106,194 indexed
CVECVE vulnerabilities
106,194 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 11,851–11,900 of 106,194 · page 238 of 2124
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81742 | CVE-2026-81742 CVSS 8.8 | The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted,… |
| CVE-2026-81741 | CVE-2026-81741 CVSS 4.7 | The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirm… |
| CVE-2026-81740 | CVE-2026-81740 CVSS 5.3 | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret ke… |
| CVE-2026-8174 | CVE-2026-8174 CVSS 5.7 | Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF). This issue affects Zoho Mail wordpress plugin versions before 1.6.2. |
| CVE-2026-81739 | CVE-2026-81739 CVSS 7.5 | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin pag… |
| CVE-2026-81738 | CVE-2026-81738 | OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries |
| CVE-2026-81737 | CVE-2026-81737 CVSS 8.8 | The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it… |
| CVE-2026-81736 | CVE-2026-81736 CVSS 7.5 | If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate C… |
| CVE-2026-81735 | CVE-2026-81735 CVSS 10.0 | startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpSe… |
| CVE-2026-81733 | CVE-2026-81733 | WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The… |
| CVE-2026-81732 | CVE-2026-81732 | WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to u… |
| CVE-2026-81731 | CVE-2026-81731 CVSS 5.4frappe | Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is … |
| CVE-2026-81730 | CVE-2026-81730 CVSS 8.2dolibarr | Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The… |
| CVE-2026-8173 | CVE-2026-8173 CVSS 5.3 | The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy… |
| CVE-2026-81729 | CVE-2026-81729 CVSS 6.5dolibarr | Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php call… |
| CVE-2026-81728 | CVE-2026-81728 CVSS 8.1dolibarr | Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdo… |
| CVE-2026-81727 | CVE-2026-81727 CVSS 7.1nltk | NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows a… |
| CVE-2026-81726 | CVE-2026-81726 CVSS 7.0nltk | NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-contr… |
| CVE-2026-81725 | CVE-2026-81725 CVSS 3.7nltk | NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption… |
| CVE-2026-81724 | CVE-2026-81724 CVSS 5.3nltk | NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial… |
| CVE-2026-81723 | CVE-2026-81723 CVSS 3.7 | NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on ev… |
| CVE-2026-81722 | CVE-2026-81722 CVSS 7.5nltk | nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_co… |
| CVE-2026-81721 | CVE-2026-81721 CVSS 7.5jahlives | openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded mem… |
| CVE-2026-81720 | CVE-2026-81720 CVSS 6.2jahlives | openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory cond… |
| CVE-2026-8172 | CVE-2026-8172 CVSS 7.1 | The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on valida… |
| CVE-2026-81719 | CVE-2026-81719 CVSS 7.8jahlives | openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/u… |
| CVE-2026-81718 | CVE-2026-81718 CVSS 7.5 | openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 it… |
| CVE-2026-81717 | CVE-2026-81717 CVSS 3.5jahlives | openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable d… |
| CVE-2026-81716 | CVE-2026-81716 CVSS 5.2jahlives | openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a… |
| CVE-2026-81715 | CVE-2026-81715 CVSS 3.3jahlives | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-to… |
| CVE-2026-81714 | CVE-2026-81714 CVSS 7.0jahlives | openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust ancho… |
| CVE-2026-81707 | CVE-2026-81707 CVSS 9.8 | openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge th… |
| CVE-2026-81706 | CVE-2026-81706 CVSS 6.8jahlives | openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed … |
| CVE-2026-81705 | CVE-2026-81705 CVSS 7.5jahlives | openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. … |
| CVE-2026-81704 | CVE-2026-81704 CVSS 7.5jahlives | openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 … |
| CVE-2026-81703 | CVE-2026-81703 CVSS 5.5jahlives | openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with… |
| CVE-2026-81702 | CVE-2026-81702 CVSS 9.8jahlives | openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public k… |
| CVE-2026-81701 | CVE-2026-81701 CVSS 9.8jahlives | openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unkn… |
| CVE-2026-81700 | CVE-2026-81700 CVSS 9.8jahlives | openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by onl… |
| CVE-2026-8170 | CVE-2026-8170 | The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of… |
| CVE-2026-81699 | CVE-2026-81699 CVSS 7.5jahlives | openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory … |
| CVE-2026-81698 | CVE-2026-81698 CVSS 7.5jahlives | openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadat… |
| CVE-2026-81697 | CVE-2026-81697 CVSS 5.5 | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FI… |
| CVE-2026-81696 | CVE-2026-81696 CVSS 3.3jahlives | openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious … |
| CVE-2026-81695 | CVE-2026-81695 CVSS 3.3jahlives | openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft enc… |
| CVE-2026-81694 | CVE-2026-81694 CVSS 3.3jahlives | openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before… |
| CVE-2026-81693 | CVE-2026-81693 CVSS 7.5jahlives | openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with e… |
| CVE-2026-81692 | CVE-2026-81692 CVSS 7.5 | openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to s… |
| CVE-2026-81691 | CVE-2026-81691 CVSS 7.5jahlives | openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigu… |
| CVE-2026-81690 | CVE-2026-81690 CVSS 7.3jahlives | openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with… |