98,920 indexed
CVECVE vulnerabilities
98,920 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 8,251–8,300 of 98,920 · page 166 of 1979
| ID | Title | Summary |
|---|---|---|
| CVE-2026-86102 | CVE-2026-86102 | An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell com… |
| CVE-2026-86101 | CVE-2026-86101 CVSS 6.5watchguard | An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access … |
| CVE-2026-86100 | CVE-2026-86100 CVSS 6.4 | Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated atta… |
| CVE-2026-8610 | CVE-2026-8610 CVSS 4.3 | The TypeSquare Webfonts for ConoHa plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.4. This is due to the p… |
| CVE-2026-86099 | CVE-2026-86099 CVSS 8.2 | Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by… |
| CVE-2026-86098 | CVE-2026-86098 CVSS 7.4 | ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer bo… |
| CVE-2026-86097 | CVE-2026-86097 CVSS 6.5 | PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows at… |
| CVE-2026-86096 | CVE-2026-86096 CVSS 5.9 | PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and objec… |
| CVE-2026-86095 | CVE-2026-86095 CVSS 7.8 | Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte … |
| CVE-2026-86093 | CVE-2026-86093 CVSS 7.5ibm | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute a… |
| CVE-2026-86091 | CVE-2026-86091 CVSS 7.1 | ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools a… |
| CVE-2026-86090 | CVE-2026-86090 CVSS 7.1 | ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users c… |
| CVE-2026-8609 | CVE-2026-8609 CVSS 5.3grafana | An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust mem… |
| CVE-2026-86089 | CVE-2026-86089 CVSS 7.1apache | Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration s… |
| CVE-2026-86087 | CVE-2026-86087 CVSS 4.3ibm | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the … |
| CVE-2026-86085 | CVE-2026-86085 CVSS 4.9n8n | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/… |
| CVE-2026-86084 | CVE-2026-86084 CVSS 5.5n8n | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authenticatio… |
| CVE-2026-86083 | CVE-2026-86083 CVSS 8.8n8n | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mu… |
| CVE-2026-86082 | CVE-2026-86082 CVSS 6.5n8n | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restri… |
| CVE-2026-86081 | CVE-2026-86081 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destinat… |
| CVE-2026-86080 | CVE-2026-86080 CVSS 5.3n8n | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when … |
| CVE-2026-8608 | CVE-2026-8608 CVSS 5.3 | The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions… |
| CVE-2026-86079 | CVE-2026-86079 CVSS 6.5n8n | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-co… |
| CVE-2026-86078 | CVE-2026-86078 CVSS 6.5n8n | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from store… |
| CVE-2026-86077 | CVE-2026-86077 CVSS 6.5n8n | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution… |
| CVE-2026-86076 | CVE-2026-86076 CVSS 8.8n8n | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scope… |
| CVE-2026-86075 | CVE-2026-86075 CVSS 7.5n8n | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accept… |
| CVE-2026-86074 | CVE-2026-86074 CVSS 7.1n8n | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verificatio… |
| CVE-2026-86073 | CVE-2026-86073 CVSS 7.6n8n | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to th… |
| CVE-2026-86071 | CVE-2026-86071 CVSS 3.7 | Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java ca… |
| CVE-2026-86066 | CVE-2026-86066 | Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ changes attendance_v… |
| CVE-2026-86065 | CVE-2026-86065 CVSS 7.5 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes… |
| CVE-2026-86064 | CVE-2026-86064 CVSS 8.6 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.… |
| CVE-2026-86063 | CVE-2026-86063 | Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned… |
| CVE-2026-86062 | CVE-2026-86062 CVSS 6.1 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx renders answer and th… |
| CVE-2026-86060 | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability KEVCVSS 9.8MikroTik | MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS… |
| CVE-2026-8606 | CVE-2026-8606 CVSS 5.9github | A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP reques… |
| CVE-2026-86059 | CVE-2026-86059 CVSS 9.6 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintex… |
| CVE-2026-86056 | CVE-2026-86056 CVSS 5.5 | Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a s… |
| CVE-2026-86054 | CVE-2026-86054 CVSS 7.8 | Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in NppParameters::writeSession in PowerEdito… |
| CVE-2026-8605 | CVE-2026-8605 CVSS 9.8scadabr | In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin. |
| CVE-2026-86049 | CVE-2026-86049 CVSS 7.1 | Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer h… |
| CVE-2026-86043 | CVE-2026-86043 CVSS 7.5 | Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversize… |
| CVE-2026-86040 | CVE-2026-86040 CVSS 7.5 | libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 … |
| CVE-2026-8604 | CVE-2026-8604 CVSS 8.8scadabr | In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in u… |
| CVE-2026-86039 | CVE-2026-86039 CVSS 8.2 | libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses con… |
| CVE-2026-86038 | CVE-2026-86038 CVSS 7.5 | libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in package… |
| CVE-2026-86035 | CVE-2026-86035 CVSS 8.5 | Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vu… |
| CVE-2026-8603 | CVE-2026-8603 CVSS 9.8scadabr | In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system. |
| CVE-2026-86022 | CVE-2026-86022 CVSS 7.0 | VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a comm… |