104,345 indexed
CVECVE vulnerabilities
104,345 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 11,251–11,300 of 104,345 · page 226 of 2087
| ID | Title | Summary |
|---|---|---|
| CVE-2026-82487 | CVE-2026-82487 CVSS 6.3 | A vulnerability was determined in Beetel 450TC3 01.00.00_01. This affects an unknown part. Executing a manipulation can lead to weak password recovery. The att… |
| CVE-2026-82486 | CVE-2026-82486 CVSS 5.0 | A vulnerability was found in SiteServer SSCMS 7.4.0. Affected by this issue is some unknown functionality of the component Agent Installation Workflow. Perform… |
| CVE-2026-82485 | CVE-2026-82485 CVSS 6.3 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/pr… |
| CVE-2026-82484 | CVE-2026-82484 CVSS 6.3 | A flaw has been found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/emp_searchfrm.php. This manipulation o… |
| CVE-2026-82483 | CVE-2026-82483 CVSS 3.5 | A vulnerability was detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This impacts an unknown function of the file db_input.php of the comp… |
| CVE-2026-82482 | CVE-2026-82482 CVSS 3.5 | A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an unknown function of the file profile.ph… |
| CVE-2026-82481 | CVE-2026-82481 | The cohttp package before 6.3.0 for OCaml allows directory traversal. |
| CVE-2026-82480 | CVE-2026-82480 CVSS 7.4 | A security flaw has been discovered in NASA cFS up to 7.0.1. The affected element is the function CFE_SB_GetUserDataLength of the file src/cFS/cfe/modules/sb/f… |
| CVE-2026-8248 | CVE-2026-8248 CVSS 4.3open5gs | A vulnerability was detected in Open5GS up to 2.7.7. The affected element is the function update_authorized_pcc_rule_and_qos of the file /src/smf/npcf-handler.… |
| CVE-2026-82479 | CVE-2026-82479 CVSS 6.3 | A vulnerability was identified in NASA cFS up to 7.0.1. Impacted is the function OS_read of the file modules/protocol/tcp/fsw/src/sbn_tcp_if.c of the component… |
| CVE-2026-82478 | CVE-2026-82478 CVSS 7.3 | A vulnerability was determined in NASA Trick 19.6.0. This issue affects the function JSONVariableServerThread::parse_request of the file trick_source/sim_servi… |
| CVE-2026-82477 | CVE-2026-82477 CVSS 5.8 | In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy end… |
| CVE-2026-82476 | CVE-2026-82476 CVSS 5.3 | Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attack… |
| CVE-2026-82475 | CVE-2026-82475 CVSS 8.1 | iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authentic… |
| CVE-2026-82474 | CVE-2026-82474 CVSS 7.8 | Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific comman… |
| CVE-2026-82473 | CVE-2026-82473 CVSS 8.2 | KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on po… |
| CVE-2026-82472 | CVE-2026-82472 CVSS 7.5 | Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Un… |
| CVE-2026-82470 | CVE-2026-82470 CVSS 5.4 | Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Atta… |
| CVE-2026-8247 | CVE-2026-8247 CVSS 8.8watchguard | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary cod… |
| CVE-2026-82469 | CVE-2026-82469 CVSS 5.4 | Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh to… |
| CVE-2026-82468 | CVE-2026-82468 CVSS 4.7 | Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cr… |
| CVE-2026-82467 | CVE-2026-82467 CVSS 4.7 | Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_t… |
| CVE-2026-82466 | CVE-2026-82466 CVSS 8.7 | Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other acco… |
| CVE-2026-82465 | CVE-2026-82465 CVSS 5.3 | pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP sends… |
| CVE-2026-82464 | CVE-2026-82464 CVSS 6.1 | pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matchin… |
| CVE-2026-82463 | CVE-2026-82463 CVSS 8.1 | pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attacker… |
| CVE-2026-82462 | CVE-2026-82462 CVSS 6.5 | pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access… |
| CVE-2026-82461 | CVE-2026-82461 CVSS 8.1 | pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can f… |
| CVE-2026-82460 | CVE-2026-82460 CVSS 9.8 | Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path … |
| CVE-2026-82459 | CVE-2026-82459 | Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport. This issue affects Apache Thrift: be… |
| CVE-2026-82458 | CVE-2026-82458 | Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, Jav… |
| CVE-2026-82457 | CVE-2026-82457 CVSS 7.8 | su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-… |
| CVE-2026-82456 | CVE-2026-82456 CVSS 10.0 | argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is con… |
| CVE-2026-82455 | CVE-2026-82455 | Rejected reason: The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no … |
| CVE-2026-82454 | CVE-2026-82454 CVSS 9.1 | The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken fu… |
| CVE-2026-82453 | CVE-2026-82453 CVSS 7.5 | rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retr… |
| CVE-2026-82452 | CVE-2026-82452 CVSS 9.8 | rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handle… |
| CVE-2026-82451 | CVE-2026-82451 CVSS 6.1 | Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated a… |
| CVE-2026-82450 | CVE-2026-82450 CVSS 8.8 | BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Crea… |
| CVE-2026-8245 | CVE-2026-8245 CVSS 5.4concretecms | Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. Concrete\Core\Legacy\Pagination builds paginatio… |
| CVE-2026-82449 | CVE-2026-82449 CVSS 5.3 | Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attack… |
| CVE-2026-82448 | CVE-2026-82448 CVSS 9.8 | Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary databas… |
| CVE-2026-82447 | CVE-2026-82447 CVSS 8.8 | Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and th… |
| CVE-2026-82443 | CVE-2026-82443 CVSS 9.6adobe | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged atta… |
| CVE-2026-82441 | CVE-2026-82441 CVSS 9.1 | Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading … |
| CVE-2026-8244 | CVE-2026-8244 CVSS 5.3 | A vulnerability was identified in Industrial Application Software IAS Canias ERP 8.03. This impacts an unknown function of the component Login RMI Interface. T… |
| CVE-2026-82439 | CVE-2026-82439 CVSS 9.8 | Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No code path ever rem… |
| CVE-2026-82438 | CVE-2026-82438 CVSS 8.1 | Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user… |
| CVE-2026-82437 | CVE-2026-82437 CVSS 4.3 | Description The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content. For daemon logs those settings were not app… |
| CVE-2026-82435 | CVE-2026-82435 CVSS 9.8 | Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentica… |