104,345 indexed
CVECVE vulnerabilities
104,345 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 10,301–10,350 of 104,345 · page 207 of 2087
| ID | Title | Summary |
|---|---|---|
| CVE-2026-83605 | CVE-2026-83605 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, a… |
| CVE-2026-83603 | CVE-2026-83603 CVSS 8.4 | Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsu… |
| CVE-2026-83602 | CVE-2026-83602 CVSS 6.5 | Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK … |
| CVE-2026-83601 | CVE-2026-83601 CVSS 6.5 | Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded pas… |
| CVE-2026-83600 | CVE-2026-83600 CVSS 6.5 | Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes … |
| CVE-2026-83599 | CVE-2026-83599 CVSS 7.5 | Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, … |
| CVE-2026-83598 | CVE-2026-83598 CVSS 7.8 | Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoPr… |
| CVE-2026-83597 | CVE-2026-83597 CVSS 7.0 | Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as ele… |
| CVE-2026-83596 | CVE-2026-83596 CVSS 8.8 | A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. |
| CVE-2026-83595 | CVE-2026-83595 CVSS 8.1 | AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET r… |
| CVE-2026-83593 | CVE-2026-83593 CVSS 7.2 | The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' … |
| CVE-2026-83592 | CVE-2026-83592 CVSS 7.2 | The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and inclu… |
| CVE-2026-83591 | CVE-2026-83591 CVSS 7.2 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all… |
| CVE-2026-83589 | CVE-2026-83589 CVSS 6.1 | A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote a… |
| CVE-2026-83588 | CVE-2026-83588 CVSS 7.8 | Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83587 | CVE-2026-83587 CVSS 7.8 | Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83586 | CVE-2026-83586 CVSS 7.8 | Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83585 | CVE-2026-83585 CVSS 7.8 | Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83584 | CVE-2026-83584 CVSS 7.0 | Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83583 | CVE-2026-83583 CVSS 7.8 | Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83582 | CVE-2026-83582 CVSS 4.7 | Use after free in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
| CVE-2026-83580 | CVE-2026-83580 CVSS 7.0 | Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-8358 | CVE-2026-8358 | LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for t… |
| CVE-2026-83579 | CVE-2026-83579 CVSS 7.8 | Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83578 | CVE-2026-83578 CVSS 9.8 | Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83575 | CVE-2026-83575 CVSS 7.0 | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83574 | CVE-2026-83574 CVSS 7.0 | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83573 | CVE-2026-83573 CVSS 6.8 | Integer overflow or wraparound in Windows Kernel Mode Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-83571 | CVE-2026-83571 CVSS 5.5 | Null pointer dereference in Windows Audio Service allows an authorized attacker to disclose information locally. |
| CVE-2026-83570 | CVE-2026-83570 CVSS 7.8 | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| CVE-2026-8357 | CVE-2026-8357 CVSS 7.8 | LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening t… |
| CVE-2026-83569 | CVE-2026-83569 CVSS 7.8 | Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83568 | CVE-2026-83568 CVSS 7.8 | Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83567 | CVE-2026-83567 CVSS 7.8 | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83566 | CVE-2026-83566 CVSS 7.0 | Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83565 | CVE-2026-83565 CVSS 5.5 | Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally. |
| CVE-2026-83564 | CVE-2026-83564 CVSS 7.0 | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83562 | CVE-2026-83562 CVSS 6.5 | Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions. |
| CVE-2026-83561 | CVE-2026-83561 CVSS 7.2 | The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor Cookie Blocke… |
| CVE-2026-83560 | CVE-2026-83560 CVSS 5.3 | The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unc… |
| CVE-2026-8356 | CVE-2026-8356 | LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-siz… |
| CVE-2026-83557 | CVE-2026-83557 CVSS 5.6 | DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom v… |
| CVE-2026-83555 | CVE-2026-83555 CVSS 5.3 | The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscrip… |
| CVE-2026-83551 | CVE-2026-83551 CVSS 7.2 | Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 mig… |
| CVE-2026-83550 | CVE-2026-83550 CVSS 7.1 | A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remo… |
| CVE-2026-83549 | SonicWall SMA1000 Appliances OS Command Injection Vulnerability KEVCVSS 7.8SonicWall | SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbit… |
| CVE-2026-83548 | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability KEVCVSS 10.0SonicWall | SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized acces… |
| CVE-2026-83547 | CVE-2026-83547 CVSS 6.8 | The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could… |
| CVE-2026-83546 | CVE-2026-83546 CVSS 6.8 | The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contribu… |
| CVE-2026-83545 | CVE-2026-83545 CVSS 6.8 | The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with co… |