96,609 indexed

CVECVE vulnerabilities

96,609 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.

Showing 6,451–6,500 of 96,609 · page 130 of 1933

IDTitleSummary
CVE-2026-8849CVE-2026-8849Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation. This issue affects Connext Professional: from 7.6.0 befor…
CVE-2026-8848CVE-2026-8848
CVSS 7.2
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to authorization bypass i…
CVE-2026-88467CVE-2026-88467
CVSS 6.2
CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensiti…
CVE-2026-8843CVE-2026-8843
CVSS 6.5mongodb
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating …
CVE-2026-88424CVE-2026-88424
CVSS 9.8
FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability all…
CVE-2026-88421CVE-2026-88421
CVSS 7.5
Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog e…
CVE-2026-88420CVE-2026-88420
CVSS 5.4
A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers w…
CVE-2026-88419CVE-2026-88419
CVSS 8.8
An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows a…
CVE-2026-88418CVE-2026-88418
CVSS 8.8
CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin request, and it does not …
CVE-2026-88416CVE-2026-88416
CVSS 9.8
MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.
CVE-2026-88415CVE-2026-88415
CVSS 8.7
MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails` is excluded from the global XSS filter.
CVE-2026-88414CVE-2026-88414
CVSS 9.8
MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).
CVE-2026-88412CVE-2026-88412
CVSS 5.3
An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause a Denial of Service…
CVE-2026-88411CVE-2026-88411
CVSS 7.5
Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within t…
CVE-2026-88410CVE-2026-88410
CVSS 7.1
The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.
CVE-2026-8841CVE-2026-8841
CVSS 6.4
The Extra Settings for RocketChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rocketchat' shortcode's 'title' attribute in versi…
CVE-2026-88409CVE-2026-88409
CVSS 8.8
FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerab…
CVE-2026-88408CVE-2026-88408
CVSS 6.5
FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c). This vulnerability all…
CVE-2026-88407CVE-2026-88407
CVSS 7.5
An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers to cause a Denial o…
CVE-2026-88406CVE-2026-88406
CVSS 7.5
FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c). This vul…
CVE-2026-88405CVE-2026-88405
CVSS 9.8
A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.…
CVE-2026-88404CVE-2026-88404
CVSS 9.8
A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.…
CVE-2026-88403CVE-2026-88403
CVSS 6.5
A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted …
CVE-2026-88402CVE-2026-88402
CVSS 9.8
A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL s…
CVE-2026-8840CVE-2026-8840
CVSS 5.3
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This …
CVE-2026-88397CVE-2026-88397
CVSS 6.5
ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.
CVE-2026-88396CVE-2026-88396
CVSS 7.2
ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's ex…
CVE-2026-88395CVE-2026-88395
CVSS 9.8
GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.
CVE-2026-88394CVE-2026-88394
CVSS 7.5
WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from t…
CVE-2026-88393CVE-2026-88393
CVSS 9.8
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed …
CVE-2026-88392CVE-2026-88392
CVSS 7.5
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code.
CVE-2026-88391CVE-2026-88391
CVSS 9.8
Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console…
CVE-2026-88390CVE-2026-88390
CVSS 7.7
An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0) allows crafted JavaScript input containing an overlong tok…
CVE-2026-8839CVE-2026-8839
CVSS 5.3
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.…
CVE-2026-88389CVE-2026-88389
CVSS 6.2
Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Crafted raw/binary string input can cause…
CVE-2026-88388CVE-2026-88388
CVSS 7.5
Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. A remot…
CVE-2026-88387CVE-2026-88387
CVSS 5.5
LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially …
CVE-2026-88386CVE-2026-88386
CVSS 5.5
libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the fu…
CVE-2026-88385CVE-2026-88385
CVSS 6.5
Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocate…
CVE-2026-88384CVE-2026-88384
CVSS 5.5
OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with da…
CVE-2026-88383CVE-2026-88383
CVSS 6.2
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the…
CVE-2026-88382CVE-2026-88382
CVSS 7.5
hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser.
CVE-2026-8838CVE-2026-8838
CVSS 9.8
Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2.1.14 allows a rogue server or man-i…
CVE-2026-88378CVE-2026-88378
CVSS 9.8
QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().
CVE-2026-88377CVE-2026-88377
CVSS 6.2
Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom wit…
CVE-2026-88376CVE-2026-88376
CVSS 7.5
Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). A specially crafted MP4 file containing an avc…
CVE-2026-88373CVE-2026-88373
CVSS 7.5
libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit,…
CVE-2026-88372CVE-2026-88372
CVSS 7.5
libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files.
CVE-2026-88371CVE-2026-88371
CVSS 5.5
ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted Code 128 input, decode_…
CVE-2026-88370CVE-2026-88370
CVSS 5.3
libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache(). The bundled utility allo…
Sourced from NVD + CISA KEV + FIRST EPSS. Curated by Adam Lundqvist, Founder at SQUR.