104,345 indexed
CVECVE vulnerabilities
104,345 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 11,101–11,150 of 104,345 · page 223 of 2087
| ID | Title | Summary |
|---|---|---|
| CVE-2026-82670 | CVE-2026-82670 CVSS 4.4 | A flaw has been found in IObit Uninstaller 15.5.0.11. This affects the function IRP_MJ_DEVICE_CONTROL in the library IUForceDelete.sys of the component IOCTL H… |
| CVE-2026-8267 | CVE-2026-8267 CVSS 4.3open5gs | A flaw has been found in Open5GS up to 2.7.7. This vulnerability affects the function smf_nsmf_handle_created_data_in_vsmf of the component SMF. This manipulat… |
| CVE-2026-82669 | CVE-2026-82669 CVSS 5.3 | A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine… |
| CVE-2026-82668 | CVE-2026-82668 CVSS 7.3 | A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/… |
| CVE-2026-82667 | CVE-2026-82667 CVSS 4.7 | A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/… |
| CVE-2026-82666 | CVE-2026-82666 CVSS 4.7 | A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorControll… |
| CVE-2026-82665 | CVE-2026-82665 CVSS 3.8 | A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the file app/Http/Controllers/Admin/ImageLibr… |
| CVE-2026-82664 | CVE-2026-82664 CVSS 4.3 | A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController… |
| CVE-2026-82662 | CVE-2026-82662 CVSS 6.5 | Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 t… |
| CVE-2026-82661 | CVE-2026-82661 CVSS 5.4 | Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message heade… |
| CVE-2026-82660 | CVE-2026-82660 CVSS 5.4 | Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local… |
| CVE-2026-8266 | CVE-2026-8266 CVSS 4.3open5gs | A vulnerability was detected in Open5GS up to 2.7.7. This affects the function gsm_build_pdu_session_establishment_accept of the file /src/smf/gsm-build.c of t… |
| CVE-2026-82659 | CVE-2026-82659 CVSS 7.1 | nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbit… |
| CVE-2026-82658 | CVE-2026-82658 CVSS 4.3 | Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read anot… |
| CVE-2026-82657 | CVE-2026-82657 CVSS 7.5 | Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can … |
| CVE-2026-82656 | CVE-2026-82656 CVSS 2.6 | Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include… |
| CVE-2026-82655 | CVE-2026-82655 CVSS 7.5 | Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated attackers … |
| CVE-2026-82654 | CVE-2026-82654 CVSS 8.9 | SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a blo… |
| CVE-2026-82653 | CVE-2026-82653 CVSS 8.9 | SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated … |
| CVE-2026-82652 | CVE-2026-82652 CVSS 5.3 | SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous… |
| CVE-2026-82651 | CVE-2026-82651 CVSS 4.9 | SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in ke… |
| CVE-2026-82650 | CVE-2026-82650 CVSS 4.4 | SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function (kernel/model/template.go), reachable via the POS… |
| CVE-2026-8265 | CVE-2026-8265 CVSS 4.7tenda | A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function get_log_file of the file /goform/getLogFile of the … |
| CVE-2026-82649 | CVE-2026-82649 | SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element vulnerability in its NSIS installer, w… |
| CVE-2026-82648 | CVE-2026-82648 CVSS 7.1 | WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails to normalize NAT64 addresses written in… |
| CVE-2026-82647 | CVE-2026-82647 CVSS 6.1 | WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's con… |
| CVE-2026-82646 | CVE-2026-82646 CVSS 6.1 | WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicio… |
| CVE-2026-82645 | CVE-2026-82645 CVSS 8.6 | AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a … |
| CVE-2026-82644 | CVE-2026-82644 CVSS 7.5 | WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpo… |
| CVE-2026-82643 | CVE-2026-82643 CVSS 6.5 | WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without … |
| CVE-2026-82642 | CVE-2026-82642 CVSS 8.8 | Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that … |
| CVE-2026-82641 | CVE-2026-82641 CVSS 8.6 | Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints th… |
| CVE-2026-82640 | CVE-2026-82640 CVSS 5.5 | browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with re… |
| CVE-2026-8264 | CVE-2026-8264 CVSS 6.3tenda | A weakness has been identified in Tenda AC6 15.03.06.23. Affected by this vulnerability is the function formWifiApScan of the file /goform/WifiApScan of the co… |
| CVE-2026-82639 | CVE-2026-82639 CVSS 7.5 | NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server'… |
| CVE-2026-82638 | CVE-2026-82638 CVSS 7.5 | jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. … |
| CVE-2026-82637 | CVE-2026-82637 CVSS 5.3 | browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrar… |
| CVE-2026-82636 | CVE-2026-82636 CVSS 7.9 | Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "sy… |
| CVE-2026-82635 | CVE-2026-82635 CVSS 8.8faberon | Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filen… |
| CVE-2026-82634 | CVE-2026-82634 CVSS 6.5 | Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Ji… |
| CVE-2026-82633 | CVE-2026-82633 CVSS 4.3 | Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users … |
| CVE-2026-82632 | CVE-2026-82632 CVSS 3.1gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain c… |
| CVE-2026-82631 | CVE-2026-82631 CVSS 2.2 | A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the … |
| CVE-2026-82630 | CVE-2026-82630 CVSS 7.3 | A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob… |
| CVE-2026-8263 | CVE-2026-8263 CVSS 4.7tenda | A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of th… |
| CVE-2026-82629 | CVE-2026-82629 CVSS 4.7 | A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.d… |
| CVE-2026-82628 | CVE-2026-82628 CVSS 8.8 | A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function sub_11504 in the library WinRing0x64.sys of the component I… |
| CVE-2026-82627 | CVE-2026-82627 CVSS 7.5 | The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Inje… |
| CVE-2026-82625 | CVE-2026-82625 CVSS 4.3 | A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Regis… |
| CVE-2026-82624 | CVE-2026-82624 CVSS 5.3 | A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of… |