106,194 indexed
CVECVE vulnerabilities
106,194 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 11,701–11,750 of 106,194 · page 235 of 2124
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81908 | CVE-2026-81908 | Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Con… |
| CVE-2026-81907 | CVE-2026-81907 CVSS 7.1concretecms | Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST /index.php/dashboard/system/expre… |
| CVE-2026-81906 | CVE-2026-81906 | Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establishing a session. A d… |
| CVE-2026-81905 | CVE-2026-81905 | Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email/registration validation, password reset, and persistent login) in a single … |
| CVE-2026-81904 | CVE-2026-81904 | Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack, Container, or layout area without checking whether the requesting user could vi… |
| CVE-2026-81903 | CVE-2026-81903 CVSS 5.4concretecms | Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known contai… |
| CVE-2026-81902 | CVE-2026-81902 CVSS 8.1concretecms | Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote attacker could craft a r… |
| CVE-2026-81901 | CVE-2026-81901 CVSS 8.7concretecms | In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-typ… |
| CVE-2026-81900 | CVE-2026-81900 CVSS 6.1concretecms | Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escapi… |
| CVE-2026-8190 | CVE-2026-8190 CVSS 6.3wavlink | A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. Affected by this issue is the function wan of the file /cgi-bin/adm.cgi. This manipulation of … |
| CVE-2026-81899 | CVE-2026-81899 | Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page, resulting in stor… |
| CVE-2026-81898 | CVE-2026-81898 | In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association view… |
| CVE-2026-81897 | CVE-2026-81897 CVSS 5.4concretecms | In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller did not validate the anti-CSRF token. By causing an… |
| CVE-2026-81896 | CVE-2026-81896 CVSS 5.4concretecms | Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard… |
| CVE-2026-81895 | CVE-2026-81895 CVSS 7.2concretecms | In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID[] without validating them as integers, and when… |
| CVE-2026-81894 | CVE-2026-81894 CVSS 5.4concretecms | Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-image Caption field because the bundled M… |
| CVE-2026-81893 | CVE-2026-81893 CVSS 4.7 | A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can lea… |
| CVE-2026-81892 | CVE-2026-81892 CVSS 8.1 | EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a si… |
| CVE-2026-81891 | CVE-2026-81891 CVSS 8.1 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.… |
| CVE-2026-81890 | CVE-2026-81890 CVSS 5.4 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector… |
| CVE-2026-8189 | CVE-2026-8189 CVSS 6.3wavlink | A vulnerability was found in Wavlink NU516U1 M16U1_V240425. Affected by this vulnerability is the function wzdrepeater of the file /cgi-bin/adm.cgi. The manipu… |
| CVE-2026-81889 | CVE-2026-81889 CVSS 8.6 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can byp… |
| CVE-2026-81888 | CVE-2026-81888 CVSS 5.4 | @hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the… |
| CVE-2026-81887 | CVE-2026-81887 | Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, in… |
| CVE-2026-81886 | CVE-2026-81886 CVSS 5.5radare | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable … |
| CVE-2026-81885 | CVE-2026-81885 CVSS 5.5radare | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable becaus… |
| CVE-2026-81884 | CVE-2026-81884 CVSS 2.5radare | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LC_DATA_IN_CODE parser was vulnerable because t… |
| CVE-2026-81883 | CVE-2026-81883 CVSS 3.3radare | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable becaus… |
| CVE-2026-81882 | CVE-2026-81882 CVSS 3.3radare | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable bec… |
| CVE-2026-81881 | CVE-2026-81881 CVSS 3.3radare | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable beca… |
| CVE-2026-81880 | CVE-2026-81880 CVSS 5.5radare | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerabl… |
| CVE-2026-8188 | CVE-2026-8188 CVSS 6.3wavlink | A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. Affected is the function change_wifi_password of the file /cgi-bin/adm.cgi. The manipulation o… |
| CVE-2026-81879 | CVE-2026-81879 CVSS 5.5radare | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF pa… |
| CVE-2026-81878 | CVE-2026-81878 CVSS 5.5radare | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable be… |
| CVE-2026-81876 | CVE-2026-81876 CVSS 7.5 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/… |
| CVE-2026-81875 | CVE-2026-81875 CVSS 7.5 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/… |
| CVE-2026-81872 | CVE-2026-81872 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight C… |
| CVE-2026-81871 | CVE-2026-81871 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LO… |
| CVE-2026-81870 | CVE-2026-81870 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal I… |
| CVE-2026-8187 | CVE-2026-8187 CVSS 5.3open5gs | A flaw has been found in Open5GS up to 2.7.7. This impacts the function _gtpv1_u_recv_cb of the file src/upf/gtp-path.c of the component UPF. Executing a manip… |
| CVE-2026-81869 | CVE-2026-81869 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enfor… |
| CVE-2026-81868 | CVE-2026-81868 CVSS 6.5 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.… |
| CVE-2026-81867 | CVE-2026-81867 | A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud P… |
| CVE-2026-81866 | CVE-2026-81866 CVSS 4.3apache | Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets … |
| CVE-2026-81862 | CVE-2026-81862 CVSS 6.5apache | Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTeradataOperator` and `AzureBlobStorageToTeradataOpera… |
| CVE-2026-81861 | CVE-2026-81861 | CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU function… |
| CVE-2026-8186 | CVE-2026-8186 CVSS 5.3open5gs | A vulnerability was detected in Open5GS up to 2.7.7. This affects the function ogs_sbi_client_send_via_scp_or_sepp in the library lib/sbi/client.c of the compo… |
| CVE-2026-81859 | CVE-2026-81859 CVSS 6.2 | CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to the use of a broken or risky cryptographic algorithm. |
| CVE-2026-81858 | CVE-2026-81858 CVSS 5.4ibm | IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in th… |
| CVE-2026-81856 | CVE-2026-81856 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to… |