98,920 indexed
CVECVE vulnerabilities
98,920 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 6,951–7,000 of 98,920 · page 140 of 1979
| ID | Title | Summary |
|---|---|---|
| CVE-2026-87891 | CVE-2026-87891 CVSS 6.5 | The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing un… |
| CVE-2026-87890 | CVE-2026-87890 CVSS 5.3 | An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups all… |
| CVE-2026-8789 | CVE-2026-8789 CVSS 8.1 | The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification … |
| CVE-2026-87888 | CVE-2026-87888 CVSS 8.0 | The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the sub… |
| CVE-2026-87886 | Acronis Backup Incorrect Default Permissions Vulnerability KEVCVSS 7.8Acronis | Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalatio… |
| CVE-2026-8788 | CVE-2026-8788 CVSS 7.3 | Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The values from the set_add method were not checked for newlines, colons or pipe… |
| CVE-2026-87877 | CVE-2026-87877 CVSS 7.7 | zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers … |
| CVE-2026-87876 | CVE-2026-87876 CVSS 3.0 | Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attri… |
| CVE-2026-87875 | CVE-2026-87875 CVSS 4.3 | The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-o… |
| CVE-2026-87874 | CVE-2026-87874 CVSS 8.1 | A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON f… |
| CVE-2026-87872 | CVE-2026-87872 CVSS 6.8 | A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS cer… |
| CVE-2026-87870 | CVE-2026-87870 CVSS 6.4 | The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters (interval, format, emailTo) in al… |
| CVE-2026-87869 | CVE-2026-87869 CVSS 6.1 | The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, … |
| CVE-2026-87860 | CVE-2026-87860 CVSS 4.3 | The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attacke… |
| CVE-2026-8786 | CVE-2026-8786 CVSS 6.3tencent | A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/ha… |
| CVE-2026-87859 | CVE-2026-87859 CVSS 5.3 | morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, w… |
| CVE-2026-87858 | CVE-2026-87858 | Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only writ… |
| CVE-2026-87855 | CVE-2026-87855 CVSS 9.8 | The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() f… |
| CVE-2026-87854 | CVE-2026-87854 CVSS 5.3 | The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing un… |
| CVE-2026-87853 | CVE-2026-87853 CVSS 7.5 | A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the auth… |
| CVE-2026-87848 | CVE-2026-87848 CVSS 3.7 | The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticate… |
| CVE-2026-87846 | CVE-2026-87846 CVSS 5.3 | The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available… |
| CVE-2026-87843 | CVE-2026-87843 CVSS 6.5 | The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer re… |
| CVE-2026-87842 | CVE-2026-87842 CVSS 7.5 | The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allow… |
| CVE-2026-87841 | CVE-2026-87841 CVSS 5.3 | The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers … |
| CVE-2026-87840 | CVE-2026-87840 CVSS 5.3 | The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are addi… |
| CVE-2026-87839 | CVE-2026-87839 CVSS 7.5 | The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX act… |
| CVE-2026-87836 | CVE-2026-87836 CVSS 2.7 | The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to con… |
| CVE-2026-87831 | CVE-2026-87831 CVSS 4.3 | The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before de… |
| CVE-2026-87830 | CVE-2026-87830 CVSS 9.1apache | In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XM… |
| CVE-2026-87829 | CVE-2026-87829 CVSS 4.3 | The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before de… |
| CVE-2026-87828 | CVE-2026-87828 CVSS 5.7 | The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated… |
| CVE-2026-87827 | CVE-2026-87827 | Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A … |
| CVE-2026-87825 | CVE-2026-87825 CVSS 7.7 | zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing… |
| CVE-2026-87824 | CVE-2026-87824 CVSS 7.5 | zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supp… |
| CVE-2026-87823 | CVE-2026-87823 CVSS 8.2 | zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via neg… |
| CVE-2026-87822 | CVE-2026-87822 CVSS 7.5 | t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values th… |
| CVE-2026-87821 | CVE-2026-87821 CVSS 7.1 | Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authen… |
| CVE-2026-87820 | CVE-2026-87820 CVSS 5.3 | CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan ide… |
| CVE-2026-87819 | CVE-2026-87819 CVSS 7.5gitpython_project | GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fiel… |
| CVE-2026-87818 | CVE-2026-87818 CVSS 6.5gitpython_project | GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operan… |
| CVE-2026-87817 | CVE-2026-87817 CVSS 8.8gitpython_project | GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like git… |
| CVE-2026-87816 | CVE-2026-87816 CVSS 7.5 | PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass e… |
| CVE-2026-87815 | CVE-2026-87815 CVSS 8.7 | SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An a… |
| CVE-2026-87814 | CVE-2026-87814 CVSS 7.3 | SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before… |
| CVE-2026-87813 | CVE-2026-87813 CVSS 7.3 | SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML wit… |
| CVE-2026-87812 | CVE-2026-87812 CVSS 6.8 | SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img… |
| CVE-2026-87811 | CVE-2026-87811 CVSS 7.3 | SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft maliciou… |
| CVE-2026-87810 | CVE-2026-87810 CVSS 5.3 | Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from res… |
| CVE-2026-87809 | CVE-2026-87809 CVSS 6.5 | Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpo… |