103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 9,201–9,250 of 103,766 · page 185 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-84834 | CVE-2026-84834 CVSS 9.8 | Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions. |
| CVE-2026-84833 | CVE-2026-84833 CVSS 4.3 | A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of… |
| CVE-2026-84832 | CVE-2026-84832 | SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker… |
| CVE-2026-84831 | CVE-2026-84831 | SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker… |
| CVE-2026-84830 | CVE-2026-84830 | SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevat… |
| CVE-2026-84829 | CVE-2026-84829 CVSS 8.8 | The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthent… |
| CVE-2026-84828 | CVE-2026-84828 CVSS 6.5 | A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' comm… |
| CVE-2026-84823 | CVE-2026-84823 CVSS 7.1 | A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal v… |
| CVE-2026-84821 | CVE-2026-84821 CVSS 7.5 | Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions. |
| CVE-2026-84820 | CVE-2026-84820 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions. |
| CVE-2026-8482 | CVE-2026-8482 CVSS 4.3 | A vulnerability was discovered on StormShield Network Security 4.3.0 to 4.3.41 (included), 4.8.0 to 4.8.15 (included) , 5.0.0 to 5.0.5 (included) There is a p… |
| CVE-2026-84819 | CVE-2026-84819 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions. |
| CVE-2026-84818 | CVE-2026-84818 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions. |
| CVE-2026-84817 | CVE-2026-84817 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions. |
| CVE-2026-84816 | CVE-2026-84816 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions. |
| CVE-2026-84815 | CVE-2026-84815 CVSS 5.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects E… |
| CVE-2026-84814 | CVE-2026-84814 CVSS 9.8 | Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions. |
| CVE-2026-84813 | CVE-2026-84813 CVSS 9.3 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions. |
| CVE-2026-84812 | CVE-2026-84812 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions. |
| CVE-2026-84811 | CVE-2026-84811 CVSS 6.5 | agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping ma… |
| CVE-2026-84810 | CVE-2026-84810 CVSS 6.5 | claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, a… |
| CVE-2026-8481 | CVE-2026-8481 CVSS 9.9langflow | IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/cod… |
| CVE-2026-84809 | CVE-2026-84809 CVSS 6.5 | Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd ex… |
| CVE-2026-84808 | CVE-2026-84808 CVSS 4.3 | Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team ac… |
| CVE-2026-84807 | CVE-2026-84807 CVSS 5.4 | Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated us… |
| CVE-2026-84806 | CVE-2026-84806 CVSS 5.4 | Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and re… |
| CVE-2026-84805 | CVE-2026-84805 CVSS 4.3 | Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences … |
| CVE-2026-84804 | CVE-2026-84804 CVSS 5.4 | Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated us… |
| CVE-2026-84803 | CVE-2026-84803 CVSS 9.0 | SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable … |
| CVE-2026-84802 | CVE-2026-84802 CVSS 4.3 | Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume p… |
| CVE-2026-84801 | CVE-2026-84801 CVSS 8.8 | Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers perm… |
| CVE-2026-84800 | CVE-2026-84800 CVSS 7.1 | Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sou… |
| CVE-2026-8480 | CVE-2026-8480 CVSS 4.3 | A vulnerability was discovered on Stormshield Network Security 4.3.0 to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included) A revo… |
| CVE-2026-84799 | CVE-2026-84799 CVSS 4.3 | Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revis… |
| CVE-2026-84798 | CVE-2026-84798 CVSS 7.1 | Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads… |
| CVE-2026-84797 | CVE-2026-84797 CVSS 6.3 | Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with c… |
| CVE-2026-84796 | CVE-2026-84796 CVSS 8.8 | Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentMa… |
| CVE-2026-84795 | CVE-2026-84795 CVSS 9.8 | Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can regis… |
| CVE-2026-84794 | CVE-2026-84794 CVSS 7.1 | Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset … |
| CVE-2026-84793 | CVE-2026-84793 CVSS 4.8 | Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Admin… |
| CVE-2026-84792 | CVE-2026-84792 CVSS 4.3 | Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users t… |
| CVE-2026-84791 | CVE-2026-84791 CVSS 7.1 | ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an auth… |
| CVE-2026-84790 | CVE-2026-84790 | OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field |
| CVE-2026-8479 | CVE-2026-8479 | IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence of messages is sent for a … |
| CVE-2026-84789 | CVE-2026-84789 CVSS 7.1 | ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an auth… |
| CVE-2026-84787 | CVE-2026-84787 CVSS 8.1 | ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authe… |
| CVE-2026-84784 | CVE-2026-84784 CVSS 7.5openssl | Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the re… |
| CVE-2026-84783 | CVE-2026-84783 CVSS 7.5openssl | Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread i… |
| CVE-2026-84782 | CVE-2026-84782 CVSS 8.2openssl | Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message … |
| CVE-2026-84781 | CVE-2026-84781 CVSS 6.5 | Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions. |