98,920 indexed
CVECVE vulnerabilities
98,920 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 6,901–6,950 of 98,920 · page 139 of 1979
| ID | Title | Summary |
|---|---|---|
| CVE-2026-87970 | CVE-2026-87970 CVSS 4.7 | The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response tha… |
| CVE-2026-8797 | CVE-2026-8797 | An access control deficiency vulnerability exists in ExpressUpdate Agent for Windows. If a malicious user gains access to the product, arbitrary code could be … |
| CVE-2026-87969 | CVE-2026-87969 | An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands … |
| CVE-2026-87968 | CVE-2026-87968 CVSS 5.3 | The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or… |
| CVE-2026-87966 | CVE-2026-87966 CVSS 5.3 | The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpo… |
| CVE-2026-87965 | CVE-2026-87965 CVSS 4.8 | The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation ac… |
| CVE-2026-87963 | CVE-2026-87963 CVSS 8.6 | The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it be… |
| CVE-2026-87962 | CVE-2026-87962 CVSS 7.5 | t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from s… |
| CVE-2026-87961 | CVE-2026-87961 CVSS 7.1 | ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read_ID3_Header function due to a shadowed length para… |
| CVE-2026-8796 | CVE-2026-8796 CVSS 8.1 | Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input. In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_… |
| CVE-2026-87959 | CVE-2026-87959 CVSS 5.4 | The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with… |
| CVE-2026-87958 | CVE-2026-87958 CVSS 8.1ibm | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by… |
| CVE-2026-8795 | CVE-2026-8795 CVSS 7.8 | A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostname field in client_i… |
| CVE-2026-8794 | CVE-2026-8794 | PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to … |
| CVE-2026-87935 | CVE-2026-87935 CVSS 8.1 | The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler functio… |
| CVE-2026-87933 | CVE-2026-87933 CVSS 7.3 | A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulat… |
| CVE-2026-87931 | CVE-2026-87931 CVSS 9.6 | A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearable up to 20260707. Impacted is an unknown function of the co… |
| CVE-2026-87930 | CVE-2026-87930 CVSS 8.1 | MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. A… |
| CVE-2026-8793 | CVE-2026-8793 | PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vul… |
| CVE-2026-87929 | CVE-2026-87929 CVSS 9.8 | MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing un… |
| CVE-2026-87928 | CVE-2026-87928 CVSS 5.4 | MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload … |
| CVE-2026-87927 | CVE-2026-87927 CVSS 8.2 | MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to ex… |
| CVE-2026-87926 | CVE-2026-87926 CVSS 4.3 | A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the… |
| CVE-2026-87925 | CVE-2026-87925 CVSS 7.3 | A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function st… |
| CVE-2026-87924 | CVE-2026-87924 CVSS 6.5 | A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part… |
| CVE-2026-87923 | CVE-2026-87923 CVSS 4.3 | A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown f… |
| CVE-2026-87922 | CVE-2026-87922 CVSS 7.3 | A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is t… |
| CVE-2026-87921 | CVE-2026-87921 CVSS 7.3 | A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function update_record o… |
| CVE-2026-87920 | CVE-2026-87920 CVSS 7.2 | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to,… |
| CVE-2026-87919 | CVE-2026-87919 CVSS 4.9 | The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the… |
| CVE-2026-87918 | CVE-2026-87918 CVSS 5.3 | The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI prov… |
| CVE-2026-87917 | CVE-2026-87917 CVSS 6.1 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, a… |
| CVE-2026-87916 | CVE-2026-87916 CVSS 5.3 | The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenti… |
| CVE-2026-87915 | CVE-2026-87915 CVSS 7.2 | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scri… |
| CVE-2026-87913 | CVE-2026-87913 CVSS 5.9 | A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source … |
| CVE-2026-87912 | CVE-2026-87912 CVSS 5.9 | A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obt… |
| CVE-2026-87911 | CVE-2026-87911 CVSS 9.6 | An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an… |
| CVE-2026-87910 | CVE-2026-87910 | When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function i… |
| CVE-2026-8791 | CVE-2026-8791 CVSS 6.4 | The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and incl… |
| CVE-2026-87909 | CVE-2026-87909 CVSS 7.5 | The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insuffic… |
| CVE-2026-87908 | CVE-2026-87908 CVSS 7.5 | multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound… |
| CVE-2026-87907 | CVE-2026-87907 CVSS 5.3 | The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category r… |
| CVE-2026-87902 | WordPress Core Remote File Inclusion Vulnerability KEVCVSS 8.1WordPress | WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen r… |
| CVE-2026-87900 | CVE-2026-87900 | Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code acros… |
| CVE-2026-8790 | CVE-2026-8790 CVSS 6.1 | The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget in all version… |
| CVE-2026-87899 | CVE-2026-87899 | Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges. |
| CVE-2026-87898 | CVE-2026-87898 | OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges. |
| CVE-2026-87896 | CVE-2026-87896 CVSS 5.3 | The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent (staff) records,… |
| CVE-2026-87894 | CVE-2026-87894 CVSS 5.3 | The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation detai… |
| CVE-2026-87892 | CVE-2026-87892 CVSS 5.3 | The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing w… |