96,609 indexed
CVECVE vulnerabilities
96,609 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 6,301–6,350 of 96,609 · page 127 of 1933
| ID | Title | Summary |
|---|---|---|
| CVE-2026-88898 | CVE-2026-88898 CVSS 6.5 | AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to… |
| CVE-2026-88897 | CVE-2026-88897 CVSS 5.9 | Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web … |
| CVE-2026-88896 | CVE-2026-88896 CVSS 5.3 | EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to int… |
| CVE-2026-88895 | CVE-2026-88895 CVSS 7.2 | CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived toke… |
| CVE-2026-88894 | CVE-2026-88894 CVSS 5.4snipeitapp | Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk,… |
| CVE-2026-88893 | CVE-2026-88893 CVSS 7.5 | OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated… |
| CVE-2026-88892 | CVE-2026-88892 CVSS 5.0 | In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard (apps/api/src/utils/s… |
| CVE-2026-88891 | CVE-2026-88891 CVSS 8.3 | OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and pub… |
| CVE-2026-88890 | CVE-2026-88890 CVSS 8.5 | OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers befo… |
| CVE-2026-8889 | CVE-2026-8889 CVSS 7.5securly | Version 3.0.7 of the Securly Chrome Extension uses deprecated SHA-1 hashing for IWF CSAM URL matching (25,020 hashes) and CIPA blocklist matching (12,352 hashe… |
| CVE-2026-88889 | CVE-2026-88889 CVSS 7.8 | Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifyi… |
| CVE-2026-88888 | CVE-2026-88888 CVSS 7.0 | Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization paramete… |
| CVE-2026-88887 | CVE-2026-88887 CVSS 8.6 | Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote regi… |
| CVE-2026-88886 | CVE-2026-88886 CVSS 7.8 | Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-ente… |
| CVE-2026-88885 | CVE-2026-88885 CVSS 7.0 | Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update comm… |
| CVE-2026-88884 | CVE-2026-88884 CVSS 5.8 | Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15… |
| CVE-2026-88883 | CVE-2026-88883 CVSS 7.7 | Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edit… |
| CVE-2026-88882 | CVE-2026-88882 CVSS 8.6 | Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterpr… |
| CVE-2026-88881 | CVE-2026-88881 CVSS 8.6 | Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub E… |
| CVE-2026-88880 | CVE-2026-88880 CVSS 8.6 | Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-b… |
| CVE-2026-8888 | CVE-2026-8888 CVSS 7.5securly | Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new R… |
| CVE-2026-88879 | CVE-2026-88879 CVSS 8.2traefik | Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on … |
| CVE-2026-88878 | CVE-2026-88878 CVSS 5.3traefik | Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transpor… |
| CVE-2026-88877 | CVE-2026-88877 CVSS 9.8traefik | Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry … |
| CVE-2026-88876 | CVE-2026-88876 CVSS 7.5 | AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unaut… |
| CVE-2026-88875 | CVE-2026-88875 CVSS 4.3 | AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video respons… |
| CVE-2026-88874 | CVE-2026-88874 CVSS 7.5 | AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream password check on the stats endpoint or … |
| CVE-2026-88873 | CVE-2026-88873 CVSS 7.1 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows… |
| CVE-2026-88872 | CVE-2026-88872 CVSS 7.1 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that al… |
| CVE-2026-88871 | CVE-2026-88871 CVSS 4.3 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request forgery vulnerability in the CustomizeUs… |
| CVE-2026-88870 | CVE-2026-88870 CVSS 7.1 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endp… |
| CVE-2026-88869 | CVE-2026-88869 CVSS 9.3 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the AD_Server plugin's log.php endpoint … |
| CVE-2026-88868 | CVE-2026-88868 CVSS 8.7 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and des… |
| CVE-2026-88867 | CVE-2026-88867 CVSS 8.7 | WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/cat… |
| CVE-2026-88866 | CVE-2026-88866 CVSS 8.7 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails … |
| CVE-2026-88865 | CVE-2026-88865 CVSS 8.1 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with … |
| CVE-2026-88864 | CVE-2026-88864 CVSS 9.1 | Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo ful… |
| CVE-2026-88863 | CVE-2026-88863 CVSS 8.1 | capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of… |
| CVE-2026-88862 | CVE-2026-88862 CVSS 8.8 | Capgo (capgo.app) backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg() in supabase/… |
| CVE-2026-88861 | CVE-2026-88861 CVSS 8.3 | Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization… |
| CVE-2026-88860 | CVE-2026-88860 CVSS 6.3 | Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can ret… |
| CVE-2026-88859 | CVE-2026-88859 CVSS 6.3 | A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. W… |
| CVE-2026-88857 | CVE-2026-88857 | Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions save… |
| CVE-2026-88856 | CVE-2026-88856 | Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions upda… |
| CVE-2026-88855 | CVE-2026-88855 | Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveGallery(… |
| CVE-2026-88854 | CVE-2026-88854 | Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and… |
| CVE-2026-88853 | CVE-2026-88853 | Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0 - Modals Pro intentionally supp… |
| CVE-2026-88852 | CVE-2026-88852 | Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11… |
| CVE-2026-8885 | CVE-2026-8885 CVSS 6.4 | The DeMomentSomTres Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'callout' shortcode in all versions up to, an… |
| CVE-2026-88848 | CVE-2026-88848 CVSS 4.2 | The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor th… |