106,194 indexed
CVECVE vulnerabilities
106,194 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 11,351–11,400 of 106,194 · page 228 of 2124
| ID | Title | Summary |
|---|---|---|
| CVE-2026-82379 | CVE-2026-82379 CVSS 7.7 | Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain … |
| CVE-2026-82378 | CVE-2026-82378 CVSS 9.0 | Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding req… |
| CVE-2026-82377 | CVE-2026-82377 CVSS 9.9 | Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the lega… |
| CVE-2026-82376 | CVE-2026-82376 CVSS 7.7 | Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse a… |
| CVE-2026-82375 | CVE-2026-82375 CVSS 7.4 | Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to… |
| CVE-2026-82372 | CVE-2026-82372 | Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being rec… |
| CVE-2026-82371 | CVE-2026-82371 | Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve adminis… |
| CVE-2026-82370 | CVE-2026-82370 | Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative… |
| CVE-2026-8237 | CVE-2026-8237 CVSS 5.3concretecms | Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of any conversation mess… |
| CVE-2026-82369 | CVE-2026-82369 | Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted ex… |
| CVE-2026-82368 | CVE-2026-82368 | Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly … |
| CVE-2026-82367 | CVE-2026-82367 | Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's … |
| CVE-2026-82364 | CVE-2026-82364 CVSS 4.2 | A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /order/submit of the component Order Su… |
| CVE-2026-8236 | CVE-2026-8236 CVSS 4.3concretecms | Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an in… |
| CVE-2026-82358 | CVE-2026-82358 CVSS 6.5 | RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' that fails to properl… |
| CVE-2026-82357 | CVE-2026-82357 CVSS 6.5 | RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application ma… |
| CVE-2026-82356 | CVE-2026-82356 CVSS 7.5 | Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely f… |
| CVE-2026-82355 | CVE-2026-82355 CVSS 4.2apache | When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie… |
| CVE-2026-8235 | CVE-2026-8235 CVSS 5.5 | A vulnerability was detected in 8421bit MiniClaw 0.8.0/0.9.0. This issue affects the function resolveSkillScriptPath of the file src/kernel.ts of the component… |
| CVE-2026-82348 | CVE-2026-82348 CVSS 7.7 | Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or de… |
| CVE-2026-82346 | CVE-2026-82346 | A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36. The vulnerability could potentially allow a local a… |
| CVE-2026-82344 | CVE-2026-82344 CVSS 8.1ibm | IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenti… |
| CVE-2026-82343 | CVE-2026-82343 CVSS 6.1gimp | A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count pa… |
| CVE-2026-82340 | CVE-2026-82340 CVSS 9.8ibm | IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Au… |
| CVE-2026-8234 | CVE-2026-8234 CVSS 8.8 | A security vulnerability has been detected in EFM ipTIME A8004T 14.18.2. This vulnerability affects the function formWifiBasicSet of the file /goform/WifiBasic… |
| CVE-2026-82335 | CVE-2026-82335 CVSS 8.1ibm | IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a spec… |
| CVE-2026-82334 | CVE-2026-82334 CVSS 8.1ibm | IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send… |
| CVE-2026-82333 | CVE-2026-82333 CVSS 7.5expressjs | multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's fie… |
| CVE-2026-82331 | CVE-2026-82331 CVSS 9.8 | Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Python < 3.12 allows m… |
| CVE-2026-82330 | CVE-2026-82330 CVSS 6.1gimp | A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memo… |
| CVE-2026-8233 | CVE-2026-8233 CVSS 4.6 | A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4. Affected is an unknown function of the component UPF. This manipulation causes improp… |
| CVE-2026-82329 | JFrog Artifactory Improper Authentication Vulnerability KEVCVSS 9.8JFrog | JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access … |
| CVE-2026-82328 | CVE-2026-82328 CVSS 6.1gimp | A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palet… |
| CVE-2026-82327 | CVE-2026-82327 CVSS 5.5 | A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache file… |
| CVE-2026-82326 | CVE-2026-82326 CVSS 4.1 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Enocta Educational Technologies Inc. Enocta Platform allo… |
| CVE-2026-82325 | CVE-2026-82325 | A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via craf… |
| CVE-2026-82324 | CVE-2026-82324 CVSS 6.1gimp | A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the … |
| CVE-2026-82323 | CVE-2026-82323 CVSS 8.1 | Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows Exploitation of Trusted Identifie… |
| CVE-2026-8232 | CVE-2026-8232 CVSS 3.5 | A vulnerability was found in Dotouch XproUPF 2.0.0-release-088aa7c4. This impacts the function vlib_worker_loop in the library /usr/xpro/upf/tools/libs/libvlib… |
| CVE-2026-82312 | CVE-2026-82312 | OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC… |
| CVE-2026-82311 | CVE-2026-82311 CVSS 9.8apache | Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it do… |
| CVE-2026-82310 | CVE-2026-82310 CVSS 7.2apache | Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rej… |
| CVE-2026-8231 | CVE-2026-8231 CVSS 6.3 | A vulnerability has been found in CodeAstro Online Catering Ordering System 1.0. This affects an unknown function of the file /deleteorder.php. The manipulatio… |
| CVE-2026-82309 | CVE-2026-82309 CVSS 4.3 | Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not b… |
| CVE-2026-82307 | CVE-2026-82307 CVSS 9.8 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injectio… |
| CVE-2026-82306 | CVE-2026-82306 CVSS 6.5 | StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Aut… |
| CVE-2026-82305 | CVE-2026-82305 CVSS 5.3 | The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated use… |
| CVE-2026-82304 | CVE-2026-82304 CVSS 8.6 | The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitab… |
| CVE-2026-82302 | CVE-2026-82302 CVSS 8.1 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security L… |
| CVE-2026-82300 | CVE-2026-82300 CVSS 6.5elastic | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). |