98,920 indexed
CVECVE vulnerabilities
98,920 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 7,801–7,850 of 98,920 · page 157 of 1979
| ID | Title | Summary |
|---|---|---|
| CVE-2026-86720 | CVE-2026-86720 CVSS 8.1 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live_restreams_id in resendRestreamer.json.php, allowing aut… |
| CVE-2026-8672 | CVE-2026-8672 CVSS 5.1avantra | Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default Usernames and Passwords. This issue affect… |
| CVE-2026-86719 | CVE-2026-86719 CVSS 5.4 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the CustomizeUser plugin en… |
| CVE-2026-86718 | CVE-2026-86718 CVSS 7.1 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll… |
| CVE-2026-86717 | CVE-2026-86717 CVSS 9.1 | The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete ar… |
| CVE-2026-86716 | CVE-2026-86716 CVSS 7.3 | A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skip_spaces_and_comments of the file src/mjs_tok.c. Executing a manipulation… |
| CVE-2026-86714 | CVE-2026-86714 CVSS 5.4 | PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attacke… |
| CVE-2026-86713 | CVE-2026-86713 CVSS 7.1 | PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and… |
| CVE-2026-86712 | CVE-2026-86712 CVSS 8.8 | SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the No… |
| CVE-2026-86711 | CVE-2026-86711 CVSS 7.4 | electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Ren… |
| CVE-2026-86710 | CVE-2026-86710 CVSS 9.8 | The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value … |
| CVE-2026-8671 | CVE-2026-8671 CVSS 7.5avantra | Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows allows Resource Leak Exposure. This issue affe… |
| CVE-2026-86709 | CVE-2026-86709 CVSS 9.8 | The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attacke… |
| CVE-2026-86708 | CVE-2026-86708 CVSS 10.0 | ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applicati… |
| CVE-2026-86707 | CVE-2026-86707 CVSS 9.8 | The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user m… |
| CVE-2026-86706 | CVE-2026-86706 CVSS 9.1 | The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which opt… |
| CVE-2026-86701 | CVE-2026-86701 CVSS 2.5 | Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on… |
| CVE-2026-8670 | CVE-2026-8670 CVSS 9.6avantra | Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session IDs (aka Session Replay). This issue aff… |
| CVE-2026-86698 | CVE-2026-86698 | Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep r… |
| CVE-2026-86689 | CVE-2026-86689 CVSS 5.9 | Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that… |
| CVE-2026-86688 | CVE-2026-86688 | Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to hold an authen… |
| CVE-2026-86684 | CVE-2026-86684 CVSS 7.1gitea | The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] … |
| CVE-2026-86683 | CVE-2026-86683 CVSS 8.1 | ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings. |
| CVE-2026-86681 | CVE-2026-86681 CVSS 7.6 | ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to exe… |
| CVE-2026-8668 | CVE-2026-8668 | A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access to internal message queues. Queue messages contained tenant-specific… |
| CVE-2026-86679 | CVE-2026-86679 CVSS 7.1 | ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to de… |
| CVE-2026-86678 | CVE-2026-86678 CVSS 8.8 | ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform a… |
| CVE-2026-86677 | CVE-2026-86677 CVSS 8.8 | ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining admini… |
| CVE-2026-86675 | CVE-2026-86675 CVSS 6.3 | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/us_edit.php. Such manipulation o… |
| CVE-2026-86674 | CVE-2026-86674 CVSS 6.3 | A vulnerability was found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is the functio… |
| CVE-2026-86673 | CVE-2026-86673 CVSS 7.3 | A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function m… |
| CVE-2026-86672 | CVE-2026-86672 CVSS 5.3 | A vulnerability has been found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function of the f… |
| CVE-2026-86671 | CVE-2026-86671 | In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.… |
| CVE-2026-86670 | CVE-2026-86670 CVSS 3.7 | A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication… |
| CVE-2026-8667 | CVE-2026-8667 CVSS 4.3gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain c… |
| CVE-2026-86669 | CVE-2026-86669 CVSS 7.3 | A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a mani… |
| CVE-2026-86668 | CVE-2026-86668 CVSS 4.3 | A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.p… |
| CVE-2026-86667 | CVE-2026-86667 CVSS 4.7 | A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function member_list of the file controllers/member.php. This… |
| CVE-2026-86666 | CVE-2026-86666 CVSS 7.3 | A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload_json/uploadFile of the file controllers/pic.php. The… |
| CVE-2026-86665 | CVE-2026-86665 CVSS 7.3 | A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The man… |
| CVE-2026-8666 | CVE-2026-8666 CVSS 7.7rapid7 | OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS… |
| CVE-2026-8665 | CVE-2026-8665 CVSS 7.7rapid7 | OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute arbitrary OS commands… |
| CVE-2026-86644 | CVE-2026-86644 CVSS 3.5 | A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web_src/public/editor.md/editormd.js of the … |
| CVE-2026-8664 | CVE-2026-8664 CVSS 6.0rapid7 | OS Command Injection vulnerability in Rapid7 InsightConnect Finger Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the user… |
| CVE-2026-8663 | CVE-2026-8663 CVSS 6.0rapid7 | OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the repo, k… |
| CVE-2026-8662 | CVE-2026-8662 CVSS 3.3rapid7 | Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to uni… |
| CVE-2026-86612 | CVE-2026-86612 CVSS 5.6 | The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuratio… |
| CVE-2026-86610 | CVE-2026-86610 CVSS 6.4 | The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which coul… |
| CVE-2026-8661 | CVE-2026-8661 CVSS 4.8 | Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin on Linux in versions prior to 4.0.2 allows remote attackers … |
| CVE-2026-86609 | CVE-2026-86609 CVSS 8.8 | The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outpu… |