106,194 indexed
CVECVE vulnerabilities
106,194 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 11,301–11,350 of 106,194 · page 227 of 2124
| ID | Title | Summary |
|---|---|---|
| CVE-2026-8244 | CVE-2026-8244 CVSS 5.3 | A vulnerability was identified in Industrial Application Software IAS Canias ERP 8.03. This impacts an unknown function of the component Login RMI Interface. T… |
| CVE-2026-82439 | CVE-2026-82439 CVSS 9.8 | Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No code path ever rem… |
| CVE-2026-82438 | CVE-2026-82438 CVSS 8.1 | Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user… |
| CVE-2026-82437 | CVE-2026-82437 CVSS 4.3 | Description The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content. For daemon logs those settings were not app… |
| CVE-2026-82435 | CVE-2026-82435 CVSS 9.8 | Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentica… |
| CVE-2026-82434 | CVE-2026-82434 CVSS 6.5 | Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, bec… |
| CVE-2026-82433 | CVE-2026-82433 CVSS 6.5 | Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is con… |
| CVE-2026-82432 | CVE-2026-82432 CVSS 8.1 | Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalance operation accepts configuration overr… |
| CVE-2026-82431 | CVE-2026-82431 CVSS 9.8 | Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.groups` was considered… |
| CVE-2026-82430 | CVE-2026-82430 CVSS 7.8 | Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory to the untrusted t… |
| CVE-2026-8243 | CVE-2026-8243 CVSS 5.3 | A vulnerability was determined in Industrial Application Software IAS Canias ERP 8.03. This affects an unknown function of the component JNLP Deployment Endpoi… |
| CVE-2026-82429 | CVE-2026-82429 CVSS 7.8 | Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling `lchown`… |
| CVE-2026-82428 | CVE-2026-82428 CVSS 8.8 | Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate, for example `dep--… |
| CVE-2026-82427 | CVE-2026-82427 CVSS 7.8 | Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That name was used to bu… |
| CVE-2026-82426 | CVE-2026-82426 CVSS 6.5 | Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a server-side path and opened it directly, wi… |
| CVE-2026-82424 | CVE-2026-82424 CVSS 6.3 | A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /student_ed… |
| CVE-2026-82423 | CVE-2026-82423 CVSS 5.4 | A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payme… |
| CVE-2026-82422 | CVE-2026-82422 CVSS 6.3 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/emp_del.php. The manipul… |
| CVE-2026-82421 | CVE-2026-82421 CVSS 6.3 | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/emp_edit.php. The … |
| CVE-2026-8242 | CVE-2026-8242 CVSS 3.7 | A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03. The impacted element is the function doAction of the component Login RMI Inte… |
| CVE-2026-82417 | CVE-2026-82417 CVSS 5.3 | ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. … |
| CVE-2026-82416 | CVE-2026-82416 CVSS 7.7 | FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session exten… |
| CVE-2026-82412 | CVE-2026-82412 CVSS 8.8 | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua an… |
| CVE-2026-82410 | CVE-2026-82410 | Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but… |
| CVE-2026-8241 | CVE-2026-8241 CVSS 5.3 | A vulnerability has been found in Industrial Application Software IAS Canias ERP 8.03. The affected element is the function iasGetServerInfoEvent of the compon… |
| CVE-2026-82409 | CVE-2026-82409 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-co… |
| CVE-2026-82407 | CVE-2026-82407 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator up… |
| CVE-2026-82406 | CVE-2026-82406 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not … |
| CVE-2026-82405 | CVE-2026-82405 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a t… |
| CVE-2026-82404 | CVE-2026-82404 CVSS 8.3 | TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a __proto__, constructor, … |
| CVE-2026-82402 | CVE-2026-82402 | Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect end… |
| CVE-2026-8240 | CVE-2026-8240 CVSS 5.3concretecms | Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure across every page with a configured summary template, revealing the exis… |
| CVE-2026-82399 | CVE-2026-82399 CVSS 7.5 | CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in plugin/pkg/doh/d… |
| CVE-2026-82398 | CVE-2026-82398 CVSS 5.3pypdf_project | pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py functi… |
| CVE-2026-82397 | CVE-2026-82397 CVSS 7.5 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with url… |
| CVE-2026-82396 | CVE-2026-82396 CVSS 5.4 | Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller… |
| CVE-2026-82395 | CVE-2026-82395 | Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its pe… |
| CVE-2026-82394 | CVE-2026-82394 | Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu… |
| CVE-2026-82393 | CVE-2026-82393 CVSS 7.5 | pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm… |
| CVE-2026-82392 | CVE-2026-82392 CVSS 7.1 | pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys w… |
| CVE-2026-8239 | CVE-2026-8239 CVSS 5.3concretecms | Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating' endpoint confirms existence and returns rating score for any m… |
| CVE-2026-82387 | CVE-2026-82387 CVSS 5.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with media-upload rights to store act… |
| CVE-2026-82386 | CVE-2026-82386 CVSS 7.7 | Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and rea… |
| CVE-2026-82385 | CVE-2026-82385 CVSS 6.5 | Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, inc… |
| CVE-2026-82384 | CVE-2026-82384 CVSS 9.8 | Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, becau… |
| CVE-2026-82383 | CVE-2026-82383 CVSS 8.2 | Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuratio… |
| CVE-2026-82382 | CVE-2026-82382 CVSS 6.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross… |
| CVE-2026-82381 | CVE-2026-82381 CVSS 5.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to … |
| CVE-2026-82380 | CVE-2026-82380 CVSS 8.1 | Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim'… |
| CVE-2026-8238 | CVE-2026-8238 CVSS 5.3concretecms | Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_page' endpoint returns the full content of any conversation messag… |