104,345 indexed
CVECVE vulnerabilities
104,345 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 10,351–10,400 of 104,345 · page 208 of 2087
| ID | Title | Summary |
|---|---|---|
| CVE-2026-83544 | CVE-2026-83544 CVSS 6.8 | The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing use… |
| CVE-2026-83543 | CVE-2026-83543 CVSS 4.1 | The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level acce… |
| CVE-2026-83541 | CVE-2026-83541 CVSS 6.8 | The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, … |
| CVE-2026-83540 | CVE-2026-83540 CVSS 8.8wolfssh | When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not … |
| CVE-2026-8354 | CVE-2026-8354 CVSS 6.4 | The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions up to, and including,… |
| CVE-2026-83537 | CVE-2026-83537 CVSS 5.3 | The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowi… |
| CVE-2026-83536 | CVE-2026-83536 CVSS 5.3 | A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeou… |
| CVE-2026-83535 | CVE-2026-83535 CVSS 7.4 | A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the … |
| CVE-2026-83534 | CVE-2026-83534 CVSS 6.4 | PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arbitrary code with s… |
| CVE-2026-83533 | CVE-2026-83533 CVSS 5.3 | The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowi… |
| CVE-2026-83532 | CVE-2026-83532 CVSS 6.8 | The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowin… |
| CVE-2026-83530 | CVE-2026-83530 CVSS 4.3google | A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocatio… |
| CVE-2026-8353 | CVE-2026-8353 CVSS 4.8concretecms | Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScript that executes i… |
| CVE-2026-83527 | CVE-2026-83527 CVSS 8.1 | An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level acce… |
| CVE-2026-83526 | CVE-2026-83526 CVSS 8.8 | The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This i… |
| CVE-2026-83524 | CVE-2026-83524 CVSS 9.9 | A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec… |
| CVE-2026-83523 | CVE-2026-83523 CVSS 8.8 | Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83522 | CVE-2026-83522 CVSS 8.1 | Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-83521 | CVE-2026-83521 CVSS 6.5 | Out-of-bounds read in Windows IKE Extension allows an authorized attacker to disclose information over a network. |
| CVE-2026-83520 | CVE-2026-83520 CVSS 8.8 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83519 | CVE-2026-83519 CVSS 9.8 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83518 | CVE-2026-83518 CVSS 7.8 | Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83517 | CVE-2026-83517 CVSS 9.8 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83516 | CVE-2026-83516 CVSS 7.5 | Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network. |
| CVE-2026-83515 | CVE-2026-83515 CVSS 6.5 | Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-83514 | CVE-2026-83514 CVSS 7.8 | Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83513 | CVE-2026-83513 CVSS 7.8 | Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83511 | CVE-2026-83511 CVSS 7.4 | Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-83510 | CVE-2026-83510 CVSS 7.0 | Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. |
| CVE-2026-8351 | CVE-2026-8351 CVSS 6.4 | The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, a… |
| CVE-2026-83509 | CVE-2026-83509 CVSS 7.0 | Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83508 | CVE-2026-83508 CVSS 7.8 | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83507 | CVE-2026-83507 CVSS 5.5 | Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information loc… |
| CVE-2026-83506 | CVE-2026-83506 CVSS 7.8 | Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83505 | CVE-2026-83505 CVSS 7.0 | Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83504 | CVE-2026-83504 CVSS 4.7 | Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally. |
| CVE-2026-83501 | CVE-2026-83501 CVSS 5.5microsoft | Out-of-bounds read in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to disclose information locally. |
| CVE-2026-83500 | CVE-2026-83500 CVSS 6.1 | Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
| CVE-2026-8350 | CVE-2026-8350 CVSS 8.8concretecms | Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Gr… |
| CVE-2026-83499 | CVE-2026-83499 CVSS 7.8 | Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83498 | CVE-2026-83498 CVSS 7.8microsoft | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83497 | CVE-2026-83497 CVSS 8.8 | Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic re… |
| CVE-2026-83492 | CVE-2026-83492 | Improper input validation vulnerability in Extend Themes Kubio AI Website Builder. This issue affects Kubio AI Website Builder: before 2.9.1. |
| CVE-2026-83491 | CVE-2026-83491 CVSS 6.8oracle | Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-… |
| CVE-2026-83490 | CVE-2026-83490 CVSS 8.5oracle | Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-… |
| CVE-2026-83489 | CVE-2026-83489 CVSS 7.5 | Vulnerability in the Oracle Banking Origination product of Oracle Financial Services Applications (component: Onboarding Batch Processes). Supported versions … |
| CVE-2026-83488 | CVE-2026-83488 CVSS 5.4oracle | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security). Supported versions that are affected are 4.0.0-4.… |
| CVE-2026-83487 | CVE-2026-83487 CVSS 7.7oracle | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.15.… |
| CVE-2026-83486 | CVE-2026-83486 CVSS 7.7oracle | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.15.… |
| CVE-2026-83485 | CVE-2026-83485 CVSS 7.7oracle | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.15.… |