98,920 indexed
CVECVE vulnerabilities
98,920 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 7,001–7,050 of 98,920 · page 141 of 1979
| ID | Title | Summary |
|---|---|---|
| CVE-2026-87808 | CVE-2026-87808 CVSS 4.9 | SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The prior fix (commit d5e2d0bc) added an administrator check for S… |
| CVE-2026-87807 | CVE-2026-87807 CVSS 7.5 | siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers ca… |
| CVE-2026-87806 | CVE-2026-87806 CVSS 7.4 | Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forward… |
| CVE-2026-87804 | CVE-2026-87804 | Rejected reason: no security impact |
| CVE-2026-87803 | CVE-2026-87803 CVSS 7.1 | An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db … |
| CVE-2026-87802 | CVE-2026-87802 CVSS 9.1 | Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an att… |
| CVE-2026-87799 | CVE-2026-87799 CVSS 9.9 | Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an au… |
| CVE-2026-87798 | CVE-2026-87798 CVSS 5.8 | Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8… |
| CVE-2026-87797 | CVE-2026-87797 CVSS 4.3 | The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through … |
| CVE-2026-87796 | CVE-2026-87796 CVSS 9.8 | The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file … |
| CVE-2026-87795 | CVE-2026-87795 CVSS 8.2 | zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attac… |
| CVE-2026-87794 | CVE-2026-87794 CVSS 8.4 | bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to t… |
| CVE-2026-87793 | CVE-2026-87793 | The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated … |
| CVE-2026-87792 | CVE-2026-87792 | The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator function… |
| CVE-2026-87791 | CVE-2026-87791 | A path traversal vulnerability exists in the reserved_file_check function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerabil… |
| CVE-2026-87786 | CVE-2026-87786 CVSS 8.8 | The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allow… |
| CVE-2026-87785 | CVE-2026-87785 CVSS 9.1 | Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least… |
| CVE-2026-87782 | CVE-2026-87782 CVSS 8.8 | The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile u… |
| CVE-2026-87781 | CVE-2026-87781 CVSS 8.6 | The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection … |
| CVE-2026-87780 | CVE-2026-87780 CVSS 8.8 | The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them an… |
| CVE-2026-8778 | CVE-2026-8778 CVSS 9.8 | The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to mi… |
| CVE-2026-87779 | CVE-2026-87779 CVSS 7.5 | Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length (not 16/24/32 bytes) is configured, Sy… |
| CVE-2026-87777 | CVE-2026-87777 CVSS 6.8 | The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users wit… |
| CVE-2026-87776 | CVE-2026-87776 CVSS 7.5 | compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still… |
| CVE-2026-87775 | CVE-2026-87775 CVSS 8.6 | The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action ava… |
| CVE-2026-87774 | CVE-2026-87774 CVSS 8.6 | The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action ava… |
| CVE-2026-87771 | CVE-2026-87771 CVSS 8.6 | The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions availab… |
| CVE-2026-87770 | CVE-2026-87770 CVSS 8.6 | The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action a… |
| CVE-2026-87767 | CVE-2026-87767 CVSS 8.6 | The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX … |
| CVE-2026-87766 | CVE-2026-87766 CVSS 8.8 | A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, … |
| CVE-2026-87765 | CVE-2026-87765 CVSS 5.5 | In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index… |
| CVE-2026-87764 | CVE-2026-87764 CVSS 8.8 | The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor… |
| CVE-2026-87762 | CVE-2026-87762 CVSS 8.8 | The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret compar… |
| CVE-2026-87761 | CVE-2026-87761 CVSS 8.0 | The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwr… |
| CVE-2026-87760 | CVE-2026-87760 CVSS 8.8 | The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storin… |
| CVE-2026-8776 | CVE-2026-8776 CVSS 8.8 | A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSetup of the compone… |
| CVE-2026-87759 | CVE-2026-87759 CVSS 8.8 | The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carry… |
| CVE-2026-87752 | CVE-2026-87752 CVSS 6.1 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies Tourism Industry and Tr… |
| CVE-2026-8775 | CVE-2026-8775 CVSS 8.8 | A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler… |
| CVE-2026-87748 | CVE-2026-87748 CVSS 8.8 | Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse. This issue affects Qorela DC: from 1.6.1-RC2… |
| CVE-2026-87747 | CVE-2026-87747 CVSS 4.9 | The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to d… |
| CVE-2026-87744 | CVE-2026-87744 CVSS 9.1 | A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a d… |
| CVE-2026-87743 | CVE-2026-87743 CVSS 7.5 | A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and H… |
| CVE-2026-87742 | CVE-2026-87742 CVSS 7.5 | A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single… |
| CVE-2026-87741 | CVE-2026-87741 CVSS 8.8 | The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of … |
| CVE-2026-87739 | CVE-2026-87739 | An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report genera… |
| CVE-2026-87737 | CVE-2026-87737 CVSS 5.9 | An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing side channel for NIST elliptic-curve scalar multiplication: t… |
| CVE-2026-87736 | CVE-2026-87736 CVSS 4.3 | An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points. |
| CVE-2026-87735 | CVE-2026-87735 CVSS 4.3 | An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or… |
| CVE-2026-87734 | CVE-2026-87734 CVSS 7.5 | An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service. |