106,194 indexed
CVECVE vulnerabilities
106,194 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 12,051–12,100 of 106,194 · page 242 of 2124
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81441 | CVE-2026-81441 CVSS 4.0dell | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated att… |
| CVE-2026-81440 | CVE-2026-81440 CVSS 7.3dell | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remo… |
| CVE-2026-81439 | CVE-2026-81439 CVSS 3.7dell | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote acce… |
| CVE-2026-81438 | CVE-2026-81438 CVSS 3.7dell | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated a… |
| CVE-2026-81433 | CVE-2026-81433 | A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent n… |
| CVE-2026-81432 | CVE-2026-81432 CVSS 4.3 | The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-… |
| CVE-2026-81431 | CVE-2026-81431 CVSS 7.2 | The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration… |
| CVE-2026-81429 | CVE-2026-81429 CVSS 7.1 | The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise t… |
| CVE-2026-81428 | CVE-2026-81428 CVSS 6.5 | The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing auth… |
| CVE-2026-81427 | CVE-2026-81427 CVSS 4.3 | The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, … |
| CVE-2026-81426 | CVE-2026-81426 CVSS 4.3 | The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attacke… |
| CVE-2026-81424 | CVE-2026-81424 CVSS 5.3 | The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the author… |
| CVE-2026-81423 | CVE-2026-81423 CVSS 4.3 | The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attacker… |
| CVE-2026-81421 | CVE-2026-81421 CVSS 7.3 | A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component raw_sentry_api. The … |
| CVE-2026-81420 | CVE-2026-81420 CVSS 8.6 | The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX acti… |
| CVE-2026-8141 | CVE-2026-8141 CVSS 7.2 | The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'taxonomy_include_children' parameter in all versions up… |
| CVE-2026-81404 | CVE-2026-81404 CVSS 7.1 | The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenti… |
| CVE-2026-81402 | CVE-2026-81402 CVSS 9.8 | The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, … |
| CVE-2026-81401 | CVE-2026-81401 CVSS 5.5microsoft | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81400 | CVE-2026-81400 CVSS 5.5microsoft | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-8140 | CVE-2026-8140 CVSS 6.5concretecms | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/<remoteId>. The download() method … |
| CVE-2026-81399 | CVE-2026-81399 CVSS 5.5microsoft | Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81398 | CVE-2026-81398 CVSS 7.8microsoft | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81397 | CVE-2026-81397 CVSS 7.8microsoft | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81396 | CVE-2026-81396 CVSS 7.8microsoft | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81395 | CVE-2026-81395 CVSS 5.5microsoft | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81394 | CVE-2026-81394 CVSS 5.5microsoft | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information lo… |
| CVE-2026-81393 | CVE-2026-81393 CVSS 5.5microsoft | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81392 | CVE-2026-81392 CVSS 5.5microsoft | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81391 | CVE-2026-81391 CVSS 5.5microsoft | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81390 | CVE-2026-81390 CVSS 5.5microsoft | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-8139 | CVE-2026-8139 CVSS 5.4concretecms | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized. The Conc… |
| CVE-2026-81389 | CVE-2026-81389 CVSS 7.0microsoft | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81388 | CVE-2026-81388 CVSS 7.8microsoft | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81387 | CVE-2026-81387 CVSS 5.5microsoft | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information lo… |
| CVE-2026-81386 | CVE-2026-81386 CVSS 7.8microsoft | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81385 | CVE-2026-81385 CVSS 8.8microsoft | Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. |
| CVE-2026-81383 | CVE-2026-81383 CVSS 7.4microsoft | Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-81381 | CVE-2026-81381 CVSS 6.5microsoft | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-81380 | CVE-2026-81380 CVSS 5.3microsoft | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to… |
| CVE-2026-8138 | CVE-2026-8138 CVSS 8.8 | A vulnerability was found in Tenda CX12L 16.03.53.12. This issue affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg”. The manipulation… |
| CVE-2026-81379 | CVE-2026-81379 CVSS 8.2microsoft | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81378 | CVE-2026-81378 CVSS 8.2microsoft | Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81377 | CVE-2026-81377 CVSS 6.5microsoft | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over … |
| CVE-2026-81376 | CVE-2026-81376 CVSS 9.6microsoft | Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81375 | CVE-2026-81375 | A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows… |
| CVE-2026-8137 | CVE-2026-8137 CVSS 8.8 | A vulnerability has been found in Totolink X5000R 9.1.0u.6369_B20230113. This vulnerability affects the function sub_458E40 of the file /boafrm/formDdns. The m… |
| CVE-2026-81357 | CVE-2026-81357 CVSS 8.2microsoft | Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81356 | CVE-2026-81356 CVSS 8.2microsoft | Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security fea… |
| CVE-2026-81355 | CVE-2026-81355 CVSS 7.5microsoft | Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to execute code locally. |