103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 8,601–8,650 of 103,766 · page 173 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-85665 | CVE-2026-85665 CVSS 6.5 | Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directo… |
| CVE-2026-85664 | CVE-2026-85664 CVSS 7.5 | Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthentic… |
| CVE-2026-85663 | CVE-2026-85663 CVSS 9.8 | Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated… |
| CVE-2026-85662 | CVE-2026-85662 CVSS 5.3 | Marqo 2.26.0 contains a server-side request forgery vulnerability in the add_documents endpoint that allows unauthenticated attackers to trigger requests to ar… |
| CVE-2026-85661 | CVE-2026-85661 CVSS 9.8 | excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. At… |
| CVE-2026-85660 | CVE-2026-85660 CVSS 8.1 | cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function when ALLOW_SHELL_OPERATORS is enabled. … |
| CVE-2026-85658 | CVE-2026-85658 CVSS 8.1 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
| CVE-2026-85657 | CVE-2026-85657 CVSS 5.4 | The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
| CVE-2026-85656 | CVE-2026-85656 CVSS 7.8 | An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands … |
| CVE-2026-85654 | CVE-2026-85654 CVSS 7.8 | Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a con… |
| CVE-2026-85653 | CVE-2026-85653 CVSS 6.4 | The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'other_attributes' Block Parameter in all versions up to, an… |
| CVE-2026-85652 | CVE-2026-85652 CVSS 6.5 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in… |
| CVE-2026-85651 | CVE-2026-85651 CVSS 8.5 | Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs in… |
| CVE-2026-85650 | CVE-2026-85650 CVSS 5.4 | Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSR… |
| CVE-2026-85649 | CVE-2026-85649 CVSS 7.9 | (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops … |
| CVE-2026-85645 | CVE-2026-85645 CVSS 6.1 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_ac… |
| CVE-2026-85644 | CVE-2026-85644 CVSS 7.5 | XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference. The wrapper function XS::Parse::Infix generates for a list-ass… |
| CVE-2026-85643 | CVE-2026-85643 CVSS 4.7 | A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli_query of the file admin/adduser.php. Executing a manipulatio… |
| CVE-2026-85641 | CVE-2026-85641 CVSS 4.3 | The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on th… |
| CVE-2026-85640 | CVE-2026-85640 CVSS 6.3 | Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component |
| CVE-2026-85639 | CVE-2026-85639 CVSS 5.6 | A security vulnerability has been detected in jofpin trape 2.0. This vulnerability affects unknown code of the file core/user.py of the component Telemetry End… |
| CVE-2026-85638 | CVE-2026-85638 CVSS 7.3 | A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes auth… |
| CVE-2026-85637 | CVE-2026-85637 CVSS 5.3 | A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function join_room of the file core/sockets.py of the component Ad… |
| CVE-2026-85636 | CVE-2026-85636 CVSS 5.3 | A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Log… |
| CVE-2026-85634 | CVE-2026-85634 CVSS 8.8 | A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server… |
| CVE-2026-85630 | CVE-2026-85630 CVSS 6.1 | HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method. Any application with fi… |
| CVE-2026-85628 | CVE-2026-85628 | Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors, in v… |
| CVE-2026-85626 | CVE-2026-85626 CVSS 7.5 | git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-… |
| CVE-2026-85625 | CVE-2026-85625 CVSS 8.1 | sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. Th… |
| CVE-2026-85624 | CVE-2026-85624 CVSS 6.5 | Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied… |
| CVE-2026-85623 | CVE-2026-85623 CVSS 8.8 | goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes … |
| CVE-2026-85622 | CVE-2026-85622 CVSS 5.3 | AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowin… |
| CVE-2026-85621 | CVE-2026-85621 CVSS 6.5 | LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route (/api/agent/webhook… |
| CVE-2026-85620 | CVE-2026-85620 CVSS 8.6 | Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. At… |
| CVE-2026-85619 | CVE-2026-85619 CVSS 7.5 | AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and… |
| CVE-2026-85618 | CVE-2026-85618 CVSS 6.5 | ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files w… |
| CVE-2026-85617 | CVE-2026-85617 CVSS 8.8snipeitapp | snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users… |
| CVE-2026-85616 | CVE-2026-85616 CVSS 8.5snipeitapp | Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enable… |
| CVE-2026-85615 | CVE-2026-85615 CVSS 6.4 | Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to … |
| CVE-2026-85614 | CVE-2026-85614 CVSS 8.6 | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully clien… |
| CVE-2026-85613 | CVE-2026-85613 CVSS 8.2 | OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attacke… |
| CVE-2026-85612 | CVE-2026-85612 CVSS 7.5 | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacke… |
| CVE-2026-85611 | CVE-2026-85611 CVSS 6.4 | OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures … |
| CVE-2026-85610 | CVE-2026-85610 CVSS 8.8 | OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code … |
| CVE-2026-85609 | CVE-2026-85609 CVSS 7.5 | Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api… |
| CVE-2026-85608 | CVE-2026-85608 CVSS 7.5 | Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video_data endpoints that al… |
| CVE-2026-85607 | CVE-2026-85607 CVSS 8.8 | Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.update, message.delete, message.clearAfte… |
| CVE-2026-85606 | CVE-2026-85606 CVSS 7.5 | firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments witho… |
| CVE-2026-85605 | CVE-2026-85605 CVSS 5.3 | Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/imag… |
| CVE-2026-85604 | CVE-2026-85604 CVSS 8.8 | Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.… |