98,920 indexed
CVECVE vulnerabilities
98,920 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 6,851–6,900 of 98,920 · page 138 of 1979
| ID | Title | Summary |
|---|---|---|
| CVE-2026-88025 | CVE-2026-88025 CVSS 8.3mongodb | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file id… |
| CVE-2026-88024 | CVE-2026-88024 CVSS 8.3mongodb | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file … |
| CVE-2026-88023 | CVE-2026-88023 CVSS 8.3mongodb | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file … |
| CVE-2026-88022 | CVE-2026-88022 CVSS 7.7mongodb | Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filt… |
| CVE-2026-88021 | CVE-2026-88021 CVSS 7.1 | Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not au… |
| CVE-2026-88020 | CVE-2026-88020 CVSS 6.1 | Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to rout… |
| CVE-2026-88018 | CVE-2026-88018 CVSS 9.8rclone | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with … |
| CVE-2026-88017 | CVE-2026-88017 CVSS 7.3rclone | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driv… |
| CVE-2026-88016 | CVE-2026-88016 CVSS 7.1rclone | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --l… |
| CVE-2026-88015 | CVE-2026-88015 CVSS 5.3rclone | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or li… |
| CVE-2026-88014 | CVE-2026-88014 CVSS 6.3rclone | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend… |
| CVE-2026-88013 | CVE-2026-88013 CVSS 3.7rclone | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attach… |
| CVE-2026-88012 | CVE-2026-88012 CVSS 5.3traefik | Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.res… |
| CVE-2026-88011 | CVE-2026-88011 CVSS 8.1traefik | Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Auth… |
| CVE-2026-88010 | CVE-2026-88010 | Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.go constructs the Ba… |
| CVE-2026-8801 | CVE-2026-8801 CVSS 3.5progress | Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2… |
| CVE-2026-88009 | CVE-2026-88009 CVSS 8.2traefik | Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores i… |
| CVE-2026-88008 | CVE-2026-88008 CVSS 9.1traefik | Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header req… |
| CVE-2026-88007 | CVE-2026-88007 CVSS 9.1traefik | Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.A… |
| CVE-2026-88006 | CVE-2026-88006 CVSS 6.5openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issue… |
| CVE-2026-88005 | CVE-2026-88005 CVSS 6.5openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues… |
| CVE-2026-88004 | CVE-2026-88004 CVSS 7.4traefik | Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStr… |
| CVE-2026-88003 | CVE-2026-88003 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative… |
| CVE-2026-88002 | CVE-2026-88002 CVSS 6.5openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backe… |
| CVE-2026-88001 | CVE-2026-88001 CVSS 5.0openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETC… |
| CVE-2026-88000 | CVE-2026-88000 CVSS 6.5openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/{id}/messages/{message_id}… |
| CVE-2026-8800 | CVE-2026-8800 CVSS 2.7progress | Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 befo… |
| CVE-2026-87999 | CVE-2026-87999 CVSS 7.1openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retr… |
| CVE-2026-87998 | CVE-2026-87998 CVSS 7.1openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/{id}/delete in backend… |
| CVE-2026-87997 | CVE-2026-87997 CVSS 4.3openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/cha… |
| CVE-2026-87996 | CVE-2026-87996 CVSS 7.7openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/re… |
| CVE-2026-87995 | CVE-2026-87995 CVSS 8.7openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.sve… |
| CVE-2026-87994 | CVE-2026-87994 CVSS 4.3openwebui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend… |
| CVE-2026-87993 | CVE-2026-87993 CVSS 7.7 | The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in templat… |
| CVE-2026-87988 | CVE-2026-87988 | An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allow… |
| CVE-2026-87987 | CVE-2026-87987 | An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments precedi… |
| CVE-2026-87986 | CVE-2026-87986 | An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot inte… |
| CVE-2026-87985 | CVE-2026-87985 | An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments… |
| CVE-2026-87984 | CVE-2026-87984 | An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspac… |
| CVE-2026-87983 | CVE-2026-87983 | An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute pa… |
| CVE-2026-87981 | CVE-2026-87981 CVSS 4.7 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway con… |
| CVE-2026-87980 | CVE-2026-87980 CVSS 3.1 | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive informatio… |
| CVE-2026-8798 | CVE-2026-8798 | In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without an… |
| CVE-2026-87979 | CVE-2026-87979 CVSS 5.3 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unaut… |
| CVE-2026-87978 | CVE-2026-87978 CVSS 5.3 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated … |
| CVE-2026-87976 | CVE-2026-87976 CVSS 8.1apache | Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates… |
| CVE-2026-87975 | CVE-2026-87975 CVSS 4.3 | An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseModelFormSet.save_existing_objects()` use… |
| CVE-2026-87974 | CVE-2026-87974 CVSS 5.3 | The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its defa… |
| CVE-2026-87973 | CVE-2026-87973 CVSS 3.1 | The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics pag… |
| CVE-2026-87971 | CVE-2026-87971 CVSS 7.1 | The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an a… |