96,609 indexed
CVECVE vulnerabilities
96,609 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 6,751–6,800 of 96,609 · page 136 of 1933
| ID | Title | Summary |
|---|---|---|
| CVE-2026-88007 | CVE-2026-88007 CVSS 9.1traefik | Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.A… |
| CVE-2026-88006 | CVE-2026-88006 CVSS 6.5openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issue… |
| CVE-2026-88005 | CVE-2026-88005 CVSS 6.5openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues… |
| CVE-2026-88004 | CVE-2026-88004 CVSS 7.4traefik | Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStr… |
| CVE-2026-88003 | CVE-2026-88003 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative… |
| CVE-2026-88002 | CVE-2026-88002 CVSS 6.5openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backe… |
| CVE-2026-88001 | CVE-2026-88001 CVSS 5.0openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETC… |
| CVE-2026-88000 | CVE-2026-88000 CVSS 6.5openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/{id}/messages/{message_id}… |
| CVE-2026-8800 | CVE-2026-8800 CVSS 2.7progress | Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 befo… |
| CVE-2026-87999 | CVE-2026-87999 CVSS 7.1openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retr… |
| CVE-2026-87998 | CVE-2026-87998 CVSS 7.1openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/{id}/delete in backend… |
| CVE-2026-87997 | CVE-2026-87997 CVSS 4.3openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/cha… |
| CVE-2026-87996 | CVE-2026-87996 CVSS 7.7openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/re… |
| CVE-2026-87995 | CVE-2026-87995 CVSS 8.7openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.sve… |
| CVE-2026-87994 | CVE-2026-87994 CVSS 4.3openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend… |
| CVE-2026-87993 | CVE-2026-87993 CVSS 7.7 | The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in templat… |
| CVE-2026-87988 | CVE-2026-87988 | An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allow… |
| CVE-2026-87987 | CVE-2026-87987 | An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments precedi… |
| CVE-2026-87986 | CVE-2026-87986 | An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot inte… |
| CVE-2026-87985 | CVE-2026-87985 | An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments… |
| CVE-2026-87984 | CVE-2026-87984 | An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspac… |
| CVE-2026-87983 | CVE-2026-87983 | An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute pa… |
| CVE-2026-87981 | CVE-2026-87981 CVSS 4.7 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway con… |
| CVE-2026-87980 | CVE-2026-87980 CVSS 3.1 | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive informatio… |
| CVE-2026-8798 | CVE-2026-8798 | In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without an… |
| CVE-2026-87979 | CVE-2026-87979 CVSS 5.3 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unaut… |
| CVE-2026-87978 | CVE-2026-87978 CVSS 5.3 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated … |
| CVE-2026-87976 | CVE-2026-87976 CVSS 8.1apache | Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates… |
| CVE-2026-87975 | CVE-2026-87975 CVSS 4.3 | An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseModelFormSet.save_existing_objects()` use… |
| CVE-2026-87973 | CVE-2026-87973 CVSS 3.1 | The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics pag… |
| CVE-2026-87971 | CVE-2026-87971 CVSS 7.1 | The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an a… |
| CVE-2026-87970 | CVE-2026-87970 CVSS 4.7 | The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response tha… |
| CVE-2026-8797 | CVE-2026-8797 | An access control deficiency vulnerability exists in ExpressUpdate Agent for Windows. If a malicious user gains access to the product, arbitrary code could be … |
| CVE-2026-87969 | CVE-2026-87969 | An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands … |
| CVE-2026-87966 | CVE-2026-87966 CVSS 5.3 | The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpo… |
| CVE-2026-87965 | CVE-2026-87965 CVSS 4.8 | The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation ac… |
| CVE-2026-87963 | CVE-2026-87963 CVSS 8.6 | The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it be… |
| CVE-2026-87962 | CVE-2026-87962 CVSS 7.5 | t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from s… |
| CVE-2026-87961 | CVE-2026-87961 CVSS 7.1 | ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read_ID3_Header function due to a shadowed length para… |
| CVE-2026-8796 | CVE-2026-8796 CVSS 8.1 | Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input. In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_… |
| CVE-2026-87959 | CVE-2026-87959 CVSS 5.4 | The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with… |
| CVE-2026-87958 | CVE-2026-87958 CVSS 8.1ibm | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by… |
| CVE-2026-8795 | CVE-2026-8795 CVSS 7.8 | A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostname field in client_i… |
| CVE-2026-8794 | CVE-2026-8794 | PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to … |
| CVE-2026-87935 | CVE-2026-87935 CVSS 8.1 | The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler functio… |
| CVE-2026-87933 | CVE-2026-87933 CVSS 7.3 | A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulat… |
| CVE-2026-87931 | CVE-2026-87931 CVSS 9.6 | A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearable up to 20260707. Impacted is an unknown function of the co… |
| CVE-2026-87930 | CVE-2026-87930 CVSS 8.1 | MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. A… |
| CVE-2026-8793 | CVE-2026-8793 | PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vul… |
| CVE-2026-87929 | CVE-2026-87929 CVSS 9.8 | MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing un… |