103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 8,951–9,000 of 103,766 · page 180 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-85192 | CVE-2026-85192 | Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0 - Conditional Content … |
| CVE-2026-85191 | CVE-2026-85191 | Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0 - Tabs & Accordions rewrites… |
| CVE-2026-85190 | CVE-2026-85190 | Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5 - Quick Index inserts configurable clas… |
| CVE-2026-8519 | CVE-2026-8519 CVSS 8.8 | Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted … |
| CVE-2026-85189 | CVE-2026-85189 | Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0 - Modals treats a destination usi… |
| CVE-2026-85188 | CVE-2026-85188 | Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content… |
| CVE-2026-85187 | CVE-2026-85187 CVSS 7.3 | A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the fi… |
| CVE-2026-85186 | CVE-2026-85186 CVSS 6.3 | A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /c… |
| CVE-2026-85185 | CVE-2026-85185 CVSS 9.6 | Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticate… |
| CVE-2026-85184 | CVE-2026-85184 CVSS 9.1fastify | @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify r… |
| CVE-2026-85183 | CVE-2026-85183 CVSS 9.3 | Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connecti… |
| CVE-2026-85182 | CVE-2026-85182 CVSS 7.5 | vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change… |
| CVE-2026-85181 | CVE-2026-85181 CVSS 9.8 | CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. … |
| CVE-2026-85180 | CVE-2026-85180 CVSS 7.5 | Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hos… |
| CVE-2026-8518 | CVE-2026-8518 CVSS 8.8 | Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. … |
| CVE-2026-85179 | CVE-2026-85179 CVSS 8.5 | Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses… |
| CVE-2026-85178 | CVE-2026-85178 CVSS 7.7 | Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization… |
| CVE-2026-85177 | CVE-2026-85177 CVSS 5.4 | CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbi… |
| CVE-2026-85176 | CVE-2026-85176 CVSS 8.8 | DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resoluti… |
| CVE-2026-85175 | CVE-2026-85175 CVSS 8.8 | SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks … |
| CVE-2026-85174 | CVE-2026-85174 CVSS 8.8 | SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Auth… |
| CVE-2026-85173 | CVE-2026-85173 CVSS 4.3n8n | n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights s… |
| CVE-2026-85172 | CVE-2026-85172 CVSS 6.4n8n | n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The va… |
| CVE-2026-85171 | CVE-2026-85171 CVSS 6.5n8n | n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decry… |
| CVE-2026-85170 | CVE-2026-85170 CVSS 6.5n8n | n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifying it is a string. … |
| CVE-2026-8517 | CVE-2026-8517 CVSS 8.8 | Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gest… |
| CVE-2026-85169 | CVE-2026-85169 CVSS 8.8n8n | n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder na… |
| CVE-2026-85168 | CVE-2026-85168 CVSS 8.8n8n | n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing … |
| CVE-2026-85167 | CVE-2026-85167 CVSS 6.5n8n | n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Qu… |
| CVE-2026-85166 | CVE-2026-85166 CVSS 6.5n8n | n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.… |
| CVE-2026-85165 | CVE-2026-85165 CVSS 9.9n8n | n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension p… |
| CVE-2026-85164 | CVE-2026-85164 CVSS 7.1 | WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profile… |
| CVE-2026-85163 | CVE-2026-85163 CVSS 6.5 | AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary i… |
| CVE-2026-85162 | CVE-2026-85162 CVSS 6.5 | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidT… |
| CVE-2026-85161 | CVE-2026-85161 CVSS 4.3 | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken chec… |
| CVE-2026-85160 | CVE-2026-85160 CVSS 8.1 | AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete director… |
| CVE-2026-85159 | CVE-2026-85159 CVSS 5.4 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href att… |
| CVE-2026-85158 | CVE-2026-85158 CVSS 5.4 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comme… |
| CVE-2026-85157 | CVE-2026-85157 CVSS 5.3 | WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a prog… |
| CVE-2026-85156 | CVE-2026-85156 CVSS 5.3 | WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted vide… |
| CVE-2026-85155 | CVE-2026-85155 CVSS 7.5 | WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated … |
| CVE-2026-85154 | CVE-2026-85154 CVSS 9.8 | WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full … |
| CVE-2026-85153 | CVE-2026-85153 | This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remo… |
| CVE-2026-85152 | CVE-2026-85152 CVSS 7.4nodejs | undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a … |
| CVE-2026-85150 | CVE-2026-85150 CVSS 7.5 | A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate head… |
| CVE-2026-8515 | CVE-2026-8515 CVSS 8.3 | Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially … |
| CVE-2026-85149 | CVE-2026-85149 CVSS 5.3 | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service … |
| CVE-2026-85148 | CVE-2026-85148 CVSS 9.8 | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password… |
| CVE-2026-85147 | CVE-2026-85147 CVSS 7.5 | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain a specific passwo… |
| CVE-2026-85146 | CVE-2026-85146 CVSS 9.8 | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service a… |