106,194 indexed
CVECVE vulnerabilities
106,194 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 11,751–11,800 of 106,194 · page 236 of 2124
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81855 | CVE-2026-81855 CVSS 9.1 | A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard. |
| CVE-2026-81853 | CVE-2026-81853 | Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attrib… |
| CVE-2026-81852 | CVE-2026-81852 | Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-… |
| CVE-2026-81851 | CVE-2026-81851 | A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a d… |
| CVE-2026-8185 | CVE-2026-8185 CVSS 6.3 | A security vulnerability has been detected in UGREEN CM933 1.1.59.4319. The impacted element is an unknown function of the component Administrative Interface. … |
| CVE-2026-81849 | CVE-2026-81849 CVSS 8.8 | Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticate… |
| CVE-2026-81848 | CVE-2026-81848 CVSS 3.5 | A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function s_fetch_page/s_fetch_pattern of the file sr… |
| CVE-2026-81847 | CVE-2026-81847 CVSS 5.5 | A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function save_pipeline/load_pipeline of the file pipeline_t… |
| CVE-2026-81846 | CVE-2026-81846 CVSS 3.5 | An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypa… |
| CVE-2026-81845 | CVE-2026-81845 CVSS 6.3 | A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function import_session/export_session of the file mcp_sequent… |
| CVE-2026-81842 | CVE-2026-81842 CVSS 4.3 | An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library… |
| CVE-2026-81841 | CVE-2026-81841 CVSS 5.3 | Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused s… |
| CVE-2026-81839 | CVE-2026-81839 CVSS 7.7gitlab | GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain cond… |
| CVE-2026-81838 | CVE-2026-81838 CVSS 7.1amazon | A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to wr… |
| CVE-2026-81837 | CVE-2026-81837 CVSS 6.3 | A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the com… |
| CVE-2026-81836 | CVE-2026-81836 CVSS 3.7 | A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of … |
| CVE-2026-81835 | CVE-2026-81835 CVSS 5.5 | A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetch_instructions of the file malicious_mcp_server.p… |
| CVE-2026-81834 | CVE-2026-81834 CVSS 6.3 | A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Ha… |
| CVE-2026-81833 | CVE-2026-81833 CVSS 5.5 | A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/hel… |
| CVE-2026-81832 | CVE-2026-81832 CVSS 7.7ibm | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is… |
| CVE-2026-81830 | CVE-2026-81830 | The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via i… |
| CVE-2026-8183 | CVE-2026-8183 CVSS 7.7langflow | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could a… |
| CVE-2026-81829 | CVE-2026-81829 CVSS 5.3 | A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When th… |
| CVE-2026-81827 | CVE-2026-81827 | Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForms field validation;… |
| CVE-2026-81826 | CVE-2026-81826 | Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already posses… |
| CVE-2026-81825 | CVE-2026-81825 CVSS 7.2 | The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, an… |
| CVE-2026-81824 | CVE-2026-81824 CVSS 4.7 | The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered … |
| CVE-2026-81823 | CVE-2026-81823 CVSS 5.3 | The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in informatio… |
| CVE-2026-81822 | CVE-2026-81822 CVSS 8.4 | The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords … |
| CVE-2026-81821 | CVE-2026-81821 CVSS 8.4 | The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information. |
| CVE-2026-81820 | CVE-2026-81820 | Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * object name; *… |
| CVE-2026-8182 | CVE-2026-8182 CVSS 8.8langflow | IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP req… |
| CVE-2026-81819 | CVE-2026-81819 | Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying … |
| CVE-2026-81818 | CVE-2026-81818 | Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an org… |
| CVE-2026-81817 | CVE-2026-81817 | Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The rout… |
| CVE-2026-81814 | CVE-2026-81814 | Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify… |
| CVE-2026-81810 | CVE-2026-81810 CVSS 7.2 | The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on … |
| CVE-2026-8181 | CVE-2026-8181 CVSS 9.8 | The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versi… |
| CVE-2026-81809 | CVE-2026-81809 CVSS 7.5 | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the … |
| CVE-2026-81807 | CVE-2026-81807 CVSS 8.8 | The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbit… |
| CVE-2026-81806 | CVE-2026-81806 CVSS 7.2 | Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from… |
| CVE-2026-81805 | CVE-2026-81805 CVSS 8.1 | Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions. |
| CVE-2026-81804 | CVE-2026-81804 CVSS 7.5 | Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions. |
| CVE-2026-81803 | CVE-2026-81803 CVSS 7.5 | Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions. |
| CVE-2026-81802 | CVE-2026-81802 CVSS 6.5 | Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions. |
| CVE-2026-81801 | CVE-2026-81801 CVSS 8.1 | Subscriber Settings Change in WP-Stateless <= 4.4.1 versions. |
| CVE-2026-81800 | CVE-2026-81800 CVSS 9.3 | Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions. |
| CVE-2026-8180 | CVE-2026-8180 CVSS 7.5ibm | IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera … |
| CVE-2026-81799 | CVE-2026-81799 CVSS 7.5 | Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions. |
| CVE-2026-81798 | CVE-2026-81798 CVSS 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affec… |