98,920 indexed
CVECVE vulnerabilities
98,920 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 7,851–7,900 of 98,920 · page 158 of 1979
| ID | Title | Summary |
|---|---|---|
| CVE-2026-86608 | CVE-2026-86608 CVSS 8.2 | The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, a… |
| CVE-2026-86607 | CVE-2026-86607 CVSS 4.3 | Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator. This issue affects Hitachi Ops Center Administrator: before 11.0… |
| CVE-2026-86604 | CVE-2026-86604 CVSS 4.8 | The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default confi… |
| CVE-2026-86603 | CVE-2026-86603 CVSS 4.3 | The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a… |
| CVE-2026-86602 | CVE-2026-86602 CVSS 4.3 | The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a… |
| CVE-2026-86601 | CVE-2026-86601 CVSS 6.5 | The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metad… |
| CVE-2026-86600 | CVE-2026-86600 CVSS 8.2 | In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying… |
| CVE-2026-8660 | CVE-2026-8660 CVSS 7.7rapid7 | OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitrary OS commands vi… |
| CVE-2026-86597 | CVE-2026-86597 CVSS 6.5 | Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-re… |
| CVE-2026-86595 | CVE-2026-86595 CVSS 8.8 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL… |
| CVE-2026-86591 | CVE-2026-86591 CVSS 9.8 | The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbi… |
| CVE-2026-86590 | CVE-2026-86590 | In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an … |
| CVE-2026-8659 | CVE-2026-8659 CVSS 6.0rapid7 | OS Command Injection vulnerability in Rapid7 InsightConnect SQLmap Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the api_… |
| CVE-2026-86585 | CVE-2026-86585 | The lack of signature verification of firmware update packages in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker who control… |
| CVE-2026-86583 | CVE-2026-86583 CVSS 8.8 | The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugi… |
| CVE-2026-8658 | CVE-2026-8658 CVSS 6.0rapid7 | OS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the opt… |
| CVE-2026-86573 | CVE-2026-86573 CVSS 5.1 | Out-of-bounds write vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. This issue affects Hitachi Disk A… |
| CVE-2026-8657 | CVE-2026-8657 CVSS 8.2 | Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.p… |
| CVE-2026-86567 | CVE-2026-86567 CVSS 8.8 | A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap. |
| CVE-2026-86566 | CVE-2026-86566 CVSS 6.5 | A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vh… |
| CVE-2026-86565 | CVE-2026-86565 CVSS 8.2 | A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vh… |
| CVE-2026-86564 | CVE-2026-86564 CVSS 3.3 | A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds re… |
| CVE-2026-86563 | CVE-2026-86563 CVSS 7.8 | A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access. |
| CVE-2026-86562 | CVE-2026-86562 CVSS 7.8 | A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VD… |
| CVE-2026-86561 | CVE-2026-86561 CVSS 6.5 | A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or mem… |
| CVE-2026-86556 | CVE-2026-86556 CVSS 5.3 | There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant… |
| CVE-2026-86555 | CVE-2026-86555 CVSS 6.2 | The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtai… |
| CVE-2026-86554 | CVE-2026-86554 CVSS 4.3 | SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife applicati… |
| CVE-2026-86553 | CVE-2026-86553 CVSS 8.8 | SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application … |
| CVE-2026-86552 | CVE-2026-86552 CVSS 5.4 | SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authenticatio… |
| CVE-2026-86551 | CVE-2026-86551 CVSS 3.3 | The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory… |
| CVE-2026-86550 | CVE-2026-86550 CVSS 6.5 | NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirect… |
| CVE-2026-8655 | CVE-2026-8655 CVSS 9.8citrix | Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScal… |
| CVE-2026-86547 | CVE-2026-86547 CVSS 6.2 | mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can … |
| CVE-2026-86544 | CVE-2026-86544 CVSS 8.1 | knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Att… |
| CVE-2026-86543 | CVE-2026-86543 CVSS 9.8 | knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installa… |
| CVE-2026-86542 | CVE-2026-86542 CVSS 9.1 | knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Atta… |
| CVE-2026-86541 | CVE-2026-86541 CVSS 8.3 | knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files out… |
| CVE-2026-86540 | CVE-2026-86540 CVSS 7.8 | knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary … |
| CVE-2026-86539 | CVE-2026-86539 CVSS 7.2 | knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to cal… |
| CVE-2026-86538 | CVE-2026-86538 CVSS 7.5 | knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read … |
| CVE-2026-86537 | CVE-2026-86537 | Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bi… |
| CVE-2026-86536 | CVE-2026-86536 | Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. This issue affects… |
| CVE-2026-86535 | CVE-2026-86535 | Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability… |
| CVE-2026-86533 | CVE-2026-86533 | Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenti… |
| CVE-2026-86530 | CVE-2026-86530 CVSS 7.2 | BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP reques… |
| CVE-2026-8653 | CVE-2026-8653 CVSS 6.5 | The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8.… |
| CVE-2026-86522 | CVE-2026-86522 | Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by … |
| CVE-2026-86520 | CVE-2026-86520 CVSS 7.5 | Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that… |
| CVE-2026-8652 | CVE-2026-8652 | An OS Command Injection vulnerability exists in Aterm. If a malicious third person gains administrator access to the product’s web console, they may be able to… |