic… |
| CVE-2026-89022 | CVE-2026-89022 CVSS 7.4 | BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as… |
| CVE-2026-89021 | CVE-2026-89021 CVSS 6.9 | MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files … |
| CVE-2026-89020 | CVE-2026-89020 CVSS 4.3 | MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder fun… |
| CVE-2026-8902 | CVE-2026-8902 CVSS 4.3 | The AJAX Report Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing o… |
| CVE-2026-89019 | CVE-2026-89019 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-89013 | CVE-2026-89013 CVSS 7.5 | Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document… |
| CVE-2026-89012 | CVE-2026-89012 CVSS 6.5 | Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers… |
| CVE-2026-89011 | CVE-2026-89011 CVSS 7.1 | isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute … |
| CVE-2026-89010 | CVE-2026-89010 CVSS 9.8 | WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote at… |
| CVE-2026-8901 | CVE-2026-8901 CVSS 7.2 | The Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin for WordPress is vulnerable to Stored Cross-Site Scripting v… |
| CVE-2026-89009 | CVE-2026-89009 CVSS 9.1 | WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote at… |
| CVE-2026-89008 | CVE-2026-89008 CVSS 2.7 | The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions… |
| CVE-2026-89007 | CVE-2026-89007 CVSS 2.7 | The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, a… |
| CVE-2026-89006 | CVE-2026-89006 CVSS 6.8 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with th… |
| CVE-2026-89005 | CVE-2026-89005 CVSS 6.8 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is e… |