103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 9,001–9,050 of 103,766 · page 181 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-8514 | CVE-2026-8514 CVSS 8.3 | Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
| CVE-2026-85138 | CVE-2026-85138 CVSS 7.3 | A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipul… |
| CVE-2026-85137 | CVE-2026-85137 CVSS 7.3 | A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Col… |
| CVE-2026-85135 | CVE-2026-85135 CVSS 6.3 | A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file … |
| CVE-2026-85134 | CVE-2026-85134 CVSS 8.8 | Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Up… |
| CVE-2026-85133 | CVE-2026-85133 CVSS 5.4 | The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authen… |
| CVE-2026-85132 | CVE-2026-85132 CVSS 4.3 | The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any auth… |
| CVE-2026-85131 | CVE-2026-85131 CVSS 6.5 | The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, a… |
| CVE-2026-85130 | CVE-2026-85130 CVSS 8.8 | The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later outpu… |
| CVE-2026-8513 | CVE-2026-8513 CVSS 8.3 | Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially p… |
| CVE-2026-85129 | CVE-2026-85129 CVSS 8.8 | The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data sub… |
| CVE-2026-85128 | CVE-2026-85128 CVSS 7.5 | The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chos… |
| CVE-2026-85127 | CVE-2026-85127 CVSS 8.8 | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live ch… |
| CVE-2026-85126 | CVE-2026-85126 CVSS 7.2 | The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privilege… |
| CVE-2026-85125 | CVE-2026-85125 CVSS 5.4 | The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. The in-app browser ma… |
| CVE-2026-85124 | CVE-2026-85124 CVSS 7.5fastify | @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured… |
| CVE-2026-85123 | CVE-2026-85123 CVSS 5.3 | The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form t… |
| CVE-2026-85122 | CVE-2026-85122 CVSS 8.8 | The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form t… |
| CVE-2026-85121 | CVE-2026-85121 CVSS 9.1 | The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create an… |
| CVE-2026-8512 | CVE-2026-8512 CVSS 8.3 | Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to poten… |
| CVE-2026-85118 | CVE-2026-85118 CVSS 9.8 | The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenti… |
| CVE-2026-85117 | CVE-2026-85117 CVSS 6.5 | The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor … |
| CVE-2026-85116 | CVE-2026-85116 CVSS 6.5 | The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, i… |
| CVE-2026-85115 | CVE-2026-85115 CVSS 5.5 | A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact … |
| CVE-2026-85114 | CVE-2026-85114 CVSS 7.5 | A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validat… |
| CVE-2026-85113 | CVE-2026-85113 CVSS 6.5 | The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortc… |
| CVE-2026-85110 | CVE-2026-85110 CVSS 8.8 | A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Serv… |
| CVE-2026-8511 | CVE-2026-8511 CVSS 9.6 | Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chrom… |
| CVE-2026-85109 | CVE-2026-85109 CVSS 9.8 | A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Serve… |
| CVE-2026-85107 | CVE-2026-85107 CVSS 4.3 | A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/… |
| CVE-2026-85106 | CVE-2026-85106 CVSS 6.3 | A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.t… |
| CVE-2026-85105 | CVE-2026-85105 CVSS 7.3 | A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the component Session Mana… |
| CVE-2026-85104 | CVE-2026-85104 | In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters. |
| CVE-2026-85103 | CVE-2026-85103 CVSS 9.8 | A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Se… |
| CVE-2026-85102 | Check Point Multiple Products Improper Certificate Validation Vulnerability KEVCVSS 9.8Check Point | Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerabilit… |
| CVE-2026-85100 | CVE-2026-85100 CVSS 4.3 | A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squ… |
| CVE-2026-85097 | CVE-2026-85097 CVSS 9.8 | The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insuffici… |
| CVE-2026-85094 | CVE-2026-85094 CVSS 8.8 | The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control … |
| CVE-2026-85093 | CVE-2026-85093 CVSS 6.5 | Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticat… |
| CVE-2026-85092 | CVE-2026-85092 CVSS 6.6 | LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing … |
| CVE-2026-85091 | CVE-2026-85091 CVSS 7.4 | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations … |
| CVE-2026-85090 | CVE-2026-85090 CVSS 5.4freerdp | FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A ma… |
| CVE-2026-8509 | CVE-2026-8509 CVSS 8.8 | Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML … |
| CVE-2026-85089 | CVE-2026-85089 CVSS 6.5freerdp | FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in… |
| CVE-2026-85088 | CVE-2026-85088 | Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for clien… |
| CVE-2026-85087 | CVE-2026-85087 | Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0… |
| CVE-2026-85086 | CVE-2026-85086 | Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apac… |
| CVE-2026-85085 | CVE-2026-85085 CVSS 9.6 | The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user i… |
| CVE-2026-85084 | CVE-2026-85084 CVSS 6.3 | Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers. |
| CVE-2026-85083 | CVE-2026-85083 CVSS 6.8 | The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this we… |