98,920 indexed
CVECVE vulnerabilities
98,920 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 7,701–7,750 of 98,920 · page 155 of 1979
| ID | Title | Summary |
|---|---|---|
| CVE-2026-86823 | CVE-2026-86823 CVSS 5.3 | The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthen… |
| CVE-2026-86819 | CVE-2026-86819 CVSS 7.1 | Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the c… |
| CVE-2026-86818 | CVE-2026-86818 CVSS 4.8 | fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 a… |
| CVE-2026-86817 | CVE-2026-86817 CVSS 4.9 | The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, a… |
| CVE-2026-86816 | CVE-2026-86816 CVSS 5.3 | The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce p… |
| CVE-2026-86815 | CVE-2026-86815 CVSS 5.5 | The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-executi… |
| CVE-2026-86814 | CVE-2026-86814 CVSS 8.1 | The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve… |
| CVE-2026-86813 | CVE-2026-86813 CVSS 4.8 | The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email head… |
| CVE-2026-86812 | CVE-2026-86812 CVSS 6.5 | The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks re… |
| CVE-2026-86810 | CVE-2026-86810 CVSS 7.3 | A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Contro… |
| CVE-2026-86809 | CVE-2026-86809 CVSS 5.3 | The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to… |
| CVE-2026-86808 | CVE-2026-86808 CVSS 7.3 | A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vault_unlock_handler/vault_recovery_han… |
| CVE-2026-86806 | CVE-2026-86806 CVSS 7.3 | A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-side request forger… |
| CVE-2026-86805 | CVE-2026-86805 CVSS 6.3 | A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local att… |
| CVE-2026-86804 | CVE-2026-86804 CVSS 5.3 | A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/in… |
| CVE-2026-86802 | CVE-2026-86802 CVSS 3.7 | The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetc… |
| CVE-2026-86801 | CVE-2026-86801 CVSS 8.8 | The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, … |
| CVE-2026-86800 | CVE-2026-86800 CVSS 5.3 | The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding prot… |
| CVE-2026-86799 | CVE-2026-86799 CVSS 8.8 | The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions scre… |
| CVE-2026-86798 | CVE-2026-86798 CVSS 8.8 | The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored thr… |
| CVE-2026-86797 | CVE-2026-86797 CVSS 6.8 | The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it, allowing … |
| CVE-2026-86796 | CVE-2026-86796 CVSS 5.3 | The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detec… |
| CVE-2026-86793 | CVE-2026-86793 CVSS 9.8 | SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be … |
| CVE-2026-86792 | CVE-2026-86792 CVSS 8.8apache | Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables… |
| CVE-2026-86790 | CVE-2026-86790 CVSS 6.8 | The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, w… |
| CVE-2026-8679 | CVE-2026-8679 CVSS 7.5 | The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_play… |
| CVE-2026-86789 | CVE-2026-86789 CVSS 5.3 | The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read e… |
| CVE-2026-86788 | CVE-2026-86788 CVSS 6.8 | The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widge… |
| CVE-2026-86787 | CVE-2026-86787 CVSS 7.2 | The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine c… |
| CVE-2026-86786 | CVE-2026-86786 CVSS 5.3 | The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users… |
| CVE-2026-86785 | CVE-2026-86785 CVSS 5.3 | The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticat… |
| CVE-2026-86784 | CVE-2026-86784 CVSS 6.8 | The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart edit… |
| CVE-2026-86783 | CVE-2026-86783 CVSS 5.3 | The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the … |
| CVE-2026-86782 | CVE-2026-86782 CVSS 5.5 | The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and ab… |
| CVE-2026-86781 | CVE-2026-86781 CVSS 5.3 | The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file down… |
| CVE-2026-86780 | CVE-2026-86780 CVSS 6.8 | The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow u… |
| CVE-2026-8678 | CVE-2026-8678 CVSS 4.3 | The MyParcel plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.25.1. This is due to the plugin not properly ve… |
| CVE-2026-86779 | CVE-2026-86779 CVSS 2.7 | The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-obj… |
| CVE-2026-86778 | CVE-2026-86778 CVSS 5.3 | Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting. Thi… |
| CVE-2026-86777 | CVE-2026-86777 CVSS 5.3 | AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve … |
| CVE-2026-86776 | CVE-2026-86776 CVSS 3.3 | KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a m… |
| CVE-2026-86775 | CVE-2026-86775 CVSS 8.6 | knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normaliz… |
| CVE-2026-86774 | CVE-2026-86774 CVSS 6.3snipeitapp | Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission… |
| CVE-2026-86773 | CVE-2026-86773 CVSS 5.4snipeitapp | Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints a… |
| CVE-2026-86772 | CVE-2026-86772 CVSS 5.4snipeitapp | Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rende… |
| CVE-2026-86771 | CVE-2026-86771 CVSS 7.6snipeitapp | Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inj… |
| CVE-2026-86770 | CVE-2026-86770 CVSS 8.1snipeitapp | Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by register… |
| CVE-2026-8677 | CVE-2026-8677 CVSS 6.4 | The Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Widget HTML T… |
| CVE-2026-86769 | CVE-2026-86769 CVSS 4.3snipeitapp | Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target… |
| CVE-2026-86768 | CVE-2026-86768 CVSS 5.4snipeitapp | Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inven… |