103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 9,551–9,600 of 103,766 · page 192 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-84409 | CVE-2026-84409 CVSS 7.5 | The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A… |
| CVE-2026-84408 | CVE-2026-84408 CVSS 8.8 | QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected pro… |
| CVE-2026-84403 | CVE-2026-84403 CVSS 6.2 | The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications… |
| CVE-2026-84400 | CVE-2026-84400 CVSS 3.1 | CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the sa… |
| CVE-2026-84399 | CVE-2026-84399 CVSS 8.8 | The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently as… |
| CVE-2026-84398 | CVE-2026-84398 CVSS 7.5 | CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affect… |
| CVE-2026-84397 | CVE-2026-84397 CVSS 5.4 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
| CVE-2026-84396 | CVE-2026-84396 CVSS 5.5 | InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this … |
| CVE-2026-84395 | CVE-2026-84395 CVSS 7.1 | Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation potentially resulting in unauthorized … |
| CVE-2026-84394 | CVE-2026-84394 CVSS 7.5openjsf | fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but d… |
| CVE-2026-84393 | CVE-2026-84393 CVSS 8.1 | A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacke… |
| CVE-2026-84392 | CVE-2026-84392 CVSS 2.7 | A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 a… |
| CVE-2026-84391 | CVE-2026-84391 CVSS 6.5 | A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via <insert attack vector h… |
| CVE-2026-84390 | CVE-2026-84390 CVSS 9.8 | A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 … |
| CVE-2026-84389 | CVE-2026-84389 CVSS 3.1 | A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker… |
| CVE-2026-84388 | CVE-2026-84388 CVSS 9.6 | A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all … |
| CVE-2026-84387 | CVE-2026-84387 CVSS 7.2 | A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through … |
| CVE-2026-84386 | CVE-2026-84386 CVSS 5.1 | A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacker to improper acc… |
| CVE-2026-84385 | CVE-2026-84385 CVSS 5.4 | A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, Fo… |
| CVE-2026-84384 | CVE-2026-84384 CVSS 7.5 | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompre… |
| CVE-2026-84383 | CVE-2026-84383 CVSS 9.8 | libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl refer… |
| CVE-2026-84382 | CVE-2026-84382 CVSS 7.5 | HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, def… |
| CVE-2026-84381 | CVE-2026-84381 CVSS 8.1 | HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpc… |
| CVE-2026-84380 | CVE-2026-84380 CVSS 5.6 | HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length h… |
| CVE-2026-8438 | CVE-2026-8438 CVSS 7.2 | The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7.… |
| CVE-2026-84379 | CVE-2026-84379 CVSS 5.3 | HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attack… |
| CVE-2026-84378 | CVE-2026-84378 CVSS 5.9 | HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copie… |
| CVE-2026-84377 | CVE-2026-84377 CVSS 6.5 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user… |
| CVE-2026-84376 | CVE-2026-84376 | Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-pref… |
| CVE-2026-84375 | CVE-2026-84375 CVSS 7.5 | js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does no… |
| CVE-2026-84374 | CVE-2026-84374 CVSS 7.5 | Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy… |
| CVE-2026-84373 | CVE-2026-84373 CVSS 5.9 | Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in pack… |
| CVE-2026-84372 | CVE-2026-84372 CVSS 9.8 | Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster a… |
| CVE-2026-84371 | CVE-2026-84371 CVSS 5.4 | ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 unti… |
| CVE-2026-84370 | CVE-2026-84370 CVSS 8.2 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and … |
| CVE-2026-84369 | CVE-2026-84369 CVSS 6.1 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and … |
| CVE-2026-84368 | CVE-2026-84368 CVSS 3.7 | joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the succ… |
| CVE-2026-84367 | CVE-2026-84367 CVSS 3.7 | joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implem… |
| CVE-2026-84366 | CVE-2026-84366 CVSS 7.4 | Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler co… |
| CVE-2026-84365 | CVE-2026-84365 CVSS 6.5 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not c… |
| CVE-2026-84364 | CVE-2026-84364 CVSS 5.3 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names … |
| CVE-2026-84363 | CVE-2026-84363 CVSS 5.9 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a liter… |
| CVE-2026-84361 | CVE-2026-84361 | Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an… |
| CVE-2026-84360 | CVE-2026-84360 CVSS 8.1 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /m… |
| CVE-2026-84359 | CVE-2026-84359 CVSS 3.1google | Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data v… |
| CVE-2026-84358 | CVE-2026-84358 CVSS 4.2google | Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof … |
| CVE-2026-84357 | CVE-2026-84357 CVSS 6.5google | Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin polic… |
| CVE-2026-84356 | CVE-2026-84356 CVSS 4.3google | UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium se… |
| CVE-2026-84355 | CVE-2026-84355 CVSS 3.1google | Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web … |
| CVE-2026-84354 | CVE-2026-84354 CVSS 9.6google | Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code… |