98,920 indexed
CVECVE vulnerabilities
98,920 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 7,951–8,000 of 98,920 · page 160 of 1979
| ID | Title | Summary |
|---|---|---|
| CVE-2026-8647 | CVE-2026-8647 CVSS 4.8 | Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available. The random_bytes function fell back to… |
| CVE-2026-86469 | CVE-2026-86469 CVSS 5.3 | A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, th… |
| CVE-2026-86466 | CVE-2026-86466 CVSS 8.1apache | Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An at… |
| CVE-2026-86465 | CVE-2026-86465 CVSS 6.5apache | Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag… |
| CVE-2026-86464 | CVE-2026-86464 | In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included inse… |
| CVE-2026-86463 | CVE-2026-86463 | Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinat… |
| CVE-2026-86462 | CVE-2026-86462 CVSS 9.1apache | Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed ses… |
| CVE-2026-86461 | CVE-2026-86461 CVSS 8.8 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the ch… |
| CVE-2026-86460 | CVE-2026-86460 CVSS 9.8 | Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0 … |
| CVE-2026-8646 | CVE-2026-8646 CVSS 7.4ibm | IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling.… |
| CVE-2026-86452 | CVE-2026-86452 CVSS 7.5misp-project | Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting.… |
| CVE-2026-86451 | CVE-2026-86451 CVSS 4.3misp-project | Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first che… |
| CVE-2026-86450 | CVE-2026-86450 CVSS 7.5 | Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Fun… |
| CVE-2026-86449 | CVE-2026-86449 CVSS 5.3 | The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST rout… |
| CVE-2026-86448 | CVE-2026-86448 CVSS 3.7 | The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export… |
| CVE-2026-86447 | CVE-2026-86447 CVSS 5.3 | The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attack… |
| CVE-2026-86446 | CVE-2026-86446 CVSS 3.7 | The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attack… |
| CVE-2026-86445 | CVE-2026-86445 CVSS 5.3 | The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated a… |
| CVE-2026-86444 | CVE-2026-86444 CVSS 7.1 | The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthentic… |
| CVE-2026-86443 | CVE-2026-86443 | Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local access to the devic… |
| CVE-2026-86441 | CVE-2026-86441 CVSS 4.3misp-project | Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-rela… |
| CVE-2026-86440 | CVE-2026-86440 CVSS 5.4misp-project | Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is stored configuration co… |
| CVE-2026-8644 | CVE-2026-8644 CVSS 9.1ibm | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing. |
| CVE-2026-86439 | CVE-2026-86439 CVSS 8.8 | knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside t… |
| CVE-2026-86438 | CVE-2026-86438 CVSS 7.2 | Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install mo… |
| CVE-2026-86437 | CVE-2026-86437 CVSS 7.2 | Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin a… |
| CVE-2026-86436 | CVE-2026-86436 CVSS 5.4 | Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content per… |
| CVE-2026-86435 | CVE-2026-86435 CVSS 7.5 | commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions.… |
| CVE-2026-86434 | CVE-2026-86434 CVSS 7.5 | league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restar… |
| CVE-2026-86433 | CVE-2026-86433 CVSS 7.5 | commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirect… |
| CVE-2026-86432 | CVE-2026-86432 CVSS 5.3 | commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML ta… |
| CVE-2026-86431 | CVE-2026-86431 CVSS 7.2thephpleague | league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an… |
| CVE-2026-86430 | CVE-2026-86430 CVSS 7.5thephpleague | league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emp… |
| CVE-2026-8643 | CVE-2026-8643 CVSS 5.5pypa | pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, lea… |
| CVE-2026-86429 | CVE-2026-86429 CVSS 7.5thephpleague | The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and A… |
| CVE-2026-86428 | CVE-2026-86428 CVSS 7.5thephpleague | commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. … |
| CVE-2026-86427 | CVE-2026-86427 CVSS 8.8librenms | LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtoo… |
| CVE-2026-86426 | CVE-2026-86426 CVSS 9.8librenms | LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by s… |
| CVE-2026-86425 | CVE-2026-86425 CVSS 3.3imagemagick | ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies… |
| CVE-2026-86424 | CVE-2026-86424 CVSS 2.5imagemagick | ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path… |
| CVE-2026-86423 | CVE-2026-86423 CVSS 3.3imagemagick | ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the … |
| CVE-2026-86422 | CVE-2026-86422 CVSS 3.3imagemagick | ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or wr… |
| CVE-2026-86421 | CVE-2026-86421 CVSS 3.7imagemagick | ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallo… |
| CVE-2026-86420 | CVE-2026-86420 CVSS 3.7imagemagick | ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such … |
| CVE-2026-86419 | CVE-2026-86419 CVSS 9.1misp-project | Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In f… |
| CVE-2026-86418 | CVE-2026-86418 CVSS 4.3misp-project | Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by … |
| CVE-2026-86417 | CVE-2026-86417 CVSS 4.3misp-project | Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetched User.email, whi… |
| CVE-2026-86416 | CVE-2026-86416 CVSS 5.4 | ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObj… |
| CVE-2026-86408 | CVE-2026-86408 CVSS 6.5misp-project | Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view(). The vulnerable … |
| CVE-2026-86407 | CVE-2026-86407 CVSS 3.7 | The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account… |