103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 8,651–8,700 of 103,766 · page 174 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-85603 | CVE-2026-85603 CVSS 6.5 | Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An… |
| CVE-2026-85602 | CVE-2026-85602 CVSS 5.3 | The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key… |
| CVE-2026-85601 | CVE-2026-85601 CVSS 5.4 | Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and Mar… |
| CVE-2026-85600 | CVE-2026-85600 CVSS 5.4 | Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tHtml() function (src/lib/stores/i18n.sve… |
| CVE-2026-85599 | CVE-2026-85599 CVSS 7.2 | Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary parameter that are wri… |
| CVE-2026-85598 | CVE-2026-85598 CVSS 6.4 | Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payl… |
| CVE-2026-85597 | CVE-2026-85597 CVSS 9.1traefik | Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass clien… |
| CVE-2026-85596 | CVE-2026-85596 CVSS 9.8traefik | Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress ca… |
| CVE-2026-85595 | CVE-2026-85595 CVSS 9.8traefik | Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown … |
| CVE-2026-85594 | CVE-2026-85594 CVSS 9.8traefik | Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation i… |
| CVE-2026-85593 | CVE-2026-85593 CVSS 5.4 | phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on s… |
| CVE-2026-85592 | CVE-2026-85592 CVSS 3.7 | phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed() method grants acces… |
| CVE-2026-85591 | CVE-2026-85591 | phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to cha… |
| CVE-2026-85590 | CVE-2026-85590 | phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality. The removeTwofactorConfig(… |
| CVE-2026-85589 | CVE-2026-85589 | phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only… |
| CVE-2026-85588 | CVE-2026-85588 | phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extra… |
| CVE-2026-85587 | CVE-2026-85587 | phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attac… |
| CVE-2026-85586 | CVE-2026-85586 | phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can… |
| CVE-2026-85585 | CVE-2026-85585 CVSS 7.5 | SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique… |
| CVE-2026-85584 | CVE-2026-85584 CVSS 7.5 | SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attac… |
| CVE-2026-85583 | CVE-2026-85583 CVSS 6.5 | SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized … |
| CVE-2026-85582 | CVE-2026-85582 CVSS 6.5 | SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers… |
| CVE-2026-85581 | CVE-2026-85581 CVSS 7.5 | SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled… |
| CVE-2026-85580 | CVE-2026-85580 CVSS 6.5 | SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. … |
| CVE-2026-8558 | CVE-2026-8558 CVSS 8.8 | Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML p… |
| CVE-2026-85579 | CVE-2026-85579 CVSS 4.3 | SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2) in the reader-accessible POST /api/transactions/undoState … |
| CVE-2026-85578 | CVE-2026-85578 CVSS 6.5 | SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks expl… |
| CVE-2026-85577 | CVE-2026-85577 CVSS 5.4 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitr… |
| CVE-2026-85576 | CVE-2026-85576 CVSS 4.3 | The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving… |
| CVE-2026-85575 | CVE-2026-85575 CVSS 6.4 | The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable … |
| CVE-2026-85574 | CVE-2026-85574 CVSS 8.0 | The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on… |
| CVE-2026-85573 | CVE-2026-85573 CVSS 8.8 | The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authe… |
| CVE-2026-85572 | CVE-2026-85572 CVSS 4.3 | The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any aut… |
| CVE-2026-85571 | CVE-2026-85571 CVSS 6.5 | The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester mana… |
| CVE-2026-85569 | CVE-2026-85569 CVSS 7.2 | The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce th… |
| CVE-2026-85568 | CVE-2026-85568 CVSS 6.8 | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement… |
| CVE-2026-8555 | CVE-2026-8555 CVSS 8.8 | Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromiu… |
| CVE-2026-85547 | CVE-2026-85547 | A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request … |
| CVE-2026-85546 | CVE-2026-85546 | MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServ… |
| CVE-2026-85545 | CVE-2026-85545 CVSS 7.1 | There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not author… |
| CVE-2026-85544 | CVE-2026-85544 CVSS 6.1 | Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within … |
| CVE-2026-85543 | CVE-2026-85543 CVSS 4.3 | Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device W… |
| CVE-2026-85542 | CVE-2026-85542 CVSS 8.8 | IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provid… |
| CVE-2026-85541 | CVE-2026-85541 CVSS 5.4 | DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in … |
| CVE-2026-85540 | CVE-2026-85540 CVSS 8.8 | DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and dele… |
| CVE-2026-85538 | CVE-2026-85538 | An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required perm_modify or perm_… |
| CVE-2026-85534 | CVE-2026-85534 CVSS 5.9 | A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flo… |
| CVE-2026-85533 | CVE-2026-85533 | An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to use the referenced S… |
| CVE-2026-85532 | CVE-2026-85532 CVSS 7.5apache | Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive C… |
| CVE-2026-85531 | CVE-2026-85531 CVSS 9.8 | Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature… |