98,920 indexed
CVECVE vulnerabilities
98,920 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 7,901–7,950 of 98,920 · page 159 of 1979
| ID | Title | Summary |
|---|---|---|
| CVE-2026-86519 | CVE-2026-86519 CVSS 5.3 | A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /card_activation.sql of the component Backu… |
| CVE-2026-86518 | CVE-2026-86518 CVSS 6.3 | A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file /edit.php. The manipulation of the arg… |
| CVE-2026-86517 | CVE-2026-86517 CVSS 6.3 | A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqli_query of the file /pages/us_searchfrm.php. Ex… |
| CVE-2026-86516 | CVE-2026-86516 CVSS 4.7 | A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file deployment/aws/shared… |
| CVE-2026-86515 | CVE-2026-86515 CVSS 4.3 | A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add_entry of the file src/meta/txtp_parser.c of the component txt… |
| CVE-2026-86514 | CVE-2026-86514 CVSS 6.3 | A weakness has been identified in vgmstream up to r2117. This issue affects the function sscanf of the file src/meta/txth.c of the component txth-txtp. This ma… |
| CVE-2026-86513 | CVE-2026-86513 CVSS 5.3 | A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function TreePointer.tokensFromInput of the file s… |
| CVE-2026-86512 | CVE-2026-86512 CVSS 6.3 | A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main… |
| CVE-2026-86511 | CVE-2026-86511 CVSS 5.3 | A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/mai… |
| CVE-2026-86510 | CVE-2026-86510 CVSS 9.9 | A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipula… |
| CVE-2026-8651 | CVE-2026-8651 CVSS 3.7progress | Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from … |
| CVE-2026-86509 | CVE-2026-86509 CVSS 9.6 | A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. Th… |
| CVE-2026-86507 | CVE-2026-86507 CVSS 6.1 | Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in th… |
| CVE-2026-86506 | CVE-2026-86506 CVSS 5.9 | In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data |
| CVE-2026-86505 | CVE-2026-86505 CVSS 3.3 | In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace |
| CVE-2026-86504 | CVE-2026-86504 CVSS 7.8 | In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution |
| CVE-2026-86503 | CVE-2026-86503 CVSS 3.3 | In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching |
| CVE-2026-86502 | CVE-2026-86502 CVSS 8.4 | In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts |
| CVE-2026-86501 | CVE-2026-86501 CVSS 2.8 | In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log |
| CVE-2026-86500 | CVE-2026-86500 CVSS 5.5 | In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin |
| CVE-2026-8650 | CVE-2026-8650 CVSS 4.5progress | Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 … |
| CVE-2026-86499 | CVE-2026-86499 CVSS 4.3 | In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission |
| CVE-2026-86498 | CVE-2026-86498 CVSS 7.7 | In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission |
| CVE-2026-86497 | CVE-2026-86497 CVSS 6.8 | In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox creden… |
| CVE-2026-86496 | CVE-2026-86496 CVSS 4.3 | In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses |
| CVE-2026-86495 | CVE-2026-86495 CVSS 6.5 | In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects |
| CVE-2026-86494 | CVE-2026-86494 CVSS 7.7 | In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues |
| CVE-2026-86493 | CVE-2026-86493 CVSS 6.5 | In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards |
| CVE-2026-86492 | CVE-2026-86492 CVSS 8.5 | In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens |
| CVE-2026-86491 | CVE-2026-86491 CVSS 3.5 | In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads |
| CVE-2026-86490 | CVE-2026-86490 CVSS 6.5 | In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint |
| CVE-2026-8649 | CVE-2026-8649 CVSS 6.4progress | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit … |
| CVE-2026-86489 | CVE-2026-86489 CVSS 6.5 | In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations |
| CVE-2026-86488 | CVE-2026-86488 CVSS 6.5 | In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches |
| CVE-2026-86487 | CVE-2026-86487 CVSS 3.1 | In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content |
| CVE-2026-86486 | CVE-2026-86486 CVSS 3.7 | In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank |
| CVE-2026-86485 | CVE-2026-86485 CVSS 3.3 | In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks |
| CVE-2026-86484 | CVE-2026-86484 CVSS 4.6 | In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS |
| CVE-2026-86483 | CVE-2026-86483 CVSS 5.4 | In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible |
| CVE-2026-86482 | CVE-2026-86482 CVSS 8.8 | In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation |
| CVE-2026-86481 | CVE-2026-86481 CVSS 4.3 | In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons |
| CVE-2026-86480 | CVE-2026-86480 CVSS 9.8 | In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges |
| CVE-2026-86479 | CVE-2026-86479 CVSS 8.1 | In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR |
| CVE-2026-86478 | CVE-2026-86478 CVSS 9.8 | In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asse… |
| CVE-2026-86477 | CVE-2026-86477 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this cand… |
| CVE-2026-86476 | CVE-2026-86476 CVSS 8.4 | A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane… |
| CVE-2026-86475 | CVE-2026-86475 CVSS 5.3 | The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its ow… |
| CVE-2026-86474 | CVE-2026-86474 | The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker t… |
| CVE-2026-86473 | CVE-2026-86473 CVSS 9.1apache | Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as a… |
| CVE-2026-86472 | CVE-2026-86472 CVSS 4.8 | fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 thro… |