106,194 indexed
CVECVE vulnerabilities
106,194 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 11,951–12,000 of 106,194 · page 240 of 2124
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81636 | CVE-2026-81636 | Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass the configured GraphQL… |
| CVE-2026-81635 | CVE-2026-81635 CVSS 5.4 | A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses … |
| CVE-2026-81634 | CVE-2026-81634 CVSS 7.5nlnetlabs | In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonic… |
| CVE-2026-81633 | CVE-2026-81633 | Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay node(id: ...) query with an unhandled KeyE… |
| CVE-2026-81632 | CVE-2026-81632 | Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or b… |
| CVE-2026-81630 | CVE-2026-81630 CVSS 8.1 | The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmware through an unprot… |
| CVE-2026-8163 | CVE-2026-8163 CVSS 8.8 | The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL… |
| CVE-2026-81627 | CVE-2026-81627 CVSS 8.2 | A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A pr… |
| CVE-2026-81626 | CVE-2026-81626 CVSS 8.6ibm | IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL … |
| CVE-2026-81625 | CVE-2026-81625 CVSS 8.8 | A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a stack buffer overf… |
| CVE-2026-81624 | CVE-2026-81624 CVSS 7.5 | Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certa… |
| CVE-2026-81623 | CVE-2026-81623 CVSS 6.3ibm | IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system due to improper valida… |
| CVE-2026-81583 | CVE-2026-81583 CVSS 5.4 | The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowi… |
| CVE-2026-81581 | CVE-2026-81581 CVSS 8.8 | Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the… |
| CVE-2026-8158 | CVE-2026-8158 CVSS 5.3 | The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to crash. The issue exclusively affects th… |
| CVE-2026-81579 | CVE-2026-81579 CVSS 8.8 | In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to expl… |
| CVE-2026-81578 | PaperCut NG/MF Missing Authentication for Critical Function Vulnerability KEVCVSS 9.8PaperCut | PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system c… |
| CVE-2026-81576 | CVE-2026-81576 CVSS 7.7 | If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole au… |
| CVE-2026-81575 | CVE-2026-81575 CVSS 7.5 | If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itsel… |
| CVE-2026-81574 | CVE-2026-81574 CVSS 8.2 | In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style f… |
| CVE-2026-81573 | CVE-2026-81573 CVSS 8.6 | If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands … |
| CVE-2026-81572 | CVE-2026-81572 CVSS 7.8 | In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file un… |
| CVE-2026-81571 | CVE-2026-81571 CVSS 4.8 | The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allow… |
| CVE-2026-81569 | CVE-2026-81569 CVSS 4.3 | An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target pro… |
| CVE-2026-81568 | CVE-2026-81568 | Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - `J2StoreModelOrderdownloads::ge… |
| CVE-2026-81567 | CVE-2026-81567 | Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unau… |
| CVE-2026-81566 | CVE-2026-81566 | Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The add-to-menu routine invo… |
| CVE-2026-81565 | CVE-2026-81565 | Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The folder request paramete… |
| CVE-2026-81564 | CVE-2026-81564 | Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.… |
| CVE-2026-81563 | CVE-2026-81563 CVSS 7.5 | A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal reso… |
| CVE-2026-81562 | CVE-2026-81562 CVSS 5.3 | A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a mani… |
| CVE-2026-81560 | CVE-2026-81560 CVSS 5.3 | A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the compon… |
| CVE-2026-81554 | CVE-2026-81554 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulne… |
| CVE-2026-81552 | CVE-2026-81552 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environ… |
| CVE-2026-81551 | CVE-2026-81551 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path… |
| CVE-2026-81550 | CVE-2026-81550 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special ele… |
| CVE-2026-8155 | CVE-2026-8155 CVSS 5.4 | The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subs… |
| CVE-2026-81549 | CVE-2026-81549 CVSS 9.6ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-For… |
| CVE-2026-81548 | CVE-2026-81548 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special… |
| CVE-2026-81547 | CVE-2026-81547 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal. |
| CVE-2026-81546 | CVE-2026-81546 CVSS 7.7 | The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity document files leading t… |
| CVE-2026-81545 | CVE-2026-81545 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special… |
| CVE-2026-81543 | CVE-2026-81543 CVSS 8.8 | The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to … |
| CVE-2026-81540 | CVE-2026-81540 CVSS 8.5ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path tra… |
| CVE-2026-81539 | CVE-2026-81539 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special ele… |
| CVE-2026-81537 | CVE-2026-81537 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection. |
| CVE-2026-81536 | CVE-2026-81536 CVSS 7.7ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) inj… |
| CVE-2026-81535 | CVE-2026-81535 CVSS 9.1wolfssh | In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. … |
| CVE-2026-81534 | CVE-2026-81534 CVSS 8.8 | The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to … |
| CVE-2026-81533 | CVE-2026-81533 CVSS 7.1mongodb | An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of … |