96,609 indexed

CVECVE vulnerabilities

96,609 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.

Showing 6,401–6,450 of 96,609 · page 129 of 1933

IDTitleSummary
CVE-2026-88778CVE-2026-88778
CVSS 7.5citrix
Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, be…
CVE-2026-88777CVE-2026-88777
CVSS 9.8citrix
Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23…
CVE-2026-88776CVE-2026-88776
CVSS 9.8citrix
Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23,…
CVE-2026-88775CVE-2026-88775
CVSS 9.8citrix
Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-…
CVE-2026-88774CVE-2026-88774
CVSS 7.2citrix
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and …
CVE-2026-88773CVE-2026-88773
CVSS 10.0citrix
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issu…
CVE-2026-88772Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
KEVCVSS 8.1Citrix
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow fo…
CVE-2026-88771Citrix NetScaler Improper Input Validation Vulnerability
KEVCVSS 9.8Citrix
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary…
CVE-2026-88770CVE-2026-88770
CVSS 6.5
A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption …
CVE-2026-88765CVE-2026-88765
CVSS 8.5gitlab
GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions cou…
CVE-2026-88764CVE-2026-88764
CVSS 5.4
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level con…
CVE-2026-88763CVE-2026-88763
CVSS 5.9
A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. T…
CVE-2026-88761CVE-2026-88761
CVSS 5.3
The Botslab G980H dash camera firmware generates the default WiFi password using predictable device information, portions of which are advertised by the produc…
CVE-2026-8876CVE-2026-8876
CVSS 7.3securly
Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis alert keyword data and…
CVE-2026-88756CVE-2026-88756
CVSS 5.3
Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint (POST /u…
CVE-2026-88746CVE-2026-88746
CVSS 7.1
idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.
CVE-2026-88745CVE-2026-88745
CVSS 6.1
EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.
CVE-2026-88743CVE-2026-88743
CVSS 6.1
Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags.
CVE-2026-88742CVE-2026-88742
CVSS 5.4
Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field.
CVE-2026-8874CVE-2026-8874
CVSS 7.1securly
Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API…
CVE-2026-88738CVE-2026-88738
CVSS 8.8
Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An attacker with administr…
CVE-2026-8865CVE-2026-8865
CVSS 6.4
The Avalon23 Products Filter for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'avalon23_qr' shortcode in all versions …
CVE-2026-88648CVE-2026-88648Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and …
CVE-2026-88647CVE-2026-88647
CVSS 9.1
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafte…
CVE-2026-8864CVE-2026-8864The HP Fan Control App might allow local escalation of privileges. An updated version of HP Fan Control App has been released to mitigate this p…
CVE-2026-8863CVE-2026-8863
CVSS 7.8
Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the bo…
CVE-2026-88624CVE-2026-88624
CVSS 9.1
Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted …
CVE-2026-88623CVE-2026-88623
CVSS 7.5
NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen() is…
CVE-2026-88622CVE-2026-88622
CVSS 8.8
NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php.
CVE-2026-88621CVE-2026-88621
CVSS 2.7
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can …
CVE-2026-88620CVE-2026-88620
CVSS 4.3
SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enf…
CVE-2026-8862CVE-2026-8862
CVSS 7.5ibm
IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the co…
CVE-2026-88619CVE-2026-88619
CVSS 8.1
1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes schedule…
CVE-2026-88618CVE-2026-88618
CVSS 6.5
1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arb…
CVE-2026-88617CVE-2026-88617
CVSS 9.8
SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges.
CVE-2026-88616CVE-2026-88616
CVSS 8.8
An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.comple…
CVE-2026-8861CVE-2026-8861
CVSS 5.3ibm
IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This inf…
CVE-2026-88593CVE-2026-88593
CVSS 6.1
kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent re…
CVE-2026-88592CVE-2026-88592
CVSS 9.1
kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter agai…
CVE-2026-8859CVE-2026-8859
CVSS 9.9langflow
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the…
CVE-2026-8858CVE-2026-8858
CVSS 7.5ibm
IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere We…
CVE-2026-8857CVE-2026-8857
CVSS 8.8mediawiki
A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This…
CVE-2026-8856CVE-2026-8856
CVSS 7.7ibm
IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.
CVE-2026-8855CVE-2026-8855
CVSS 8.1ibm
IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authenticati…
CVE-2026-8854CVE-2026-8854
CVSS 7.5ibm
IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache.
CVE-2026-8853CVE-2026-8853
CVSS 4.4
The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'memo' parameter in all versions up to, and including, 5.1.3 due to in…
CVE-2026-8852CVE-2026-8852
CVSS 6.2ibm
IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module.
CVE-2026-88514CVE-2026-88514
CVSS 5.5
An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.
CVE-2026-8851CVE-2026-8851
CVSS 8.1
SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to ex…
CVE-2026-8850CVE-2026-8850
CVSS 7.5ibm
IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.
Sourced from NVD + CISA KEV + FIRST EPSS. Curated by Adam Lundqvist, Founder at SQUR.