103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 9,151–9,200 of 103,766 · page 184 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-84904 | CVE-2026-84904 CVSS 3.8 | The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gatin… |
| CVE-2026-84903 | CVE-2026-84903 CVSS 2.7 | The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of … |
| CVE-2026-84902 | CVE-2026-84902 CVSS 6.8 | The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page… |
| CVE-2026-84901 | CVE-2026-84901 CVSS 4.9 | The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contribut… |
| CVE-2026-84900 | CVE-2026-84900 | Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could potentially contain security vulnerabilities. HP has released HP ThinPro 8.1 SP10, which i… |
| CVE-2026-84899 | CVE-2026-84899 CVSS 6.8 | The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users… |
| CVE-2026-84898 | CVE-2026-84898 CVSS 6.6 | The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contr… |
| CVE-2026-84897 | CVE-2026-84897 CVSS 5.3wolfssh | src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and SSH_MSG_KE… |
| CVE-2026-84896 | CVE-2026-84896 CVSS 6.8 | The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowi… |
| CVE-2026-84895 | CVE-2026-84895 CVSS 7.3 | In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSes… |
| CVE-2026-84894 | CVE-2026-84894 CVSS 7.5 | In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under … |
| CVE-2026-84893 | CVE-2026-84893 CVSS 7.6 | IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sens… |
| CVE-2026-84891 | CVE-2026-84891 CVSS 5.9ibm | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of hard-coded credentials. |
| CVE-2026-84890 | CVE-2026-84890 CVSS 5.9nodejs | undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is… |
| CVE-2026-8489 | CVE-2026-8489 CVSS 6.4 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
| CVE-2026-84889 | CVE-2026-84889 CVSS 8.8langflow | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restr… |
| CVE-2026-84888 | CVE-2026-84888 CVSS 4.3 | A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shell_exec of the file crates/openfang-runtime/src/… |
| CVE-2026-84887 | CVE-2026-84887 CVSS 4.3 | A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the componen… |
| CVE-2026-84886 | CVE-2026-84886 CVSS 5.3 | A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_… |
| CVE-2026-84885 | CVE-2026-84885 CVSS 4.3 | A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code_agent.py of the component CodeAgent. Such m… |
| CVE-2026-84884 | CVE-2026-84884 CVSS 7.5 | IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gai… |
| CVE-2026-84882 | CVE-2026-84882 CVSS 7.5 | IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker c… |
| CVE-2026-8488 | CVE-2026-8488 CVSS 4.3progress | Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVE… |
| CVE-2026-84875 | CVE-2026-84875 CVSS 7.5ibm | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. |
| CVE-2026-8487 | CVE-2026-8487 CVSS 6.5progress | Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affects MOVEit Automati… |
| CVE-2026-84869 | ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability KEVCVSS 9.9ConnectWise | ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and exe… |
| CVE-2026-84862 | CVE-2026-84862 CVSS 7.2 | IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerab… |
| CVE-2026-84860 | CVE-2026-84860 CVSS 8.8 | ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself disp… |
| CVE-2026-8486 | CVE-2026-8486 CVSS 5.3progress | Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affects MOVEit Automatio… |
| CVE-2026-84859 | CVE-2026-84859 CVSS 6.5 | ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing … |
| CVE-2026-84858 | CVE-2026-84858 CVSS 8.8 | ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataSourceEditDwr" clas… |
| CVE-2026-84857 | CVE-2026-84857 CVSS 5.3 | A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulatio… |
| CVE-2026-84856 | CVE-2026-84856 CVSS 5.3 | A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/co… |
| CVE-2026-84854 | CVE-2026-84854 CVSS 7.0 | In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amou… |
| CVE-2026-84852 | CVE-2026-84852 CVSS 4.4 | A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of … |
| CVE-2026-84851 | CVE-2026-84851 CVSS 7.5 | An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts th… |
| CVE-2026-84850 | CVE-2026-84850 CVSS 4.8 | Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a… |
| CVE-2026-8485 | CVE-2026-8485 CVSS 5.9progress | Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before … |
| CVE-2026-84849 | CVE-2026-84849 CVSS 6.5 | Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions. |
| CVE-2026-84848 | CVE-2026-84848 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions. |
| CVE-2026-84847 | CVE-2026-84847 CVSS 7.5 | Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions. |
| CVE-2026-84842 | CVE-2026-84842 CVSS 8.1ibm | IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacke… |
| CVE-2026-84841 | CVE-2026-84841 CVSS 7.3 | A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enfo… |
| CVE-2026-84840 | CVE-2026-84840 CVSS 6.5 | A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstra… |
| CVE-2026-8484 | CVE-2026-8484 | A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl()" wrapper due to a lack of size verification for the argument array before the system call… |
| CVE-2026-84839 | CVE-2026-84839 CVSS 5.3 | A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component … |
| CVE-2026-84838 | CVE-2026-84838 CVSS 7.8 | A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress p… |
| CVE-2026-84837 | CVE-2026-84837 CVSS 7.8 | A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*`… |
| CVE-2026-84836 | CVE-2026-84836 CVSS 7.1 | Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions. |
| CVE-2026-84835 | CVE-2026-84835 CVSS 5.3 | Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects … |