98,920 indexed
CVECVE vulnerabilities
98,920 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 8,151–8,200 of 98,920 · page 164 of 1979
| ID | Title | Summary |
|---|---|---|
| CVE-2026-86205 | CVE-2026-86205 CVSS 5.4 | h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Refer… |
| CVE-2026-86204 | CVE-2026-86204 CVSS 6.5 | PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of ser… |
| CVE-2026-86203 | CVE-2026-86203 CVSS 3.7 | PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition … |
| CVE-2026-86202 | CVE-2026-86202 CVSS 4.3 | PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animat… |
| CVE-2026-86201 | CVE-2026-86201 CVSS 7.5 | PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT pr… |
| CVE-2026-86200 | CVE-2026-86200 CVSS 5.3 | PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning message… |
| CVE-2026-8620 | CVE-2026-8620 CVSS 7.5ibm | IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liber… |
| CVE-2026-86199 | CVE-2026-86199 CVSS 7.5 | PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger a… |
| CVE-2026-86198 | CVE-2026-86198 CVSS 4.2 | PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource p… |
| CVE-2026-86197 | CVE-2026-86197 | Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets with… |
| CVE-2026-86196 | CVE-2026-86196 | Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated atta… |
| CVE-2026-86195 | CVE-2026-86195 | grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only remove… |
| CVE-2026-86194 | CVE-2026-86194 | Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form action… |
| CVE-2026-86193 | CVE-2026-86193 | grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-a… |
| CVE-2026-86192 | CVE-2026-86192 CVSS 6.5 | SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hid… |
| CVE-2026-86191 | CVE-2026-86191 CVSS 4.3 | SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate… |
| CVE-2026-86190 | CVE-2026-86190 CVSS 9.1 | WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery t… |
| CVE-2026-8619 | CVE-2026-8619 CVSS 7.5tp-link | An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper … |
| CVE-2026-86189 | CVE-2026-86189 CVSS 9.8 | WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by su… |
| CVE-2026-86188 | CVE-2026-86188 CVSS 7.2 | AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other … |
| CVE-2026-86187 | CVE-2026-86187 CVSS 5.9 | WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integers. Attackers with a… |
| CVE-2026-86186 | CVE-2026-86186 CVSS 6.5 | AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login … |
| CVE-2026-86185 | CVE-2026-86185 CVSS 8.0 | Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity chec… |
| CVE-2026-86184 | CVE-2026-86184 CVSS 9.8 | Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate… |
| CVE-2026-86183 | CVE-2026-86183 CVSS 5.3 | A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmW… |
| CVE-2026-86182 | CVE-2026-86182 CVSS 4.3 | A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/a… |
| CVE-2026-86181 | CVE-2026-86181 CVSS 3.5 | A vulnerability was found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/UpdateUserProfile… |
| CVE-2026-86180 | CVE-2026-86180 CVSS 7.3 | A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /inde… |
| CVE-2026-8618 | CVE-2026-8618 | A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request da… |
| CVE-2026-86179 | CVE-2026-86179 CVSS 5.3 | A flaw has been found in code-projects Daily Expense Manager 1.0. Affected is an unknown function of the file /Daily-Expense-Manager/exp_ak.sql of the componen… |
| CVE-2026-86178 | CVE-2026-86178 CVSS 5.4 | Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access followe… |
| CVE-2026-86177 | CVE-2026-86177 CVSS 8.8 | Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permissio… |
| CVE-2026-86176 | CVE-2026-86176 CVSS 4.3 | NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authentica… |
| CVE-2026-86175 | CVE-2026-86175 CVSS 6.5 | NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission… |
| CVE-2026-86174 | CVE-2026-86174 CVSS 4.3 | Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comment… |
| CVE-2026-86173 | CVE-2026-86173 CVSS 7.5 | MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary… |
| CVE-2026-86172 | CVE-2026-86172 CVSS 6.3 | A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation… |
| CVE-2026-86171 | CVE-2026-86171 CVSS 6.3 | A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /modules/orders/delete.php. Such manipulat… |
| CVE-2026-86170 | CVE-2026-86170 CVSS 6.3 | A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation… |
| CVE-2026-8617 | CVE-2026-8617 CVSS 5.3 | The SearchPlus plugin for WordPress is vulnerable to unauthorized modification and deletion of data in versions up to, and including, 1.7.1. This is due to a m… |
| CVE-2026-86169 | CVE-2026-86169 CVSS 8.8 | Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, cau… |
| CVE-2026-86168 | CVE-2026-86168 CVSS 7.3 | A security flaw has been discovered in code-projects Content Management System 1.0. The affected element is an unknown function of the file /login.php. The man… |
| CVE-2026-86167 | CVE-2026-86167 CVSS 9.9 | A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The… |
| CVE-2026-86166 | CVE-2026-86166 CVSS 8.8 | A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component B… |
| CVE-2026-86165 | CVE-2026-86165 CVSS 9.8 | A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulatio… |
| CVE-2026-86164 | CVE-2026-86164 CVSS 6.3 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/trans_view.php. The mani… |
| CVE-2026-86163 | CVE-2026-86163 CVSS 6.3 | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/pro_del.php. The manipulatio… |
| CVE-2026-86162 | CVE-2026-86162 CVSS 7.3 | A vulnerability was determined in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /ajax.php?action=login. Executing a man… |
| CVE-2026-86161 | CVE-2026-86161 CVSS 7.3 | A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_category.… |
| CVE-2026-86160 | CVE-2026-86160 CVSS 7.3 | A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_voti… |