103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 9,051–9,100 of 103,766 · page 182 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-85082 | CVE-2026-85082 | Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command. |
| CVE-2026-85081 | CVE-2026-85081 CVSS 7.5 | The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly … |
| CVE-2026-8508 | CVE-2026-8508 CVSS 6.5 | An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacke… |
| CVE-2026-85078 | CVE-2026-85078 CVSS 6.5 | Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part aft… |
| CVE-2026-85077 | CVE-2026-85077 CVSS 8.2 | Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py… |
| CVE-2026-8507 | CVE-2026-8507 CVSS 9.8 | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws. When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT S… |
| CVE-2026-85063 | CVE-2026-85063 | node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by… |
| CVE-2026-85062 | CVE-2026-85062 | Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/color… |
| CVE-2026-85061 | CVE-2026-85061 CVSS 10.0 | MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live… |
| CVE-2026-85058 | CVE-2026-85058 CVSS 7.5 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers… |
| CVE-2026-85057 | CVE-2026-85057 CVSS 8.7 | ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() regis… |
| CVE-2026-85056 | CVE-2026-85056 CVSS 8.2 | ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can… |
| CVE-2026-85055 | CVE-2026-85055 | Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields bu… |
| CVE-2026-85053 | CVE-2026-85053 CVSS 8.8google | Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a… |
| CVE-2026-85052 | CVE-2026-85052 CVSS 3.1google | Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory … |
| CVE-2026-85051 | CVE-2026-85051 CVSS 8.8google | Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… |
| CVE-2026-85050 | CVE-2026-85050 CVSS 9.6google | Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via … |
| CVE-2026-8505 | CVE-2026-8505 CVSS 9.8langflow | IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of a… |
| CVE-2026-85049 | CVE-2026-85049 CVSS 8.8google | Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. … |
| CVE-2026-85048 | CVE-2026-85048 CVSS 8.3google | Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary c… |
| CVE-2026-85047 | CVE-2026-85047 CVSS 9.6google | Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary… |
| CVE-2026-85046 | Google Chromium V8 Type Confusion Vulnerability KEVCVSS 8.8Google | Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. … |
| CVE-2026-85045 | CVE-2026-85045 CVSS 7.5google | Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
| CVE-2026-85044 | CVE-2026-85044 CVSS 6.5google | Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web … |
| CVE-2026-85043 | CVE-2026-85043 CVSS 9.1google | Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via crafted network traffi… |
| CVE-2026-85042 | CVE-2026-85042 CVSS 9.6google | Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML p… |
| CVE-2026-85040 | CVE-2026-85040 CVSS 4.7 | A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/sav… |
| CVE-2026-85038 | CVE-2026-85038 CVSS 5.3 | The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a ro… |
| CVE-2026-85037 | CVE-2026-85037 CVSS 5.3 | The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is a… |
| CVE-2026-85031 | CVE-2026-85031 CVSS 9.9 | A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of t… |
| CVE-2026-85030 | CVE-2026-85030 CVSS 3.7 | A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file servi… |
| CVE-2026-85029 | CVE-2026-85029 CVSS 7.5 | IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to impro… |
| CVE-2026-85028 | CVE-2026-85028 CVSS 7.8 | Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga)… |
| CVE-2026-85025 | CVE-2026-85025 CVSS 9.8langflow | IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through pub… |
| CVE-2026-85024 | CVE-2026-85024 CVSS 5.9nodejs | undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error … |
| CVE-2026-85022 | CVE-2026-85022 CVSS 3.5 | A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webap… |
| CVE-2026-85021 | CVE-2026-85021 CVSS 4.3 | A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of th… |
| CVE-2026-8502 | CVE-2026-8502 CVSS 5.3 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u… |
| CVE-2026-85017 | CVE-2026-85017 CVSS 7.5 | The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled … |
| CVE-2026-85016 | CVE-2026-85016 CVSS 6.8 | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared … |
| CVE-2026-85015 | CVE-2026-85015 CVSS 6.6 | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing auth… |
| CVE-2026-85014 | CVE-2026-85014 CVSS 5.9nodejs | undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake… |
| CVE-2026-85013 | CVE-2026-85013 CVSS 7.3 | A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the… |
| CVE-2026-85012 | CVE-2026-85012 CVSS 8.0 | Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprint… |
| CVE-2026-85010 | CVE-2026-85010 CVSS 5.3 | The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in th… |
| CVE-2026-8501 | CVE-2026-8501 CVSS 7.8 | Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM d… |
| CVE-2026-85009 | CVE-2026-85009 CVSS 6.5 | The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, al… |
| CVE-2026-85008 | CVE-2026-85008 CVSS 3.7nodejs | undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from … |
| CVE-2026-85006 | CVE-2026-85006 CVSS 6.8 | The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML at… |
| CVE-2026-85005 | CVE-2026-85005 CVSS 5.4 | The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged… |