103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 9,101–9,150 of 103,766 · page 183 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-85004 | CVE-2026-85004 CVSS 4.3 | The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing … |
| CVE-2026-85002 | CVE-2026-85002 CVSS 6.8 | The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow user… |
| CVE-2026-85001 | CVE-2026-85001 CVSS 6.8 | The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, wh… |
| CVE-2026-85000 | CVE-2026-85000 CVSS 5.3 | The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credent… |
| CVE-2026-8500 | CVE-2026-8500 CVSS 9.8 | Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is a small CGI application for managing htpasswd files using the htpasswd command… |
| CVE-2026-84997 | CVE-2026-84997 CVSS 7.5 | react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter … |
| CVE-2026-84994 | CVE-2026-84994 | Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserializ… |
| CVE-2026-84993 | CVE-2026-84993 CVSS 6.5 | MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 and 7.1.7, the shared SQL layer validate… |
| CVE-2026-84992 | CVE-2026-84992 CVSS 6.1 | md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEdito… |
| CVE-2026-84990 | CVE-2026-84990 CVSS 8.8 | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and… |
| CVE-2026-8499 | CVE-2026-8499 CVSS 5.3 | The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in versions up to, and including, 1.2.9. This… |
| CVE-2026-84989 | CVE-2026-84989 CVSS 7.1 | ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge featur… |
| CVE-2026-84975 | CVE-2026-84975 CVSS 7.4 | PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuTLS backends in pjlib/src/pj/ssl_sock_os… |
| CVE-2026-84971 | CVE-2026-84971 CVSS 6.5mongodb | Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the … |
| CVE-2026-84970 | CVE-2026-84970 CVSS 6.2mongodb | A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding a… |
| CVE-2026-8497 | CVE-2026-8497 CVSS 7.4devolutions | Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS… |
| CVE-2026-84969 | CVE-2026-84969 CVSS 3.7mongodb | A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a b… |
| CVE-2026-84968 | CVE-2026-84968 CVSS 5.3mongodb | An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a… |
| CVE-2026-84967 | CVE-2026-84967 CVSS 4.3mongodb | A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a co… |
| CVE-2026-84966 | CVE-2026-84966 CVSS 5.1mongodb | An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. … |
| CVE-2026-84965 | CVE-2026-84965 CVSS 5.1mongodb | An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operat… |
| CVE-2026-84964 | CVE-2026-84964 CVSS 5.9mongodb | A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already tr… |
| CVE-2026-84963 | CVE-2026-84963 CVSS 5.3mongodb | An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently sho… |
| CVE-2026-84962 | CVE-2026-84962 CVSS 4.2mongodb | An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorize… |
| CVE-2026-84961 | CVE-2026-84961 CVSS 7.4nodejs | undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON … |
| CVE-2026-84960 | CVE-2026-84960 CVSS 6.1 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including… |
| CVE-2026-8496 | CVE-2026-8496 CVSS 6.1 | A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScr… |
| CVE-2026-8495 | CVE-2026-8495 CVSS 9.8date_ical_project | Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15. |
| CVE-2026-84947 | CVE-2026-84947 CVSS 3.7nodejs | undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maxi… |
| CVE-2026-84942 | CVE-2026-84942 CVSS 8.7 | Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write perm… |
| CVE-2026-84941 | CVE-2026-84941 | An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration… |
| CVE-2026-84939 | CVE-2026-84939 CVSS 9.1apache | Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarke… |
| CVE-2026-84937 | CVE-2026-84937 CVSS 6.8 | The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allow… |
| CVE-2026-84936 | CVE-2026-84936 CVSS 5.3 | The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the… |
| CVE-2026-84935 | CVE-2026-84935 CVSS 8.0 | The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not es… |
| CVE-2026-84934 | CVE-2026-84934 CVSS 8.0 | The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which i… |
| CVE-2026-84933 | CVE-2026-84933 CVSS 6.5nodejs | undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In… |
| CVE-2026-84931 | CVE-2026-84931 CVSS 6.8 | The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's … |
| CVE-2026-84930 | CVE-2026-84930 CVSS 6.8 | The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in… |
| CVE-2026-8493 | CVE-2026-8493 CVSS 5.4colorbox_inline_project | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS).… |
| CVE-2026-84927 | CVE-2026-84927 CVSS 2.7 | The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users wi… |
| CVE-2026-84926 | CVE-2026-84926 CVSS 2.7 | The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authe… |
| CVE-2026-84925 | CVE-2026-84925 CVSS 6.1 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all ver… |
| CVE-2026-8492 | CVE-2026-8492 CVSS 2.7gtranslate | Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects T… |
| CVE-2026-8491 | CVE-2026-8491 CVSS 3.7adcisolutions | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing. This issue affects Node View Perm… |
| CVE-2026-84909 | CVE-2026-84909 CVSS 6.4 | The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attri… |
| CVE-2026-84908 | CVE-2026-84908 CVSS 5.3 | The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the … |
| CVE-2026-84907 | CVE-2026-84907 CVSS 3.7 | The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a non… |
| CVE-2026-84906 | CVE-2026-84906 CVSS 5.3 | The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment… |
| CVE-2026-84905 | CVE-2026-84905 CVSS 2.7 | The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level… |