106,194 indexed
CVECVE vulnerabilities
106,194 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 11,401–11,450 of 106,194 · page 229 of 2124
| ID | Title | Summary |
|---|---|---|
| CVE-2026-8230 | CVE-2026-8230 CVSS 6.3wavlink | A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of th… |
| CVE-2026-82299 | CVE-2026-82299 CVSS 6.5 | Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). |
| CVE-2026-82298 | CVE-2026-82298 CVSS 4.3 | Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). |
| CVE-2026-82294 | CVE-2026-82294 CVSS 6.5elastic | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). |
| CVE-2026-82293 | CVE-2026-82293 CVSS 4.3 | Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Ac… |
| CVE-2026-82291 | CVE-2026-82291 CVSS 8.1 | HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. … |
| CVE-2026-82290 | CVE-2026-82290 CVSS 5.3 | Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' … |
| CVE-2026-8229 | CVE-2026-8229 CVSS 6.3wavlink | A vulnerability was detected in Wavlink NU516U1 240425. The affected element is the function WifiBasic of the file /cgi-bin/wireless.cgi. Performing a manipula… |
| CVE-2026-82289 | CVE-2026-82289 CVSS 7.4 | Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-… |
| CVE-2026-82288 | CVE-2026-82288 CVSS 7.5 | Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line argum… |
| CVE-2026-82287 | CVE-2026-82287 CVSS 8.1 | Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Acce… |
| CVE-2026-82286 | CVE-2026-82286 CVSS 8.6 | gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary fil… |
| CVE-2026-82285 | CVE-2026-82285 CVSS 8.2 | bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication… |
| CVE-2026-82284 | CVE-2026-82284 CVSS 8.1 | Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/an… |
| CVE-2026-82283 | CVE-2026-82283 CVSS 8.1 | VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. At… |
| CVE-2026-82282 | CVE-2026-82282 CVSS 8.0 | Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers ca… |
| CVE-2026-82281 | CVE-2026-82281 CVSS 7.4 | Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in… |
| CVE-2026-82280 | CVE-2026-82280 CVSS 7.1 | Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-onl… |
| CVE-2026-8228 | CVE-2026-8228 CVSS 6.3wavlink | A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of … |
| CVE-2026-82279 | CVE-2026-82279 CVSS 8.1 | HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. At… |
| CVE-2026-82278 | CVE-2026-82278 CVSS 8.8 | BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Pyth… |
| CVE-2026-82277 | CVE-2026-82277 CVSS 9.8 | Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protectio… |
| CVE-2026-82276 | CVE-2026-82276 CVSS 5.3 | StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing … |
| CVE-2026-82275 | CVE-2026-82275 CVSS 7.5 | Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers … |
| CVE-2026-82274 | CVE-2026-82274 CVSS 4.7 | Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query para… |
| CVE-2026-82273 | CVE-2026-82273 CVSS 6.5 | Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitte… |
| CVE-2026-82272 | CVE-2026-82272 CVSS 6.5 | Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain access… |
| CVE-2026-82271 | CVE-2026-82271 CVSS 6.5 | R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' co… |
| CVE-2026-82270 | CVE-2026-82270 CVSS 7.5 | Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attacke… |
| CVE-2026-8227 | CVE-2026-8227 CVSS 6.3wavlink | A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipulation causes os c… |
| CVE-2026-82269 | CVE-2026-82269 CVSS 8.1 | Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys ca… |
| CVE-2026-82268 | CVE-2026-82268 CVSS 7.5 | Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without s… |
| CVE-2026-82267 | CVE-2026-82267 CVSS 5.4 | Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant… |
| CVE-2026-82266 | CVE-2026-82266 CVSS 9.8 | Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. A… |
| CVE-2026-82265 | CVE-2026-82265 CVSS 6.5 | Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensit… |
| CVE-2026-82264 | CVE-2026-82264 CVSS 6.8 | Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. At… |
| CVE-2026-82263 | CVE-2026-82263 CVSS 6.8 | Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL par… |
| CVE-2026-82262 | CVE-2026-82262 CVSS 6.8 | Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host val… |
| CVE-2026-82261 | CVE-2026-82261 CVSS 7.5svelte | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form des… |
| CVE-2026-82260 | CVE-2026-82260 CVSS 7.5svelte | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory ex… |
| CVE-2026-8226 | CVE-2026-8226 CVSS 5.3open5gs | A security flaw has been discovered in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pcc_rule_install_flow_from_media in the library /lib/pr… |
| CVE-2026-82259 | CVE-2026-82259 CVSS 7.5svelte | SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an app… |
| CVE-2026-82258 | CVE-2026-82258 CVSS 4.8svelte | SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a sing… |
| CVE-2026-82257 | CVE-2026-82257 CVSS 4.3svelte | SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-control… |
| CVE-2026-82256 | CVE-2026-82256 CVSS 5.3svelte | SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. … |
| CVE-2026-82255 | CVE-2026-82255 CVSS 6.8 | gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controll… |
| CVE-2026-82254 | CVE-2026-82254 CVSS 7.5 | gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attack… |
| CVE-2026-82253 | CVE-2026-82253 CVSS 7.5 | gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate… |
| CVE-2026-82252 | CVE-2026-82252 CVSS 7.5 | gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadat… |
| CVE-2026-82251 | CVE-2026-82251 CVSS 7.5 | gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attac… |