103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 8,901–8,950 of 103,766 · page 179 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-85279 | CVE-2026-85279 CVSS 8.6 | Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in Pow… |
| CVE-2026-85274 | CVE-2026-85274 CVSS 6.5 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Recurring::stop() as a… |
| CVE-2026-85272 | CVE-2026-85272 CVSS 4.3 | Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive.… |
| CVE-2026-85271 | CVE-2026-85271 CVSS 6.1 | Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_… |
| CVE-2026-8527 | CVE-2026-8527 CVSS 8.8 | Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a craf… |
| CVE-2026-8526 | CVE-2026-8526 CVSS 8.8 | Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML … |
| CVE-2026-8525 | CVE-2026-8525 CVSS 8.3 | Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
| CVE-2026-85242 | CVE-2026-85242 | PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retrieval functionality. When only_global_lookup is enabled, the a… |
| CVE-2026-85241 | CVE-2026-85241 CVSS 6.3 | A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.… |
| CVE-2026-8524 | CVE-2026-8524 CVSS 8.8 | Out of bounds write in WebAudio in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTM… |
| CVE-2026-85239 | CVE-2026-85239 CVSS 6.5misp-project | A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the… |
| CVE-2026-85238 | CVE-2026-85238 CVSS 6.8misp-project | MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated throu… |
| CVE-2026-85237 | CVE-2026-85237 CVSS 8.1misp-project | A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification att… |
| CVE-2026-85236 | CVE-2026-85236 CVSS 8.8misp-project | A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible opera… |
| CVE-2026-85235 | CVE-2026-85235 CVSS 7.2 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textare… |
| CVE-2026-85234 | CVE-2026-85234 CVSS 7.5 | A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can p… |
| CVE-2026-85230 | CVE-2026-85230 CVSS 5.4misp-project | A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the wid… |
| CVE-2026-8523 | CVE-2026-8523 CVSS 8.3 | Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
| CVE-2026-85229 | CVE-2026-85229 CVSS 6.1 | ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster… |
| CVE-2026-85228 | CVE-2026-85228 CVSS 9.1 | An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remot… |
| CVE-2026-85227 | CVE-2026-85227 CVSS 6.1misp-project | MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttri… |
| CVE-2026-85226 | CVE-2026-85226 CVSS 4.3misp-project | MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applyin… |
| CVE-2026-85225 | CVE-2026-85225 CVSS 7.3 | A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient_login.php. The mani… |
| CVE-2026-85224 | CVE-2026-85224 CVSS 9.1 | A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file_sharing.cgi of the component File Shar… |
| CVE-2026-85223 | CVE-2026-85223 CVSS 9.9 | A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CG… |
| CVE-2026-85222 | CVE-2026-85222 CVSS 9.1 | A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of … |
| CVE-2026-85221 | CVE-2026-85221 CVSS 9.1misp-project | MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and there… |
| CVE-2026-85220 | CVE-2026-85220 CVSS 3.7 | A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeyp… |
| CVE-2026-8522 | CVE-2026-8522 CVSS 8.8 | Use after free in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chrom… |
| CVE-2026-85219 | CVE-2026-85219 CVSS 3.7 | Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage. |
| CVE-2026-85217 | CVE-2026-85217 CVSS 8.6 | A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or… |
| CVE-2026-85216 | CVE-2026-85216 CVSS 9.8misp-project | MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentia… |
| CVE-2026-85215 | CVE-2026-85215 CVSS 7.1 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GG Soft Software Services Inc. Paperwork allows SQL Injec… |
| CVE-2026-85214 | CVE-2026-85214 CVSS 8.1 | vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID… |
| CVE-2026-85213 | CVE-2026-85213 CVSS 7.6 | Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfR… |
| CVE-2026-85212 | CVE-2026-85212 CVSS 8.3 | CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Su… |
| CVE-2026-85211 | CVE-2026-85211 CVSS 7.7 | Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenan… |
| CVE-2026-85210 | CVE-2026-85210 CVSS 4.3 | Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts… |
| CVE-2026-85209 | CVE-2026-85209 CVSS 6.5 | Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting In… |
| CVE-2026-85208 | CVE-2026-85208 CVSS 7.3 | A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/order… |
| CVE-2026-85207 | CVE-2026-85207 CVSS 3.5 | A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such… |
| CVE-2026-85205 | CVE-2026-85205 CVSS 6.3 | A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controlle… |
| CVE-2026-85201 | CVE-2026-85201 | In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received thr… |
| CVE-2026-85200 | CVE-2026-85200 CVSS 7.5 | The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_locator_ajax_info_wind… |
| CVE-2026-8520 | CVE-2026-8520 CVSS 8.3 | Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium … |
| CVE-2026-85199 | CVE-2026-85199 | Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, up… |
| CVE-2026-85198 | CVE-2026-85198 CVSS 6.5 | The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versio… |
| CVE-2026-85197 | CVE-2026-85197 CVSS 7.6 | A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 cli… |
| CVE-2026-85196 | CVE-2026-85196 | Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0 - Articles A… |
| CVE-2026-85195 | CVE-2026-85195 | Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0 - Articles Anywhere accepts link … |