98,920 indexed
CVECVE vulnerabilities
98,920 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 7,651–7,700 of 98,920 · page 154 of 1979
| ID | Title | Summary |
|---|---|---|
| CVE-2026-86884 | CVE-2026-86884 CVSS 5.5apple | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27. An app … |
| CVE-2026-86883 | CVE-2026-86883 CVSS 5.5apple | A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27. An app may be able to access sensitive… |
| CVE-2026-86882 | CVE-2026-86882 CVSS 6.5apple | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden G… |
| CVE-2026-86881 | CVE-2026-86881 CVSS 9.1apple | A certificate validation issue was addressed with improved certificate validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS… |
| CVE-2026-8688 | CVE-2026-8688 CVSS 4.3 | The Advance Nav Menu Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.3. This is due to the plugin no… |
| CVE-2026-86879 | CVE-2026-86879 CVSS 6.5apple | A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. A remote attacker may be able to cause a d… |
| CVE-2026-86878 | CVE-2026-86878 CVSS 5.5apple | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data. |
| CVE-2026-86876 | CVE-2026-86876 CVSS 5.2apple | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden G… |
| CVE-2026-86870 | CVE-2026-86870 CVSS 6.5apple | A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27… |
| CVE-2026-86869 | CVE-2026-86869 CVSS 6.5apple | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Golden Gate 27. Processing a m… |
| CVE-2026-86867 | CVE-2026-86867 CVSS 6.5 | Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and i… |
| CVE-2026-86865 | CVE-2026-86865 CVSS 7.2 | Tanium addressed a SQL injection vulnerability in Asset. |
| CVE-2026-86864 | CVE-2026-86864 CVSS 8.8pgadmin | pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare traili… |
| CVE-2026-86863 | CVE-2026-86863 CVSS 9.8pgadmin | pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered throug… |
| CVE-2026-86862 | CVE-2026-86862 CVSS 6.5pgadmin | pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql… |
| CVE-2026-86861 | CVE-2026-86861 CVSS 5.9pgadmin | pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permiss… |
| CVE-2026-86860 | CVE-2026-86860 | ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthent… |
| CVE-2026-8686 | CVE-2026-8686 CVSS 9.1 | Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a denial of service by sending a crafted pac… |
| CVE-2026-86859 | CVE-2026-86859 | ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could en… |
| CVE-2026-86858 | CVE-2026-86858 | ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unau… |
| CVE-2026-86857 | CVE-2026-86857 | ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could en… |
| CVE-2026-86856 | CVE-2026-86856 CVSS 6.5 | A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leadi… |
| CVE-2026-86853 | CVE-2026-86853 CVSS 4.3mozilla | A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS tem… |
| CVE-2026-86851 | CVE-2026-86851 CVSS 6.5 | The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order c… |
| CVE-2026-86850 | CVE-2026-86850 CVSS 6.5 | The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also ava… |
| CVE-2026-8685 | CVE-2026-8685 CVSS 6.5 | The Infility Global plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' parameters in all versions up to, and including, 2.15.16.… |
| CVE-2026-86849 | CVE-2026-86849 CVSS 6.5 | A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer… |
| CVE-2026-86848 | CVE-2026-86848 CVSS 8.8 | A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to c… |
| CVE-2026-86847 | CVE-2026-86847 CVSS 6.5 | A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causi… |
| CVE-2026-86846 | CVE-2026-86846 CVSS 6.5 | A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-boun… |
| CVE-2026-86845 | CVE-2026-86845 CVSS 6.5 | A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type be… |
| CVE-2026-86843 | CVE-2026-86843 CVSS 6.3apache | The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight … |
| CVE-2026-86842 | CVE-2026-86842 CVSS 6.8 | The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users… |
| CVE-2026-86841 | CVE-2026-86841 CVSS 4.7 | The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly r… |
| CVE-2026-86840 | CVE-2026-86840 CVSS 9.1 | The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supp… |
| CVE-2026-8684 | CVE-2026-8684 CVSS 5.3 | The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1. This is due to the plugin n… |
| CVE-2026-86839 | CVE-2026-86839 CVSS 3.8 | The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its s… |
| CVE-2026-86838 | CVE-2026-86838 CVSS 5.3 | The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowin… |
| CVE-2026-86837 | CVE-2026-86837 CVSS 5.3 | The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers… |
| CVE-2026-86836 | CVE-2026-86836 | In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived fr… |
| CVE-2026-86834 | CVE-2026-86834 CVSS 3.7 | The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpo… |
| CVE-2026-86833 | CVE-2026-86833 CVSS 5.4 | The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notific… |
| CVE-2026-86832 | CVE-2026-86832 CVSS 5.3 | The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter info… |
| CVE-2026-86831 | CVE-2026-86831 CVSS 8.7 | Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remo… |
| CVE-2026-86830 | CVE-2026-86830 CVSS 7.2 | Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenti… |
| CVE-2026-8683 | CVE-2026-8683 CVSS 6.5mattermost | Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a maliciou… |
| CVE-2026-86828 | CVE-2026-86828 CVSS 6.6 | The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archiv… |
| CVE-2026-86827 | CVE-2026-86827 CVSS 5.3 | The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's … |
| CVE-2026-86826 | CVE-2026-86826 CVSS 5.9 | The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthentic… |
| CVE-2026-86824 | CVE-2026-86824 CVSS 4.8 | The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unk… |