96,609 indexed
CVECVE vulnerabilities
96,609 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 6,251–6,300 of 96,609 · page 126 of 1933
| ID | Title | Summary |
|---|---|---|
| CVE-2026-89004 | CVE-2026-89004 CVSS 2.7 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and… |
| CVE-2026-89003 | CVE-2026-89003 CVSS 4.1 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the respons… |
| CVE-2026-89002 | CVE-2026-89002 CVSS 6.8 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it… |
| CVE-2026-89001 | CVE-2026-89001 CVSS 4.9 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribu… |
| CVE-2026-89000 | CVE-2026-89000 CVSS 4.1 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL befor… |
| CVE-2026-8900 | CVE-2026-8900 CVSS 6.4 | The Simple SEO Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.2.8… |
| CVE-2026-88999 | CVE-2026-88999 CVSS 4.3 | The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not prope… |
| CVE-2026-88997 | CVE-2026-88997 CVSS 6.8 | The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute i… |
| CVE-2026-88996 | CVE-2026-88996 CVSS 6.1 | The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site… |
| CVE-2026-88995 | CVE-2026-88995 CVSS 5.3 | The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allo… |
| CVE-2026-88994 | CVE-2026-88994 CVSS 6.6 | The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at ren… |
| CVE-2026-88993 | CVE-2026-88993 CVSS 6.8 | The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing us… |
| CVE-2026-88978 | CVE-2026-88978 CVSS 4.3 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pk… |
| CVE-2026-88976 | CVE-2026-88976 CVSS 6.1 | Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deseri… |
| CVE-2026-88975 | CVE-2026-88975 CVSS 7.5 | Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses a frame’s 24-bit declared length but waits to bu… |
| CVE-2026-88974 | CVE-2026-88974 CVSS 5.4 | WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-… |
| CVE-2026-88964 | CVE-2026-88964 | An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or mem… |
| CVE-2026-88962 | CVE-2026-88962 CVSS 8.8langflow | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. |
| CVE-2026-8896 | CVE-2026-8896 CVSS 6.4 | The MIR blocks and shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute (and other attributes such as 'ready_… |
| CVE-2026-88959 | CVE-2026-88959 CVSS 8.8 | Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to creat… |
| CVE-2026-88956 | CVE-2026-88956 CVSS 6.8 | The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected a… |
| CVE-2026-88952 | CVE-2026-88952 | Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an … |
| CVE-2026-8895 | CVE-2026-8895 CVSS 6.4 | The kk blog card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blog-card' shortcode in all versions up to, and including,… |
| CVE-2026-88944 | CVE-2026-88944 CVSS 4.3 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. Th… |
| CVE-2026-88940 | CVE-2026-88940 CVSS 5.3 | knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories… |
| CVE-2026-88939 | CVE-2026-88939 CVSS 8.3 | knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. At… |
| CVE-2026-88938 | CVE-2026-88938 CVSS 6.5 | knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywher… |
| CVE-2026-88937 | CVE-2026-88937 CVSS 8.8 | knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitr… |
| CVE-2026-88932 | CVE-2026-88932 CVSS 5.3 | multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-uplo… |
| CVE-2026-88931 | CVE-2026-88931 CVSS 5.3 | The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing atta… |
| CVE-2026-88930 | CVE-2026-88930 CVSS 8.6 | The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not san… |
| CVE-2026-8893 | CVE-2026-8893 CVSS 6.4 | The Express Payment For Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the [stripe-express] shortcode in … |
| CVE-2026-88929 | CVE-2026-88929 CVSS 5.3 | The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its det… |
| CVE-2026-88926 | CVE-2026-88926 CVSS 8.6 | The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL s… |
| CVE-2026-88924 | CVE-2026-88924 CVSS 7.0 | A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the li… |
| CVE-2026-88922 | CVE-2026-88922 CVSS 6.7 | The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a craft… |
| CVE-2026-88921 | CVE-2026-88921 | MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references (attrib… |
| CVE-2026-88920 | CVE-2026-88920 CVSS 9.8apache | An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a craft… |
| CVE-2026-8892 | CVE-2026-8892 CVSS 6.4 | The CM Business Directory – Optimise and showcase local business plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Business Address Meta Fi… |
| CVE-2026-88916 | CVE-2026-88916 CVSS 6.8 | Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation. This issue affects UlakPDF: through 09092026. |
| CVE-2026-88915 | CVE-2026-88915 | Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = … |
| CVE-2026-88914 | CVE-2026-88914 CVSS 4.4 | A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an … |
| CVE-2026-88912 | CVE-2026-88912 CVSS 4.2 | The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and … |
| CVE-2026-88910 | CVE-2026-88910 CVSS 5.3 | The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently dele… |
| CVE-2026-88907 | CVE-2026-88907 CVSS 7.4 | Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026. |
| CVE-2026-88905 | CVE-2026-88905 CVSS 8.8 | The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before out… |
| CVE-2026-88904 | CVE-2026-88904 CVSS 8.8 | The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from… |
| CVE-2026-88903 | CVE-2026-88903 CVSS 8.8 | The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitt… |
| CVE-2026-8890 | CVE-2026-8890 CVSS 8.2 | code100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to impersonate arbitrary users by supplying a … |
| CVE-2026-88899 | CVE-2026-88899 CVSS 9.8 | knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can suppl… |