106,194 indexed
CVECVE vulnerabilities
106,194 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 11,551–11,600 of 106,194 · page 232 of 2124
| ID | Title | Summary |
|---|---|---|
| CVE-2026-82078 | PaperCut NG/MF Unsafe Reflection Vulnerability KEVCVSS 9.1PaperCut | PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java byt… |
| CVE-2026-82077 | CVE-2026-82077 | An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allow… |
| CVE-2026-82076 | CVE-2026-82076 CVSS 6.5mongodb | An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to byp… |
| CVE-2026-82075 | CVE-2026-82075 CVSS 7.5mongodb | An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network acce… |
| CVE-2026-82074 | CVE-2026-82074 CVSS 6.5mongodb | MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specia… |
| CVE-2026-82073 | CVE-2026-82073 CVSS 6.5mongodb | A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization check… |
| CVE-2026-82072 | CVE-2026-82072 CVSS 8.8google | Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page… |
| CVE-2026-82071 | CVE-2026-82071 CVSS 8.1mongodb | Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted paramete… |
| CVE-2026-82070 | CVE-2026-82070 CVSS 6.5mongodb | A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected … |
| CVE-2026-8207 | CVE-2026-8207 | Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://github.com/GibbonEdu/cor… |
| CVE-2026-82069 | CVE-2026-82069 CVSS 2.7mongodb | A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query tex… |
| CVE-2026-82068 | CVE-2026-82068 CVSS 6.5mongodb | A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafte… |
| CVE-2026-82067 | CVE-2026-82067 CVSS 8.1mongodb | Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default … |
| CVE-2026-82066 | CVE-2026-82066 CVSS 4.3mongodb | A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privilege… |
| CVE-2026-82065 | CVE-2026-82065 CVSS 6.5mongodb | A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persisten… |
| CVE-2026-82064 | CVE-2026-82064 CVSS 7.5mongodb | A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server con… |
| CVE-2026-82063 | CVE-2026-82063 CVSS 5.3mongodb | A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific … |
| CVE-2026-82062 | CVE-2026-82062 CVSS 5.5mongodb | A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by … |
| CVE-2026-82061 | CVE-2026-82061 CVSS 8.1mongodb | A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a writ… |
| CVE-2026-82060 | CVE-2026-82060 CVSS 5.4mongodb | In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operat… |
| CVE-2026-8206 | CVE-2026-8206 CVSS 9.8 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions… |
| CVE-2026-82059 | CVE-2026-82059 CVSS 5.3mongodb | An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to interna… |
| CVE-2026-82058 | CVE-2026-82058 CVSS 6.5mongodb | A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON… |
| CVE-2026-82057 | CVE-2026-82057 CVSS 6.5mongodb | A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom … |
| CVE-2026-82056 | CVE-2026-82056 CVSS 5.3mongodb | A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent i… |
| CVE-2026-82055 | CVE-2026-82055 CVSS 6.5mongodb | A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted Ge… |
| CVE-2026-82054 | CVE-2026-82054 CVSS 6.5mongodb | A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially craft… |
| CVE-2026-82053 | CVE-2026-82053 CVSS 8.1mongodb | A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authent… |
| CVE-2026-82052 | CVE-2026-82052 CVSS 6.5mongodb | The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain spe… |
| CVE-2026-8205 | CVE-2026-8205 CVSS 5.3concretecms | Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which r… |
| CVE-2026-82049 | CVE-2026-82049 | In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link.… |
| CVE-2026-82045 | CVE-2026-82045 CVSS 6.5 | UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanS… |
| CVE-2026-82044 | CVE-2026-82044 CVSS 7.7 | UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal … |
| CVE-2026-82043 | CVE-2026-82043 CVSS 5.3 | UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observin… |
| CVE-2026-82042 | CVE-2026-82042 CVSS 9.8 | UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a val… |
| CVE-2026-82041 | CVE-2026-82041 CVSS 9.9 | UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hos… |
| CVE-2026-82040 | CVE-2026-82040 CVSS 5.0 | UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl() that allows authenticated attacke… |
| CVE-2026-8204 | CVE-2026-8204 CVSS 5.3concretecms | Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A publ… |
| CVE-2026-82039 | CVE-2026-82039 CVSS 8.8 | UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbit… |
| CVE-2026-82035 | CVE-2026-82035 CVSS 7.1 | PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the … |
| CVE-2026-8203 | CVE-2026-8203 CVSS 5.4concretecms | Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $height. Any user with editor privileges can … |
| CVE-2026-82028 | CVE-2026-82028 CVSS 8.8 | Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attacker… |
| CVE-2026-82026 | CVE-2026-82026 CVSS 8.8 | Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticate… |
| CVE-2026-82024 | CVE-2026-82024 CVSS 5.4 | LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to i… |
| CVE-2026-82023 | CVE-2026-82023 CVSS 4.3 | LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor rol… |
| CVE-2026-82021 | CVE-2026-82021 CVSS 8.3 | Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by… |
| CVE-2026-82020 | CVE-2026-82020 CVSS 6.8 | Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to ove… |
| CVE-2026-82019 | CVE-2026-82019 CVSS 4.2 | TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arb… |
| CVE-2026-82018 | CVE-2026-82018 CVSS 6.1 | IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically p… |
| CVE-2026-82017 | CVE-2026-82017 CVSS 7.6 | IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access t… |