103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 9,301–9,350 of 103,766 · page 187 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-8472 | CVE-2026-8472 CVSS 4.3gitlab | GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain cond… |
| CVE-2026-84719 | CVE-2026-84719 CVSS 9.9 | A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates o… |
| CVE-2026-84718 | CVE-2026-84718 CVSS 4.3 | A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X… |
| CVE-2026-84717 | CVE-2026-84717 CVSS 5.3 | A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature veri… |
| CVE-2026-84716 | CVE-2026-84716 CVSS 6.6 | A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an ex… |
| CVE-2026-84715 | CVE-2026-84715 CVSS 8.8 | FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify th… |
| CVE-2026-84714 | CVE-2026-84714 CVSS 7.1 | A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expres… |
| CVE-2026-84713 | CVE-2026-84713 CVSS 6.5 | A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configura… |
| CVE-2026-84712 | CVE-2026-84712 CVSS 5.3 | A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, … |
| CVE-2026-84706 | CVE-2026-84706 CVSS 7.6 | A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names agai… |
| CVE-2026-84702 | CVE-2026-84702 CVSS 7.5 | facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can s… |
| CVE-2026-84701 | CVE-2026-84701 CVSS 5.4 | NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Att… |
| CVE-2026-84700 | CVE-2026-84700 CVSS 8.6 | PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g. 11221 when the default client por… |
| CVE-2026-8470 | CVE-2026-8470 CVSS 7.4langflow | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for ge… |
| CVE-2026-84699 | CVE-2026-84699 CVSS 9.1 | Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can re… |
| CVE-2026-84698 | CVE-2026-84698 CVSS 6.5 | PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplied sized allocation.… |
| CVE-2026-84697 | CVE-2026-84697 CVSS 5.3 | Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing… |
| CVE-2026-84696 | CVE-2026-84696 CVSS 8.2 | Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authe… |
| CVE-2026-84695 | CVE-2026-84695 CVSS 8.7 | BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores… |
| CVE-2026-84694 | CVE-2026-84694 CVSS 8.8 | Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers c… |
| CVE-2026-84691 | CVE-2026-84691 CVSS 8.7 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an adm… |
| CVE-2026-8469 | CVE-2026-8469 | Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthenticated denial-of-service via BEAM atom ta… |
| CVE-2026-84685 | CVE-2026-84685 CVSS 6.5 | The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side r… |
| CVE-2026-84683 | CVE-2026-84683 CVSS 8.7 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update st… |
| CVE-2026-84682 | CVE-2026-84682 | A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the … |
| CVE-2026-84677 | CVE-2026-84677 CVSS 5.4 | Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pa… |
| CVE-2026-84676 | CVE-2026-84676 CVSS 4.3 | Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be vie… |
| CVE-2026-84675 | CVE-2026-84675 CVSS 7.4 | OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute ar… |
| CVE-2026-84674 | CVE-2026-84674 CVSS 5.4 | Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of… |
| CVE-2026-84673 | CVE-2026-84673 CVSS 8.8 | Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allo… |
| CVE-2026-84672 | CVE-2026-84672 CVSS 8.8 | Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID a… |
| CVE-2026-84671 | CVE-2026-84671 CVSS 8.8 | Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler… |
| CVE-2026-84670 | CVE-2026-84670 CVSS 8.8 | Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance report… |
| CVE-2026-8467 | CVE-2026-8467 | Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in H… |
| CVE-2026-84669 | CVE-2026-84669 CVSS 8.8 | A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report result… |
| CVE-2026-84668 | CVE-2026-84668 CVSS 8.8 | Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attack… |
| CVE-2026-84667 | CVE-2026-84667 CVSS 7.1 | Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect b… |
| CVE-2026-84666 | CVE-2026-84666 CVSS 5.4 | Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data … |
| CVE-2026-84665 | CVE-2026-84665 CVSS 8.0 | Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing … |
| CVE-2026-84664 | CVE-2026-84664 CVSS 5.4 | Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to conn… |
| CVE-2026-84663 | CVE-2026-84663 CVSS 5.4 | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared … |
| CVE-2026-84662 | CVE-2026-84662 CVSS 4.3 | Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an a… |
| CVE-2026-84661 | CVE-2026-84661 CVSS 5.4 | A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `waitForBuild` step … |
| CVE-2026-84660 | CVE-2026-84660 CVSS 5.4 | A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be… |
| CVE-2026-84659 | CVE-2026-84659 CVSS 4.3jenkins | Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbo… |
| CVE-2026-84658 | CVE-2026-84658 CVSS 4.3jenkins | Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configur… |
| CVE-2026-84657 | CVE-2026-84657 CVSS 4.2jenkins | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build… |
| CVE-2026-84656 | CVE-2026-84656 CVSS 4.3jenkins | A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build p… |
| CVE-2026-84655 | CVE-2026-84655 CVSS 4.3jenkins | Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attacker… |
| CVE-2026-84654 | CVE-2026-84654 CVSS 5.4 | In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding … |