98,920 indexed
CVECVE vulnerabilities
98,920 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 8,201–8,250 of 98,920 · page 165 of 1979
| ID | Title | Summary |
|---|---|---|
| CVE-2026-8616 | CVE-2026-8616 CVSS 5.3 | The Fense Proxy & VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce valid… |
| CVE-2026-86159 | CVE-2026-86159 CVSS 7.3 | A flaw has been found in SourceCodester Online Voting System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_user. This manipulation of … |
| CVE-2026-86158 | CVE-2026-86158 CVSS 7.7 | Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint … |
| CVE-2026-86157 | CVE-2026-86157 CVSS 5.6 | Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify app… |
| CVE-2026-86153 | CVE-2026-86153 CVSS 9.1 | A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The mani… |
| CVE-2026-86152 | CVE-2026-86152 CVSS 10.0 | A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the comp… |
| CVE-2026-86151 | CVE-2026-86151 CVSS 9.1 | A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Confi… |
| CVE-2026-86150 | CVE-2026-86150 CVSS 4.1 | A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of … |
| CVE-2026-8615 | CVE-2026-8615 CVSS 4.3 | The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce… |
| CVE-2026-86149 | CVE-2026-86149 CVSS 9.1 | A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the … |
| CVE-2026-86148 | CVE-2026-86148 CVSS 9.1 | A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kyli… |
| CVE-2026-86145 | CVE-2026-86145 CVSS 8.2 | PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size … |
| CVE-2026-86144 | CVE-2026-86144 CVSS 5.6xmlsoft | In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, … |
| CVE-2026-86143 | CVE-2026-86143 CVSS 6.9xmlsoft | In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a c… |
| CVE-2026-86142 | CVE-2026-86142 CVSS 6.9xmlsoft | In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation. |
| CVE-2026-86141 | CVE-2026-86141 CVSS 2.9xmlsoft | xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length af… |
| CVE-2026-86140 | CVE-2026-86140 CVSS 8.0xmlsoft | In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. |
| CVE-2026-8614 | CVE-2026-8614 CVSS 4.3 | The Assistio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the as… |
| CVE-2026-86139 | CVE-2026-86139 CVSS 6.9xmlsoft | In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. |
| CVE-2026-86138 | CVE-2026-86138 CVSS 6.9xmlsoft | In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. |
| CVE-2026-86137 | CVE-2026-86137 CVSS 2.9xmlsoft | In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp. |
| CVE-2026-86136 | CVE-2026-86136 CVSS 8.1watchguard | A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (includin… |
| CVE-2026-86135 | CVE-2026-86135 | A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized… |
| CVE-2026-86134 | CVE-2026-86134 CVSS 7.5watchguard | A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management… |
| CVE-2026-86133 | CVE-2026-86133 CVSS 7.5watchguard | An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to cr… |
| CVE-2026-86132 | CVE-2026-86132 CVSS 7.5watchguard | An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending … |
| CVE-2026-86131 | CVE-2026-86131 CVSS 9.8watchguard | A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server t… |
| CVE-2026-8613 | CVE-2026-8613 CVSS 6.4 | The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title_tag' Widget Setting in all versions up to, and in… |
| CVE-2026-86128 | CVE-2026-86128 CVSS 7.5watchguard | A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of serv… |
| CVE-2026-86124 | CVE-2026-86124 CVSS 9.8 | AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied command… |
| CVE-2026-86123 | CVE-2026-86123 CVSS 8.7 | SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attac… |
| CVE-2026-86122 | CVE-2026-86122 CVSS 5.0 | Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can poi… |
| CVE-2026-86121 | CVE-2026-86121 CVSS 9.8 | Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, all… |
| CVE-2026-86120 | CVE-2026-86120 CVSS 4.3 | APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when pe… |
| CVE-2026-86119 | CVE-2026-86119 CVSS 8.6 | Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when… |
| CVE-2026-86118 | CVE-2026-86118 CVSS 4.3 | gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library resc… |
| CVE-2026-86117 | CVE-2026-86117 CVSS 8.1 | Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on em… |
| CVE-2026-86116 | CVE-2026-86116 CVSS 6.5 | Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, an… |
| CVE-2026-86115 | CVE-2026-86115 CVSS 5.0 | Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal… |
| CVE-2026-86114 | CVE-2026-86114 CVSS 6.5 | Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates… |
| CVE-2026-86113 | CVE-2026-86113 CVSS 6.5 | BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' r… |
| CVE-2026-86112 | CVE-2026-86112 CVSS 5.4 | BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfa… |
| CVE-2026-86111 | CVE-2026-86111 CVSS 6.5 | BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and d… |
| CVE-2026-8611 | CVE-2026-8611 CVSS 4.3 | The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.4 via the 'in… |
| CVE-2026-86109 | CVE-2026-86109 CVSS 6.6 | The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the d… |
| CVE-2026-86108 | CVE-2026-86108 CVSS 8.0 | Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or… |
| CVE-2026-86107 | CVE-2026-86107 CVSS 5.9 | The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This… |
| CVE-2026-86106 | CVE-2026-86106 CVSS 9.6 | An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in … |
| CVE-2026-86105 | CVE-2026-86105 CVSS 7.1watchguard | An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other… |
| CVE-2026-86104 | CVE-2026-86104 CVSS 7.5watchguard | An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of se… |