103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 9,701–9,750 of 103,766 · page 195 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-84226 | CVE-2026-84226 | OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during networ… |
| CVE-2026-84225 | CVE-2026-84225 CVSS 2.2 | The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom… |
| CVE-2026-84224 | CVE-2026-84224 CVSS 4.1 | The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above t… |
| CVE-2026-84223 | CVE-2026-84223 CVSS 6.8 | The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access a… |
| CVE-2026-84222 | CVE-2026-84222 CVSS 5.3 | The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowi… |
| CVE-2026-84221 | CVE-2026-84221 CVSS 6.8 | The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and… |
| CVE-2026-84220 | CVE-2026-84220 CVSS 4.8 | The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless… |
| CVE-2026-8422 | CVE-2026-8422 CVSS 4.3 | The Remove meta boxes per user role plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.01. This is due to… |
| CVE-2026-84219 | CVE-2026-84219 CVSS 7.5 | The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to st… |
| CVE-2026-84218 | CVE-2026-84218 CVSS 8.1 | A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist i… |
| CVE-2026-84217 | CVE-2026-84217 CVSS 5.4 | Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.Thi… |
| CVE-2026-84215 | CVE-2026-84215 CVSS 6.5 | Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions. |
| CVE-2026-8421 | CVE-2026-8421 CVSS 8.8concretecms | Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php. A… |
| CVE-2026-84209 | CVE-2026-84209 CVSS 8.1ibm | IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special element… |
| CVE-2026-84208 | CVE-2026-84208 CVSS 7.5 | AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoint… |
| CVE-2026-84207 | CVE-2026-84207 CVSS 5.4 | Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal service… |
| CVE-2026-84206 | CVE-2026-84206 CVSS 4.3snipeitapp | Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to res… |
| CVE-2026-84205 | CVE-2026-84205 CVSS 6.5 | GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revis… |
| CVE-2026-84204 | CVE-2026-84204 CVSS 6.5 | GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attack… |
| CVE-2026-84203 | CVE-2026-84203 CVSS 8.1 | Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attack… |
| CVE-2026-84202 | CVE-2026-84202 CVSS 8.8 | ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Atta… |
| CVE-2026-84201 | CVE-2026-84201 CVSS 7.1 | appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools, allowing attackers to write files out… |
| CVE-2026-84200 | CVE-2026-84200 CVSS 9.0 | Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less… |
| CVE-2026-8420 | CVE-2026-8420 CVSS 6.1 | The BLOGCHAT Chat System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6.3. This is due to missing… |
| CVE-2026-84199 | CVE-2026-84199 CVSS 7.7 | Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration… |
| CVE-2026-84198 | CVE-2026-84198 CVSS 8.1ibm | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. |
| CVE-2026-84197 | CVE-2026-84197 | In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor p… |
| CVE-2026-84196 | CVE-2026-84196 CVSS 7.7 | Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP reques… |
| CVE-2026-84195 | CVE-2026-84195 CVSS 7.7 | Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit… |
| CVE-2026-84194 | CVE-2026-84194 | LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery. When libvirt supp… |
| CVE-2026-84193 | CVE-2026-84193 | LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields includ… |
| CVE-2026-84192 | CVE-2026-84192 CVSS 7.1 | LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without es… |
| CVE-2026-84191 | CVE-2026-84191 CVSS 6.1 | LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDist… |
| CVE-2026-84190 | CVE-2026-84190 CVSS 7.2 | LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to she… |
| CVE-2026-8419 | CVE-2026-8419 CVSS 4.3 | The Amazon Scraper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorr… |
| CVE-2026-84189 | CVE-2026-84189 CVSS 8.1 | LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url… |
| CVE-2026-84188 | CVE-2026-84188 CVSS 4.8 | LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configuration settings, which are echoed verbati… |
| CVE-2026-84187 | CVE-2026-84187 CVSS 8.2 | AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcas… |
| CVE-2026-84186 | CVE-2026-84186 | Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via t… |
| CVE-2026-84185 | CVE-2026-84185 CVSS 5.9 | A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the l… |
| CVE-2026-8418 | CVE-2026-8418 CVSS 4.3 | The Games Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.0. This is due to missing or incorrect… |
| CVE-2026-84179 | CVE-2026-84179 CVSS 6.5 | Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in th… |
| CVE-2026-84175 | CVE-2026-84175 | In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definitio… |
| CVE-2026-84173 | CVE-2026-84173 | In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path… |
| CVE-2026-84171 | CVE-2026-84171 CVSS 9.8 | The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible … |
| CVE-2026-8417 | CVE-2026-8417 CVSS 8.8concretecms | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() metho… |
| CVE-2026-84169 | CVE-2026-84169 CVSS 5.3 | The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer i… |
| CVE-2026-84168 | CVE-2026-84168 CVSS 5.3 | The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard … |
| CVE-2026-84167 | CVE-2026-84167 CVSS 4.3 | The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as… |
| CVE-2026-84166 | CVE-2026-84166 CVSS 4.3 | The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a… |