106,194 indexed
CVECVE vulnerabilities
106,194 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 11,651–11,700 of 106,194 · page 234 of 2124
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81956 | CVE-2026-81956 CVSS 7.8microsoft | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81955 | CVE-2026-81955 CVSS 8.8 | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
| CVE-2026-81954 | CVE-2026-81954 CVSS 7.8microsoft | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81953 | CVE-2026-81953 CVSS 7.8microsoft | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81952 | CVE-2026-81952 CVSS 8.8microsoft | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| CVE-2026-81951 | CVE-2026-81951 CVSS 7.8microsoft | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81950 | CVE-2026-81950 CVSS 7.8microsoft | Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-8195 | CVE-2026-8195 CVSS 4.3 | A vulnerability was detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/ja… |
| CVE-2026-81949 | CVE-2026-81949 CVSS 7.8microsoft | Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81948 | CVE-2026-81948 CVSS 7.8microsoft | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81947 | CVE-2026-81947 CVSS 7.8microsoft | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81946 | CVE-2026-81946 CVSS 4.4 | PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptogra… |
| CVE-2026-81945 | CVE-2026-81945 CVSS 6.6 | PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in th… |
| CVE-2026-81944 | CVE-2026-81944 CVSS 7.5 | PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in th… |
| CVE-2026-81943 | CVE-2026-81943 CVSS 6.7 | PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the e… |
| CVE-2026-81942 | CVE-2026-81942 CVSS 8.8 | PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerabili… |
| CVE-2026-81941 | CVE-2026-81941 CVSS 8.8langflow | IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the pr… |
| CVE-2026-81940 | CVE-2026-81940 CVSS 8.8langflow | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special character… |
| CVE-2026-8194 | CVE-2026-8194 CVSS 4.3 | A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component … |
| CVE-2026-81939 | CVE-2026-81939 CVSS 9.1 | A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract… |
| CVE-2026-81937 | CVE-2026-81937 CVSS 7.2ibm | IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import remotelog_config file CLI command. A highly privileged authe… |
| CVE-2026-81934 | CVE-2026-81934 CVSS 7.1 | Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TL… |
| CVE-2026-81933 | CVE-2026-81933 CVSS 8.8ibm | IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Analytic Grid Service Handler. A low-privileged authenticated user can … |
| CVE-2026-81932 | CVE-2026-81932 CVSS 8.6ibm | IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements… |
| CVE-2026-81931 | CVE-2026-81931 | Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the … |
| CVE-2026-81930 | CVE-2026-81930 CVSS 6.3apache | Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API en… |
| CVE-2026-8193 | CVE-2026-8193 CVSS 6.3 | A weakness has been identified in Akaunting 3.1.21. This issue affects some unknown processing of the file config/dompdf.php of the component Invoice PDF Rende… |
| CVE-2026-81929 | CVE-2026-81929 CVSS 7.2 | The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions… |
| CVE-2026-81928 | CVE-2026-81928 CVSS 7.5 | Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. si… |
| CVE-2026-81927 | CVE-2026-81927 CVSS 5.4concretecms | Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject fi… |
| CVE-2026-81926 | CVE-2026-81926 CVSS 6.1concretecms | Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The pane… |
| CVE-2026-81925 | CVE-2026-81925 CVSS 6.1concretecms | Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scr… |
| CVE-2026-81924 | CVE-2026-81924 CVSS 6.5concretecms | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard theme Inspect control… |
| CVE-2026-81923 | CVE-2026-81923 CVSS 2.7concretecms | In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the… |
| CVE-2026-81922 | CVE-2026-81922 CVSS 2.7concretecms | Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, t… |
| CVE-2026-81921 | CVE-2026-81921 CVSS 5.4concretecms | Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a va… |
| CVE-2026-81920 | CVE-2026-81920 CVSS 4.3concretecms | Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() controller action cleared the admin… |
| CVE-2026-8192 | CVE-2026-8192 CVSS 6.3wavlink | A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. This vulnerability affects the function wzdap of the file /cgi-bin/adm.cgi. Performing a … |
| CVE-2026-81919 | CVE-2026-81919 CVSS 4.3concretecms | Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Pag… |
| CVE-2026-81918 | CVE-2026-81918 CVSS 4.8concretecms | Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions … |
| CVE-2026-81917 | CVE-2026-81917 CVSS 5.4concretecms | Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with … |
| CVE-2026-81916 | CVE-2026-81916 CVSS 4.3concretecms | Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identi… |
| CVE-2026-81915 | CVE-2026-81915 CVSS 5.3concretecms | Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and… |
| CVE-2026-81914 | CVE-2026-81914 CVSS 4.3apache | Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, with… |
| CVE-2026-81913 | CVE-2026-81913 CVSS 6.1concretecms | Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain… |
| CVE-2026-81912 | CVE-2026-81912 CVSS 5.7concretecms | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endp… |
| CVE-2026-81911 | CVE-2026-81911 CVSS 5.4concretecms | Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template endpoint authorizes the request onl… |
| CVE-2026-81910 | CVE-2026-81910 CVSS 6.5concretecms | Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. Values submitted through … |
| CVE-2026-8191 | CVE-2026-8191 CVSS 6.3wavlink | A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This affects the function wifi_region of the file /cgi-bin/adm.cgi. Such manipulation of the a… |
| CVE-2026-81909 | CVE-2026-81909 | Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concrete/controllers/backend/block/process.ph… |