104,345 indexed
CVECVE vulnerabilities
104,345 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 10,851–10,900 of 104,345 · page 218 of 2087
| ID | Title | Summary |
|---|---|---|
| CVE-2026-82998 | CVE-2026-82998 CVSS 9.9 | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12… |
| CVE-2026-82997 | CVE-2026-82997 CVSS 9.9 | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12… |
| CVE-2026-82996 | CVE-2026-82996 CVSS 7.8 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
| CVE-2026-82995 | CVE-2026-82995 CVSS 9.8 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
| CVE-2026-82994 | CVE-2026-82994 CVSS 9.8 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
| CVE-2026-82993 | CVE-2026-82993 CVSS 8.5 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are … |
| CVE-2026-82992 | CVE-2026-82992 CVSS 7.8oracle | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Installation). Supported versions that are affected are 17.0-26.7. Easily … |
| CVE-2026-82989 | CVE-2026-82989 CVSS 9.8 | There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input i… |
| CVE-2026-82988 | CVE-2026-82988 CVSS 7.5 | There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unp… |
| CVE-2026-82985 | CVE-2026-82985 CVSS 6.5 | The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rathe… |
| CVE-2026-82982 | CVE-2026-82982 CVSS 4.3 | The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting… |
| CVE-2026-82980 | CVE-2026-82980 CVSS 6.3 | Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absol… |
| CVE-2026-82973 | CVE-2026-82973 CVSS 9.4 | Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when be… |
| CVE-2026-82971 | CVE-2026-82971 CVSS 10.0 | A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Scri… |
| CVE-2026-82970 | CVE-2026-82970 CVSS 10.0 | Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files… |
| CVE-2026-8297 | CVE-2026-8297 CVSS 9.8 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and… |
| CVE-2026-82969 | CVE-2026-82969 CVSS 5.4 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and… |
| CVE-2026-82968 | CVE-2026-82968 CVSS 6.4 | A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their loca… |
| CVE-2026-82967 | CVE-2026-82967 CVSS 9.8ibm | IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls a… |
| CVE-2026-82964 | CVE-2026-82964 CVSS 8.8 | Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside th… |
| CVE-2026-8296 | CVE-2026-8296 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts. |
| CVE-2026-82958 | CVE-2026-82958 | In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting place… |
| CVE-2026-82957 | CVE-2026-82957 CVSS 7.3 | A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks… |
| CVE-2026-82955 | CVE-2026-82955 | In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had… |
| CVE-2026-82954 | CVE-2026-82954 CVSS 9.9 | A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/ap… |
| CVE-2026-82936 | CVE-2026-82936 | mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB … |
| CVE-2026-82935 | CVE-2026-82935 | mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device … |
| CVE-2026-82933 | CVE-2026-82933 | mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmi… |
| CVE-2026-82932 | CVE-2026-82932 | mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, f… |
| CVE-2026-82930 | CVE-2026-82930 | mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authenti… |
| CVE-2026-8293 | CVE-2026-8293 CVSS 7.5 | The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoint… |
| CVE-2026-82929 | CVE-2026-82929 | mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys f… |
| CVE-2026-82928 | CVE-2026-82928 | mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root l… |
| CVE-2026-82927 | CVE-2026-82927 CVSS 5.5 | Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 06994e303637512e39062… |
| CVE-2026-82926 | CVE-2026-82926 CVSS 5.5 | NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before afef59aa6f55c5d5ebf9b14bc0… |
| CVE-2026-82925 | CVE-2026-82925 CVSS 8.1 | The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out t… |
| CVE-2026-82924 | CVE-2026-82924 CVSS 5.3 | Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. … |
| CVE-2026-82923 | CVE-2026-82923 CVSS 9.8 | The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated… |
| CVE-2026-82922 | CVE-2026-82922 CVSS 7.3 | A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_update_cart of the file /flow.php?step=up… |
| CVE-2026-82921 | CVE-2026-82921 CVSS 7.3 | A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/pack.php. Executing a manipulation of t… |
| CVE-2026-82920 | CVE-2026-82920 CVSS 5.5mattermost | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint … |
| CVE-2026-82919 | CVE-2026-82919 CVSS 7.3 | A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function create_app of the file views.py of the component edit … |
| CVE-2026-82918 | CVE-2026-82918 CVSS 5.5 | XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improperly restrict XML ext… |
| CVE-2026-82915 | CVE-2026-82915 CVSS 6.5 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workf… |
| CVE-2026-82914 | CVE-2026-82914 CVSS 7.3 | A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipula… |
| CVE-2026-82911 | CVE-2026-82911 | Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unaut… |
| CVE-2026-82909 | CVE-2026-82909 CVSS 4.3 | A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of … |
| CVE-2026-82908 | CVE-2026-82908 CVSS 8.8 | A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWritePath in the library NTIOLib_X64.sys of … |
| CVE-2026-82906 | CVE-2026-82906 CVSS 3.7 | A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of … |
| CVE-2026-82905 | CVE-2026-82905 CVSS 6.3 | A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs… |