103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 8,551–8,600 of 103,766 · page 172 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-85720 | CVE-2026-85720 CVSS 5.9 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 a… |
| CVE-2026-85719 | CVE-2026-85719 CVSS 7.5 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 a… |
| CVE-2026-85718 | CVE-2026-85718 CVSS 5.9 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, … |
| CVE-2026-85717 | CVE-2026-85717 CVSS 6.8 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and… |
| CVE-2026-85716 | CVE-2026-85716 CVSS 3.7 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, … |
| CVE-2026-85715 | CVE-2026-85715 CVSS 7.5 | ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems() within src… |
| CVE-2026-85714 | CVE-2026-85714 CVSS 9.1 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the de… |
| CVE-2026-8571 | CVE-2026-8571 CVSS 8.3 | Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process t… |
| CVE-2026-85709 | CVE-2026-85709 CVSS 5.3 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers… |
| CVE-2026-85706 | GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability KEVCVSS 10.0GitLab | GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an i… |
| CVE-2026-85705 | CVE-2026-85705 CVSS 7.5 | The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and … |
| CVE-2026-85704 | CVE-2026-85704 CVSS 3.7 | A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function getJailbreak … |
| CVE-2026-85703 | CVE-2026-85703 CVSS 6.5 | A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the … |
| CVE-2026-85702 | CVE-2026-85702 CVSS 7.3 | A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function _conversation… |
| CVE-2026-85701 | CVE-2026-85701 CVSS 5.3 | A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.cre… |
| CVE-2026-85700 | CVE-2026-85700 CVSS 6.5 | Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API key… |
| CVE-2026-85699 | CVE-2026-85699 CVSS 7.5 | jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequ… |
| CVE-2026-85698 | CVE-2026-85698 CVSS 5.5 | Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without … |
| CVE-2026-85697 | CVE-2026-85697 CVSS 6.5 | Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low p… |
| CVE-2026-85696 | CVE-2026-85696 CVSS 9.8 | SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands witho… |
| CVE-2026-85695 | CVE-2026-85695 CVSS 9.4 | FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker ad… |
| CVE-2026-85694 | CVE-2026-85694 CVSS 8.1 | LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output d… |
| CVE-2026-85693 | CVE-2026-85693 CVSS 6.5 | Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belongin… |
| CVE-2026-85692 | CVE-2026-85692 CVSS 6.5 | Nightingale (n9e), as of commit 8362cbe (main branch, confirmed 2026-08-27), contains a server-side request forgery vulnerability in the isPublicIP function in… |
| CVE-2026-85691 | CVE-2026-85691 CVSS 7.5 | MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-si… |
| CVE-2026-85690 | CVE-2026-85690 CVSS 7.8 | Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files outside the project directory. Attackers … |
| CVE-2026-8569 | CVE-2026-8569 CVSS 8.3 | Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted v… |
| CVE-2026-85689 | CVE-2026-85689 CVSS 6.5 | llmware 0.4.6 contains an SQL injection vulnerability in the collection-database layer (llmware/resources.py) where filter and lookup values are directly strin… |
| CVE-2026-85688 | CVE-2026-85688 CVSS 9.8 | TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can sub… |
| CVE-2026-85687 | CVE-2026-85687 CVSS 7.5 | surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file_path… |
| CVE-2026-85686 | CVE-2026-85686 CVSS 7.5 | ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without valida… |
| CVE-2026-85685 | CVE-2026-85685 CVSS 7.5 | AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent work… |
| CVE-2026-85684 | CVE-2026-85684 CVSS 9.1 | marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthen… |
| CVE-2026-85682 | CVE-2026-85682 CVSS 8.8 | The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting… |
| CVE-2026-85681 | CVE-2026-85681 CVSS 9.8 | The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users,… |
| CVE-2026-85680 | CVE-2026-85680 CVSS 8.8 | The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, an… |
| CVE-2026-85679 | CVE-2026-85679 CVSS 7.2 | The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 … |
| CVE-2026-85678 | CVE-2026-85678 CVSS 6.8 | The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, … |
| CVE-2026-85677 | CVE-2026-85677 CVSS 8.8 | The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, app… |
| CVE-2026-85676 | CVE-2026-85676 CVSS 4.3 | Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforc… |
| CVE-2026-85675 | CVE-2026-85675 CVSS 7.5 | OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that fetches caller-supplied URLs wit… |
| CVE-2026-85674 | CVE-2026-85674 CVSS 7.8 | aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set… |
| CVE-2026-85673 | CVE-2026-85673 CVSS 7.5 | LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attack… |
| CVE-2026-85672 | CVE-2026-85672 CVSS 9.8 | zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is int… |
| CVE-2026-85671 | CVE-2026-85671 CVSS 7.5 | QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints that allows un… |
| CVE-2026-85670 | CVE-2026-85670 CVSS 6.5 | tokenizers (Hugging Face) is affected by an out-of-bounds buffer access in BpeBuilder::build (tokenizers/src/models/bpe/model.rs). When loading a tokenizer.jso… |
| CVE-2026-85669 | CVE-2026-85669 CVSS 6.5 | potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpoint. Authenticated attackers can write … |
| CVE-2026-85668 | CVE-2026-85668 CVSS 7.5 | Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint… |
| CVE-2026-85667 | CVE-2026-85667 CVSS 9.1 | xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary me… |
| CVE-2026-85666 | CVE-2026-85666 CVSS 7.5 | OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/… |