103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 9,501–9,550 of 103,766 · page 191 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-84471 | CVE-2026-84471 | The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to p… |
| CVE-2026-84470 | CVE-2026-84470 CVSS 6.4 | A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the requested… |
| CVE-2026-8447 | CVE-2026-8447 CVSS 6.1langflow | IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface. |
| CVE-2026-84469 | CVE-2026-84469 CVSS 7.5fastify | fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as … |
| CVE-2026-84465 | CVE-2026-84465 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email… |
| CVE-2026-84464 | CVE-2026-84464 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an exte… |
| CVE-2026-84463 | CVE-2026-84463 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video … |
| CVE-2026-84462 | CVE-2026-84462 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypa… |
| CVE-2026-84461 | CVE-2026-84461 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses fo… |
| CVE-2026-84460 | CVE-2026-84460 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list an… |
| CVE-2026-8446 | CVE-2026-8446 CVSS 7.5langflow | IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_en… |
| CVE-2026-84458 | CVE-2026-84458 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zamm… |
| CVE-2026-84452 | CVE-2026-84452 | Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serv… |
| CVE-2026-84451 | CVE-2026-84451 CVSS 6.5 | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_un… |
| CVE-2026-84450 | CVE-2026-84450 CVSS 4.3 | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or heig… |
| CVE-2026-8445 | CVE-2026-8445 CVSS 9.8 | justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed do… |
| CVE-2026-84449 | CVE-2026-84449 CVSS 3.7 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an intege… |
| CVE-2026-84448 | CVE-2026-84448 CVSS 4.0 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/… |
| CVE-2026-84447 | CVE-2026-84447 CVSS 7.5 | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same… |
| CVE-2026-84446 | CVE-2026-84446 CVSS 7.5 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing… |
| CVE-2026-84445 | CVE-2026-84445 | gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.g… |
| CVE-2026-84444 | CVE-2026-84444 CVSS 7.4 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an … |
| CVE-2026-84442 | CVE-2026-84442 CVSS 4.4 | A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIn… |
| CVE-2026-84441 | CVE-2026-84441 CVSS 7.3 | A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Imag… |
| CVE-2026-84440 | CVE-2026-84440 CVSS 7.5ibm | IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification functionality. An authenticated attacker who can influence … |
| CVE-2026-8444 | CVE-2026-8444 CVSS 8.8 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions … |
| CVE-2026-84439 | CVE-2026-84439 CVSS 5.3apache | When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sendi… |
| CVE-2026-84438 | CVE-2026-84438 CVSS 3.5 | A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component A… |
| CVE-2026-84437 | CVE-2026-84437 CVSS 3.5 | A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the co… |
| CVE-2026-84436 | CVE-2026-84436 CVSS 9.1ibm | IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged authenticated CLI user … |
| CVE-2026-84434 | CVE-2026-84434 CVSS 9.8 | The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This … |
| CVE-2026-84432 | CVE-2026-84432 | Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller (concrete/controllers/dialog/board/custom_slot.ph… |
| CVE-2026-84431 | CVE-2026-84431 CVSS 4.4 | A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUtil.getRealPath of t… |
| CVE-2026-84430 | CVE-2026-84430 CVSS 6.3 | A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.… |
| CVE-2026-8443 | CVE-2026-8443 CVSS 8.8 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data A… |
| CVE-2026-84429 | CVE-2026-84429 CVSS 5.3 | An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_header_parameters()` was subject to a pot… |
| CVE-2026-84428 | CVE-2026-84428 CVSS 7.5fastify | fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, … |
| CVE-2026-84427 | CVE-2026-84427 CVSS 4.3 | A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Too… |
| CVE-2026-84425 | CVE-2026-84425 CVSS 4.3 | A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tools/browser/browser_tool.py of the compon… |
| CVE-2026-84423 | CVE-2026-84423 CVSS 7.3 | A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource AP… |
| CVE-2026-84422 | CVE-2026-84422 CVSS 7.2ibm | IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion functionality, allowing an authenticated p… |
| CVE-2026-84421 | CVE-2026-84421 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during ar… |
| CVE-2026-84420 | CVE-2026-84420 | Out-of-bounds read vulnerability in Citirx Citrix Workspace app for Windows. This issue affects Citrix Workspace app for Windows: before 2603.20 CR, before LT… |
| CVE-2026-8442 | CVE-2026-8442 CVSS 8.1 | The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authoriza… |
| CVE-2026-84419 | CVE-2026-84419 | Out-of-bounds write vulnerability in Citrix Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.20 CR, before LTSR 2607 Hotfi… |
| CVE-2026-84418 | CVE-2026-84418 CVSS 7.4ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture t… |
| CVE-2026-84414 | CVE-2026-84414 CVSS 7.8ibm | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-co… |
| CVE-2026-84412 | CVE-2026-84412 CVSS 10.0adobe | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code exec… |
| CVE-2026-84411 | CVE-2026-84411 CVSS 9.8 | The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authenticatio… |
| CVE-2026-8441 | CVE-2026-8441 CVSS 7.5 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions… |