106,194 indexed
CVECVE vulnerabilities
106,194 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 11,901–11,950 of 106,194 · page 239 of 2124
| ID | Title | Summary |
|---|---|---|
| CVE-2026-8169 | CVE-2026-8169 | ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insu… |
| CVE-2026-81689 | CVE-2026-81689 CVSS 7.5jahlives | openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys acr… |
| CVE-2026-81688 | CVE-2026-81688 CVSS 7.5jahlives | openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash withou… |
| CVE-2026-81687 | CVE-2026-81687 CVSS 5.5 | openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craf… |
| CVE-2026-81686 | CVE-2026-81686 CVSS 6.2jahlives | openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authori… |
| CVE-2026-81685 | CVE-2026-81685 CVSS 3.3jahlives | openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line sepa… |
| CVE-2026-81684 | CVE-2026-81684 CVSS 6.2jahlives | In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command l… |
| CVE-2026-81683 | CVE-2026-81683 CVSS 8.4jahlives | openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPre… |
| CVE-2026-81682 | CVE-2026-81682 CVSS 6.2 | openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable… |
| CVE-2026-81681 | CVE-2026-81681 CVSS 4.6jahlives | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption … |
| CVE-2026-81680 | CVE-2026-81680 CVSS 4.0jahlives | openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slo… |
| CVE-2026-81679 | CVE-2026-81679 CVSS 7.7 | OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administ… |
| CVE-2026-81678 | CVE-2026-81678 CVSS 7.5 | AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64,… |
| CVE-2026-81677 | CVE-2026-81677 | The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL sy… |
| CVE-2026-81676 | CVE-2026-81676 | A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without pro… |
| CVE-2026-81675 | CVE-2026-81675 | The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in … |
| CVE-2026-81674 | CVE-2026-81674 | The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a Mar… |
| CVE-2026-81673 | CVE-2026-81673 | The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sani… |
| CVE-2026-81672 | CVE-2026-81672 | SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanit… |
| CVE-2026-8167 | CVE-2026-8167 CVSS 6.1 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solutions News Theme V8 allows Reflected XS… |
| CVE-2026-81669 | CVE-2026-81669 CVSS 7.2ibm | IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the create csr wildcard CLI command. An authenticated privileged CLI us… |
| CVE-2026-81668 | CVE-2026-81668 CVSS 5.4 | A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated… |
| CVE-2026-81666 | CVE-2026-81666 CVSS 6.5 | An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-… |
| CVE-2026-81665 | CVE-2026-81665 CVSS 7.5 | A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffe… |
| CVE-2026-81664 | CVE-2026-81664 CVSS 5.3 | The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.De… |
| CVE-2026-81662 | CVE-2026-81662 | Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized … |
| CVE-2026-81660 | CVE-2026-81660 CVSS 8.8 | The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web fo… |
| CVE-2026-8166 | CVE-2026-8166 CVSS 5.4 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing P… |
| CVE-2026-81659 | CVE-2026-81659 | Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local fil… |
| CVE-2026-81658 | CVE-2026-81658 CVSS 6.5redhat | A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authen… |
| CVE-2026-81657 | CVE-2026-81657 CVSS 9.8ibm | IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted… |
| CVE-2026-81656 | CVE-2026-81656 CVSS 8.8ibm | IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user c… |
| CVE-2026-81655 | CVE-2026-81655 CVSS 7.5 | The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user un… |
| CVE-2026-81654 | CVE-2026-81654 CVSS 3.1 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing set… |
| CVE-2026-81653 | CVE-2026-81653 CVSS 4.2 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allow… |
| CVE-2026-81652 | CVE-2026-81652 CVSS 2.7 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before re… |
| CVE-2026-81651 | CVE-2026-81651 CVSS 3.1 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its … |
| CVE-2026-81650 | CVE-2026-81650 CVSS 7.2 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive… |
| CVE-2026-81649 | CVE-2026-81649 CVSS 9.1 | The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credentia… |
| CVE-2026-81648 | CVE-2026-81648 CVSS 10.0 | The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated use… |
| CVE-2026-81647 | CVE-2026-81647 CVSS 5.3 | Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-81646 | CVE-2026-81646 CVSS 5.9 | Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-81645 | CVE-2026-81645 CVSS 5.9 | Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-81644 | CVE-2026-81644 CVSS 4.3 | DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-81643 | CVE-2026-81643 | Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In … |
| CVE-2026-81642 | CVE-2026-81642 CVSS 9.8nlnetlabs | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code exe… |
| CVE-2026-81640 | CVE-2026-81640 CVSS 8.8 | An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point pas… |
| CVE-2026-8164 | CVE-2026-8164 CVSS 7.3 | Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijackin… |
| CVE-2026-81638 | CVE-2026-81638 | Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the sam… |
| CVE-2026-81637 | CVE-2026-81637 | Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the call… |