103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 8,851–8,900 of 103,766 · page 178 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-85352 | CVE-2026-85352 CVSS 7.0 | Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85350 | CVE-2026-85350 CVSS 5.3 | The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campai… |
| CVE-2026-85349 | CVE-2026-85349 CVSS 4.3 | The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authe… |
| CVE-2026-85348 | CVE-2026-85348 CVSS 4.3 | The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that se… |
| CVE-2026-85345 | CVE-2026-85345 CVSS 4.1 | The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an… |
| CVE-2026-85343 | CVE-2026-85343 CVSS 7.8 | Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85342 | CVE-2026-85342 CVSS 7.0 | Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85341 | CVE-2026-85341 CVSS 7.8 | Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85340 | CVE-2026-85340 CVSS 7.8microsoft | Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. |
| CVE-2026-8534 | CVE-2026-8534 CVSS 8.3 | Integer overflow in GPU in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to po… |
| CVE-2026-85339 | CVE-2026-85339 CVSS 8.8 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine |
| CVE-2026-85338 | CVE-2026-85338 CVSS 7.8 | Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85337 | CVE-2026-85337 CVSS 6.5 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-85336 | CVE-2026-85336 CVSS 5.5 | Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally. |
| CVE-2026-85334 | CVE-2026-85334 CVSS 7.5 | Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-85333 | CVE-2026-85333 CVSS 6.7 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to ele… |
| CVE-2026-85332 | CVE-2026-85332 CVSS 7.8 | Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85331 | CVE-2026-85331 CVSS 6.5 | Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information over a network. |
| CVE-2026-8533 | CVE-2026-8533 CVSS 8.3 | Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perf… |
| CVE-2026-85329 | CVE-2026-85329 CVSS 7.0 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows an authorized attacker to elevate privi… |
| CVE-2026-85328 | CVE-2026-85328 CVSS 7.0 | Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85327 | CVE-2026-85327 CVSS 7.8 | Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85324 | CVE-2026-85324 CVSS 7.5 | Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. |
| CVE-2026-85323 | CVE-2026-85323 CVSS 6.8 | Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network. |
| CVE-2026-85322 | CVE-2026-85322 CVSS 7.5 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-85321 | CVE-2026-85321 CVSS 7.5 | Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a net… |
| CVE-2026-85320 | CVE-2026-85320 CVSS 5.5 | Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to disclose information locally. |
| CVE-2026-8532 | CVE-2026-8532 CVSS 8.8 | Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. … |
| CVE-2026-85319 | CVE-2026-85319 CVSS 7.5 | Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a net… |
| CVE-2026-85318 | CVE-2026-85318 CVSS 7.8 | Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85311 | CVE-2026-85311 CVSS 5.3 | Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ma… |
| CVE-2026-85310 | CVE-2026-85310 CVSS 6.5 | import_contacts Path Traversal in Groundhogg <= 4.7.1 versions. |
| CVE-2026-8531 | CVE-2026-8531 CVSS 8.8 | Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
| CVE-2026-85309 | CVE-2026-85309 CVSS 5.3 | Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issu… |
| CVE-2026-85308 | CVE-2026-85308 CVSS 5.3 | Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security L… |
| CVE-2026-85307 | CVE-2026-85307 CVSS 5.3 | Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP … |
| CVE-2026-85306 | CVE-2026-85306 CVSS 6.5 | Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Se… |
| CVE-2026-85305 | CVE-2026-85305 CVSS 5.4 | Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1. |
| CVE-2026-85304 | CVE-2026-85304 CVSS 5.3 | Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Conf… |
| CVE-2026-85303 | CVE-2026-85303 CVSS 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored … |
| CVE-2026-85302 | CVE-2026-85302 CVSS 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allo… |
| CVE-2026-8530 | CVE-2026-8530 CVSS 8.3 | Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially… |
| CVE-2026-85298 | CVE-2026-85298 | An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior … |
| CVE-2026-85293 | CVE-2026-85293 CVSS 4.8 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-beta-1, InvoicePlane stores client_email v… |
| CVE-2026-85292 | CVE-2026-85292 CVSS 4.8 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's User_Controller compares the… |
| CVE-2026-85291 | CVE-2026-85291 CVSS 6.5 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Users::change_password() met… |
| CVE-2026-85290 | CVE-2026-85290 CVSS 5.3 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur() method writes … |
| CVE-2026-8529 | CVE-2026-8529 CVSS 8.8 | Heap buffer overflow in Codecs in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted vide… |
| CVE-2026-85289 | CVE-2026-85289 CVSS 6.5 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensure_valid_post_reques… |
| CVE-2026-85288 | CVE-2026-85288 CVSS 6.7 | Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMAC… |