106,194 indexed
CVECVE vulnerabilities
106,194 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 11,451–11,500 of 106,194 · page 230 of 2124
| ID | Title | Summary |
|---|---|---|
| CVE-2026-82250 | CVE-2026-82250 CVSS 6.5 | gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines w… |
| CVE-2026-8225 | CVE-2026-8225 CVSS 5.3open5gs | A vulnerability was identified in Open5GS up to 2.7.7. This affects the function pcf_npcf_smpolicycontrol_handle_delete of the file src/pcf/sm-sm.c of the comp… |
| CVE-2026-82249 | CVE-2026-82249 CVSS 3.1 | gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carri… |
| CVE-2026-82248 | CVE-2026-82248 CVSS 5.3 | gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing te… |
| CVE-2026-82247 | CVE-2026-82247 CVSS 7.5 | gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, cont… |
| CVE-2026-82246 | CVE-2026-82246 CVSS 7.1 | Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs befor… |
| CVE-2026-82245 | CVE-2026-82245 CVSS 8.1 | Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or man… |
| CVE-2026-82244 | CVE-2026-82244 CVSS 9.1 | Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary cod… |
| CVE-2026-82243 | CVE-2026-82243 CVSS 7.6 | Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply … |
| CVE-2026-82242 | CVE-2026-82242 CVSS 7.7 | Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders … |
| CVE-2026-82241 | CVE-2026-82241 CVSS 7.1 | Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist … |
| CVE-2026-82240 | CVE-2026-82240 CVSS 8.1 | Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scop… |
| CVE-2026-8224 | CVE-2026-8224 CVSS 5.3open5gs | A vulnerability was determined in Open5GS up to 2.7.7. Affected by this issue is the function pcf_sess_set_ipv6prefix of the file /src/pcf/context.c of the com… |
| CVE-2026-82239 | CVE-2026-82239 CVSS 8.1 | Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, cr… |
| CVE-2026-82238 | CVE-2026-82238 CVSS 3.1 | filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by… |
| CVE-2026-82237 | CVE-2026-82237 CVSS 3.1 | filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share record is keyed by pa… |
| CVE-2026-82236 | CVE-2026-82236 CVSS 3.1 | File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can … |
| CVE-2026-82235 | CVE-2026-82235 CVSS 5.9 | filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscal… |
| CVE-2026-82234 | CVE-2026-82234 CVSS 8.2 | SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution onl… |
| CVE-2026-82233 | CVE-2026-82233 CVSS 5.7 | SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary… |
| CVE-2026-82232 | CVE-2026-82232 CVSS 9.8 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate entitle… |
| CVE-2026-8223 | CVE-2026-8223 CVSS 5.3open5gs | A vulnerability was found in Open5GS up to 2.7.7. Affected by this vulnerability is the function pcf_sess_sbi_discover_and_send of the component sm-policies En… |
| CVE-2026-82229 | CVE-2026-82229 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions. |
| CVE-2026-82228 | CVE-2026-82228 CVSS 8.1 | Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions. |
| CVE-2026-82227 | CVE-2026-82227 CVSS 8.5 | Contributor SQL Injection in WPBulky <= 1.2.2 versions. |
| CVE-2026-82226 | CVE-2026-82226 CVSS 9.8 | Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions. |
| CVE-2026-82225 | CVE-2026-82225 CVSS 7.4 | Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions. |
| CVE-2026-82224 | CVE-2026-82224 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions. |
| CVE-2026-82223 | CVE-2026-82223 CVSS 6.5 | Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions. |
| CVE-2026-82222 | CVE-2026-82222 CVSS 10.0 | Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1. |
| CVE-2026-82221 | CVE-2026-82221 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions. |
| CVE-2026-82220 | CVE-2026-82220 CVSS 5.3 | Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions. |
| CVE-2026-8222 | CVE-2026-8222 CVSS 5.3open5gs | A vulnerability has been found in Open5GS up to 2.7.7. Affected is the function pcf_nbsf_management_handle_register of the file src/pcf/nbsf-handler.c of the c… |
| CVE-2026-82217 | CVE-2026-82217 CVSS 8.8 | In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replaceme… |
| CVE-2026-82215 | CVE-2026-82215 CVSS 5.9 | The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before … |
| CVE-2026-82213 | CVE-2026-82213 CVSS 5.3 | The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing una… |
| CVE-2026-82212 | CVE-2026-82212 CVSS 7.5 | The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when… |
| CVE-2026-82211 | CVE-2026-82211 CVSS 8.2 | The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to … |
| CVE-2026-8221 | CVE-2026-8221 CVSS 2.4 | A flaw has been found in Devs Palace ERP Online up to 4.0.0. This impacts an unknown function of the file /inventory/item-save. This manipulation causes cross … |
| CVE-2026-82209 | CVE-2026-82209 CVSS 8.2haxx | When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribu… |
| CVE-2026-82208 | CVE-2026-82208 CVSS 7.5haxx | With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the ca… |
| CVE-2026-8220 | CVE-2026-8220 CVSS 2.4 | A vulnerability was detected in Devs Palace ERP Online up to 4.0.0. This affects an unknown function of the file /inventory/customer-save. The manipulation res… |
| CVE-2026-82195 | CVE-2026-82195 CVSS 6.5 | The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connectio… |
| CVE-2026-82194 | CVE-2026-82194 CVSS 5.5 | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, al… |
| CVE-2026-82193 | CVE-2026-82193 CVSS 5.5 | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, al… |
| CVE-2026-82191 | CVE-2026-82191 | Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted … |
| CVE-2026-82190 | CVE-2026-82190 | Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's … |
| CVE-2026-8219 | CVE-2026-8219 CVSS 2.4 | A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0. The impacted element is an unknown function of the file /inventory/supplier-s… |
| CVE-2026-82189 | CVE-2026-82189 | Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-serv… |
| CVE-2026-82187 | CVE-2026-82187 CVSS 9.8 | The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those… |