104,345 indexed
CVECVE vulnerabilities
104,345 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 10,901–10,950 of 104,345 · page 219 of 2087
| ID | Title | Summary |
|---|---|---|
| CVE-2026-82901 | CVE-2026-82901 CVSS 9.8 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_ma… |
| CVE-2026-82900 | CVE-2026-82900 CVSS 8.1ibm | IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted … |
| CVE-2026-82896 | CVE-2026-82896 CVSS 7.6ibm | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability. |
| CVE-2026-82895 | CVE-2026-82895 CVSS 8.1ibm | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. |
| CVE-2026-82893 | CVE-2026-82893 CVSS 7.8ibm | IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management. |
| CVE-2026-82892 | CVE-2026-82892 CVSS 8.1ibm | IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS … |
| CVE-2026-82890 | CVE-2026-82890 CVSS 5.9ibm | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary JavaScript code due to improper neutralization of input duri… |
| CVE-2026-82887 | CVE-2026-82887 CVSS 8.8ibm | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements … |
| CVE-2026-82885 | CVE-2026-82885 CVSS 8.8ibm | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API. |
| CVE-2026-82884 | CVE-2026-82884 CVSS 6.8 | The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which… |
| CVE-2026-82883 | CVE-2026-82883 CVSS 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue … |
| CVE-2026-82882 | CVE-2026-82882 CVSS 8.8 | Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin… |
| CVE-2026-82881 | CVE-2026-82881 CVSS 5.4 | Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers … |
| CVE-2026-82880 | CVE-2026-82880 CVSS 7.5 | YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external… |
| CVE-2026-82879 | CVE-2026-82879 CVSS 6.3 | DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket … |
| CVE-2026-82878 | CVE-2026-82878 CVSS 6.3 | DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing… |
| CVE-2026-82877 | CVE-2026-82877 CVSS 6.5 | ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read se… |
| CVE-2026-82876 | CVE-2026-82876 CVSS 8.2 | Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutabl… |
| CVE-2026-82875 | CVE-2026-82875 CVSS 5.5 | ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without veri… |
| CVE-2026-82874 | CVE-2026-82874 CVSS 9.9 | ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db end… |
| CVE-2026-82873 | CVE-2026-82873 CVSS 5.0 | ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpoint that allow authenticated users to d… |
| CVE-2026-82872 | CVE-2026-82872 CVSS 9.1 | ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operation… |
| CVE-2026-82871 | CVE-2026-82871 CVSS 7.7 | ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' tabl… |
| CVE-2026-82870 | CVE-2026-82870 CVSS 9.6 | ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or d… |
| CVE-2026-8287 | CVE-2026-8287 CVSS 4.3 | Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software all… |
| CVE-2026-82869 | CVE-2026-82869 CVSS 7.7 | ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authe… |
| CVE-2026-82868 | CVE-2026-82868 CVSS 6.1 | @pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML… |
| CVE-2026-82867 | CVE-2026-82867 CVSS 6.1 | @pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating… |
| CVE-2026-82866 | CVE-2026-82866 CVSS 6.8 | @pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation w… |
| CVE-2026-82865 | CVE-2026-82865 CVSS 4.4 | pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to… |
| CVE-2026-82864 | CVE-2026-82864 CVSS 6.5 | pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method that allows attackers to cause … |
| CVE-2026-82863 | CVE-2026-82863 CVSS 3.3 | @hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attacke… |
| CVE-2026-82862 | CVE-2026-82862 CVSS 8.4 | Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attack… |
| CVE-2026-82861 | CVE-2026-82861 CVSS 7.5 | @hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during … |
| CVE-2026-82860 | CVE-2026-82860 CVSS 9.8 | @hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craf… |
| CVE-2026-8286 | CVE-2026-8286 CVSS 8.1haxx | A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configurat… |
| CVE-2026-82859 | CVE-2026-82859 CVSS 9.8 | hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intend… |
| CVE-2026-82858 | CVE-2026-82858 CVSS 9.8 | @hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input … |
| CVE-2026-82857 | CVE-2026-82857 CVSS 9.8 | hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e… |
| CVE-2026-82856 | CVE-2026-82856 CVSS 9.8 | @hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use For… |
| CVE-2026-82855 | CVE-2026-82855 CVSS 9.8 | @hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attac… |
| CVE-2026-82854 | CVE-2026-82854 CVSS 9.8 | Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope o… |
| CVE-2026-82853 | CVE-2026-82853 CVSS 4.9 | Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is… |
| CVE-2026-82852 | CVE-2026-82852 CVSS 5.4 | Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions. |
| CVE-2026-82851 | CVE-2026-82851 CVSS 2.7 | The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing user… |
| CVE-2026-82850 | CVE-2026-82850 CVSS 4.3 | The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve … |
| CVE-2026-8285 | CVE-2026-8285 CVSS 4.3 | Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation. This issue affects Fl… |
| CVE-2026-82849 | CVE-2026-82849 CVSS 4.3 | The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any… |
| CVE-2026-82848 | CVE-2026-82848 CVSS 5.3 | The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowin… |
| CVE-2026-82847 | CVE-2026-82847 CVSS 6.8 | The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing… |