96,609 indexed
CVECVE vulnerabilities
96,609 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 6,801–6,850 of 96,609 · page 137 of 1933
| ID | Title | Summary |
|---|---|---|
| CVE-2026-87928 | CVE-2026-87928 CVSS 5.4 | MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload … |
| CVE-2026-87927 | CVE-2026-87927 CVSS 8.2 | MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to ex… |
| CVE-2026-87926 | CVE-2026-87926 CVSS 4.3 | A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the… |
| CVE-2026-87925 | CVE-2026-87925 CVSS 7.3 | A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function st… |
| CVE-2026-87924 | CVE-2026-87924 CVSS 6.5 | A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part… |
| CVE-2026-87923 | CVE-2026-87923 CVSS 4.3 | A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown f… |
| CVE-2026-87922 | CVE-2026-87922 CVSS 7.3 | A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is t… |
| CVE-2026-87921 | CVE-2026-87921 CVSS 7.3 | A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function update_record o… |
| CVE-2026-87920 | CVE-2026-87920 CVSS 7.2 | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to,… |
| CVE-2026-87919 | CVE-2026-87919 CVSS 4.9 | The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the… |
| CVE-2026-87918 | CVE-2026-87918 CVSS 5.3 | The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI prov… |
| CVE-2026-87917 | CVE-2026-87917 CVSS 6.1 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, a… |
| CVE-2026-87916 | CVE-2026-87916 CVSS 5.3 | The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenti… |
| CVE-2026-87915 | CVE-2026-87915 CVSS 7.2 | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scri… |
| CVE-2026-87913 | CVE-2026-87913 CVSS 5.9 | A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source … |
| CVE-2026-87912 | CVE-2026-87912 CVSS 5.9 | A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obt… |
| CVE-2026-87911 | CVE-2026-87911 CVSS 9.6 | An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an… |
| CVE-2026-87910 | CVE-2026-87910 | When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function i… |
| CVE-2026-8791 | CVE-2026-8791 CVSS 6.4 | The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and incl… |
| CVE-2026-87909 | CVE-2026-87909 CVSS 7.5 | The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insuffic… |
| CVE-2026-87908 | CVE-2026-87908 CVSS 7.5 | multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound… |
| CVE-2026-87907 | CVE-2026-87907 CVSS 5.3 | The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category r… |
| CVE-2026-87902 | WordPress Core Remote File Inclusion Vulnerability KEVCVSS 8.1WordPress | WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen r… |
| CVE-2026-87900 | CVE-2026-87900 | Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code acros… |
| CVE-2026-8790 | CVE-2026-8790 CVSS 6.1 | The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget in all version… |
| CVE-2026-87899 | CVE-2026-87899 | Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges. |
| CVE-2026-87898 | CVE-2026-87898 | OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges. |
| CVE-2026-87896 | CVE-2026-87896 CVSS 5.3 | The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent (staff) records,… |
| CVE-2026-87894 | CVE-2026-87894 CVSS 5.3 | The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation detai… |
| CVE-2026-87892 | CVE-2026-87892 CVSS 5.3 | The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing w… |
| CVE-2026-87891 | CVE-2026-87891 CVSS 6.5 | The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing un… |
| CVE-2026-87890 | CVE-2026-87890 CVSS 5.3 | An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups all… |
| CVE-2026-8789 | CVE-2026-8789 CVSS 8.1 | The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification … |
| CVE-2026-87888 | CVE-2026-87888 CVSS 8.0 | The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the sub… |
| CVE-2026-87886 | Acronis Backup Incorrect Default Permissions Vulnerability KEVCVSS 7.8Acronis | Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalatio… |
| CVE-2026-8788 | CVE-2026-8788 CVSS 7.3 | Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The values from the set_add method were not checked for newlines, colons or pipe… |
| CVE-2026-87877 | CVE-2026-87877 CVSS 7.7 | zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers … |
| CVE-2026-87876 | CVE-2026-87876 CVSS 3.0 | Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attri… |
| CVE-2026-87875 | CVE-2026-87875 CVSS 4.3 | The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-o… |
| CVE-2026-87874 | CVE-2026-87874 CVSS 8.1 | A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON f… |
| CVE-2026-87872 | CVE-2026-87872 CVSS 6.8 | A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS cer… |
| CVE-2026-87870 | CVE-2026-87870 CVSS 6.4 | The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters (interval, format, emailTo) in al… |
| CVE-2026-87869 | CVE-2026-87869 CVSS 6.1 | The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, … |
| CVE-2026-87860 | CVE-2026-87860 CVSS 4.3 | The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attacke… |
| CVE-2026-87859 | CVE-2026-87859 CVSS 5.3 | morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, w… |
| CVE-2026-87858 | CVE-2026-87858 | Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only writ… |
| CVE-2026-87855 | CVE-2026-87855 CVSS 9.8 | The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() f… |
| CVE-2026-87854 | CVE-2026-87854 CVSS 5.3 | The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing un… |
| CVE-2026-87853 | CVE-2026-87853 CVSS 7.5 | A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the auth… |
| CVE-2026-87848 | CVE-2026-87848 CVSS 3.7 | The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticate… |