103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 8,351–8,400 of 103,766 · page 168 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-85984 | CVE-2026-85984 CVSS 9.8 | The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter i… |
| CVE-2026-85983 | CVE-2026-85983 CVSS 7.8 | The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify t… |
| CVE-2026-85982 | CVE-2026-85982 CVSS 9.0 | The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log c… |
| CVE-2026-85981 | CVE-2026-85981 CVSS 6.7 | The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. … |
| CVE-2026-8598 | CVE-2026-8598 CVSS 9.1 | An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical… |
| CVE-2026-85979 | CVE-2026-85979 | Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitr… |
| CVE-2026-85978 | CVE-2026-85978 CVSS 9.8 | An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the… |
| CVE-2026-85976 | CVE-2026-85976 CVSS 5.4 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-explora… |
| CVE-2026-85975 | CVE-2026-85975 CVSS 7.5 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A netwo… |
| CVE-2026-85974 | CVE-2026-85974 CVSS 7.4 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbou… |
| CVE-2026-85973 | CVE-2026-85973 CVSS 7.4 | Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned attacker … |
| CVE-2026-85972 | CVE-2026-85972 CVSS 7.4 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication serv… |
| CVE-2026-85971 | CVE-2026-85971 CVSS 7.1 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log file… |
| CVE-2026-85970 | CVE-2026-85970 CVSS 7.1 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths… |
| CVE-2026-85969 | CVE-2026-85969 CVSS 7.1 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processi… |
| CVE-2026-85968 | CVE-2026-85968 CVSS 7.1 | Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authentic… |
| CVE-2026-85967 | CVE-2026-85967 CVSS 6.1 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that could allow a remote at… |
| CVE-2026-85966 | CVE-2026-85966 CVSS 7.7 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive informa… |
| CVE-2026-85965 | CVE-2026-85965 CVSS 8.0 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that c… |
| CVE-2026-85964 | CVE-2026-85964 CVSS 7.7 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to… |
| CVE-2026-85963 | CVE-2026-85963 CVSS 7.5 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could a… |
| CVE-2026-85962 | CVE-2026-85962 CVSS 7.5 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In d… |
| CVE-2026-85961 | CVE-2026-85961 CVSS 7.5 | On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication inform… |
| CVE-2026-85960 | CVE-2026-85960 CVSS 7.5 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures… |
| CVE-2026-85959 | CVE-2026-85959 CVSS 7.5 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs… |
| CVE-2026-85958 | CVE-2026-85958 CVSS 7.5 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacke… |
| CVE-2026-85957 | CVE-2026-85957 CVSS 7.5 | Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result i… |
| CVE-2026-85956 | CVE-2026-85956 CVSS 9.6 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges … |
| CVE-2026-85955 | CVE-2026-85955 CVSS 9.9 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery e… |
| CVE-2026-85954 | CVE-2026-85954 CVSS 8.6 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQue… |
| CVE-2026-85953 | CVE-2026-85953 CVSS 8.5 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently val… |
| CVE-2026-85952 | CVE-2026-85952 CVSS 8.5 | Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability … |
| CVE-2026-85951 | CVE-2026-85951 CVSS 8.5 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could a… |
| CVE-2026-85950 | CVE-2026-85950 CVSS 8.4 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with adm… |
| CVE-2026-8595 | CVE-2026-8595 CVSS 6.8grafana | A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of an… |
| CVE-2026-85949 | CVE-2026-85949 CVSS 8.1 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certai… |
| CVE-2026-85948 | CVE-2026-85948 CVSS 9.9 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package p… |
| CVE-2026-85947 | CVE-2026-85947 CVSS 9.9 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A … |
| CVE-2026-85945 | CVE-2026-85945 CVSS 7.8 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85943 | CVE-2026-85943 CVSS 7.0 | Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85941 | CVE-2026-85941 CVSS 7.0 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privi… |
| CVE-2026-8594 | CVE-2026-8594 CVSS 6.2 | Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. Text::LineFold splits the input string… |
| CVE-2026-85939 | CVE-2026-85939 CVSS 5.3 | Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network. |
| CVE-2026-85938 | CVE-2026-85938 CVSS 5.5 | Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. |
| CVE-2026-85936 | CVE-2026-85936 CVSS 8.8 | Double free in Windows Shell allows an unauthorized attacker to execute code over a network. |
| CVE-2026-85935 | CVE-2026-85935 CVSS 5.5 | Buffer over-read in Windows USB Driver allows an authorized attacker to disclose information locally. |
| CVE-2026-85934 | CVE-2026-85934 CVSS 7.0 | Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85933 | CVE-2026-85933 CVSS 7.8 | Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85932 | CVE-2026-85932 CVSS 6.5microsoft | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose informa… |
| CVE-2026-85931 | CVE-2026-85931 CVSS 8.8 | Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network. |