103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 8,301–8,350 of 103,766 · page 167 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-86093 | CVE-2026-86093 CVSS 7.5ibm | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute a… |
| CVE-2026-86091 | CVE-2026-86091 CVSS 7.1 | ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools a… |
| CVE-2026-86090 | CVE-2026-86090 CVSS 7.1 | ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users c… |
| CVE-2026-8609 | CVE-2026-8609 CVSS 5.3grafana | An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust mem… |
| CVE-2026-86089 | CVE-2026-86089 CVSS 7.1apache | Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration s… |
| CVE-2026-86087 | CVE-2026-86087 CVSS 4.3ibm | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the … |
| CVE-2026-86085 | CVE-2026-86085 CVSS 4.9n8n | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/… |
| CVE-2026-86084 | CVE-2026-86084 CVSS 5.5n8n | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authenticatio… |
| CVE-2026-86083 | CVE-2026-86083 CVSS 8.8n8n | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mu… |
| CVE-2026-86082 | CVE-2026-86082 CVSS 6.5n8n | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restri… |
| CVE-2026-86081 | CVE-2026-86081 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destinat… |
| CVE-2026-86080 | CVE-2026-86080 CVSS 5.3n8n | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when … |
| CVE-2026-8608 | CVE-2026-8608 CVSS 5.3 | The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions… |
| CVE-2026-86079 | CVE-2026-86079 CVSS 6.5n8n | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-co… |
| CVE-2026-86078 | CVE-2026-86078 CVSS 6.5n8n | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from store… |
| CVE-2026-86077 | CVE-2026-86077 CVSS 6.5n8n | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution… |
| CVE-2026-86076 | CVE-2026-86076 CVSS 8.8n8n | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scope… |
| CVE-2026-86075 | CVE-2026-86075 CVSS 7.5n8n | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accept… |
| CVE-2026-86074 | CVE-2026-86074 CVSS 7.1n8n | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verificatio… |
| CVE-2026-86073 | CVE-2026-86073 CVSS 7.6n8n | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to th… |
| CVE-2026-86071 | CVE-2026-86071 CVSS 3.7 | Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java ca… |
| CVE-2026-86066 | CVE-2026-86066 | Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ changes attendance_v… |
| CVE-2026-86065 | CVE-2026-86065 CVSS 7.5 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes… |
| CVE-2026-86064 | CVE-2026-86064 CVSS 8.6 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.… |
| CVE-2026-86063 | CVE-2026-86063 | Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned… |
| CVE-2026-86062 | CVE-2026-86062 CVSS 6.1 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx renders answer and th… |
| CVE-2026-86060 | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability KEVCVSS 9.8MikroTik | MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS… |
| CVE-2026-8606 | CVE-2026-8606 CVSS 5.9github | A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP reques… |
| CVE-2026-86059 | CVE-2026-86059 CVSS 9.6 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintex… |
| CVE-2026-86056 | CVE-2026-86056 CVSS 5.5 | Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a s… |
| CVE-2026-86054 | CVE-2026-86054 CVSS 7.8 | Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in NppParameters::writeSession in PowerEdito… |
| CVE-2026-8605 | CVE-2026-8605 CVSS 9.8scadabr | In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin. |
| CVE-2026-86049 | CVE-2026-86049 CVSS 7.1 | Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer h… |
| CVE-2026-86043 | CVE-2026-86043 CVSS 7.5 | Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversize… |
| CVE-2026-86040 | CVE-2026-86040 CVSS 7.5 | libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 … |
| CVE-2026-8604 | CVE-2026-8604 CVSS 8.8scadabr | In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in u… |
| CVE-2026-86039 | CVE-2026-86039 CVSS 8.2 | libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses con… |
| CVE-2026-86038 | CVE-2026-86038 CVSS 7.5 | libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in package… |
| CVE-2026-86035 | CVE-2026-86035 CVSS 8.5 | Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vu… |
| CVE-2026-8603 | CVE-2026-8603 CVSS 9.8scadabr | In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system. |
| CVE-2026-86022 | CVE-2026-86022 CVSS 7.0 | VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a comm… |
| CVE-2026-8602 | CVE-2026-8602 CVSS 9.1scadabr | In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to t… |
| CVE-2026-86016 | CVE-2026-86016 CVSS 8.2 | VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YA… |
| CVE-2026-86003 | CVE-2026-86003 CVSS 7.5 | CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.g… |
| CVE-2026-86002 | CVE-2026-86002 CVSS 9.0 | Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-o… |
| CVE-2026-86000 | CVE-2026-86000 CVSS 5.3 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTI… |
| CVE-2026-85999 | CVE-2026-85999 CVSS 5.3 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw select… |
| CVE-2026-85995 | CVE-2026-85995 CVSS 7.3 | Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP… |
| CVE-2026-85990 | CVE-2026-85990 CVSS 8.8 | Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime'… |
| CVE-2026-8599 | CVE-2026-8599 CVSS 6.4 | The MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Camp… |