110,684 indexed
CVECVE vulnerabilities
110,684 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 12,201–12,250 of 110,684 · page 245 of 2214
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81930 | CVE-2026-81930 CVSS 6.3apache | Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API en… |
| CVE-2026-8193 | CVE-2026-8193 CVSS 6.3 | A weakness has been identified in Akaunting 3.1.21. This issue affects some unknown processing of the file config/dompdf.php of the component Invoice PDF Rende… |
| CVE-2026-81929 | CVE-2026-81929 CVSS 7.2 | The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions… |
| CVE-2026-81928 | CVE-2026-81928 CVSS 7.5 | Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. si… |
| CVE-2026-81927 | CVE-2026-81927 CVSS 5.4concretecms | Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject fi… |
| CVE-2026-81926 | CVE-2026-81926 CVSS 6.1concretecms | Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The pane… |
| CVE-2026-81925 | CVE-2026-81925 CVSS 6.1concretecms | Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scr… |
| CVE-2026-81924 | CVE-2026-81924 CVSS 6.5concretecms | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard theme Inspect control… |
| CVE-2026-81923 | CVE-2026-81923 CVSS 2.7concretecms | In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the… |
| CVE-2026-81922 | CVE-2026-81922 CVSS 2.7concretecms | Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, t… |
| CVE-2026-81921 | CVE-2026-81921 CVSS 5.4concretecms | Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a va… |
| CVE-2026-81920 | CVE-2026-81920 CVSS 4.3concretecms | Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() controller action cleared the admin… |
| CVE-2026-8192 | CVE-2026-8192 CVSS 6.3wavlink | A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. This vulnerability affects the function wzdap of the file /cgi-bin/adm.cgi. Performing a … |
| CVE-2026-81919 | CVE-2026-81919 CVSS 4.3concretecms | Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Pag… |
| CVE-2026-81918 | CVE-2026-81918 CVSS 4.8concretecms | Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions … |
| CVE-2026-81917 | CVE-2026-81917 CVSS 5.4concretecms | Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with … |
| CVE-2026-81916 | CVE-2026-81916 CVSS 4.3concretecms | Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identi… |
| CVE-2026-81915 | CVE-2026-81915 CVSS 5.3concretecms | Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and… |
| CVE-2026-81914 | CVE-2026-81914 CVSS 4.3apache | Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, with… |
| CVE-2026-81913 | CVE-2026-81913 CVSS 6.1concretecms | Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain… |
| CVE-2026-81912 | CVE-2026-81912 CVSS 5.7concretecms | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endp… |
| CVE-2026-81911 | CVE-2026-81911 CVSS 5.4concretecms | Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template endpoint authorizes the request onl… |
| CVE-2026-81910 | CVE-2026-81910 CVSS 6.5concretecms | Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. Values submitted through … |
| CVE-2026-8191 | CVE-2026-8191 CVSS 6.3wavlink | A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This affects the function wifi_region of the file /cgi-bin/adm.cgi. Such manipulation of the a… |
| CVE-2026-81909 | CVE-2026-81909 | Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concrete/controllers/backend/block/process.ph… |
| CVE-2026-81908 | CVE-2026-81908 | Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Con… |
| CVE-2026-81907 | CVE-2026-81907 CVSS 7.1concretecms | Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST /index.php/dashboard/system/expre… |
| CVE-2026-81906 | CVE-2026-81906 | Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establishing a session. A d… |
| CVE-2026-81905 | CVE-2026-81905 | Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email/registration validation, password reset, and persistent login) in a single … |
| CVE-2026-81904 | CVE-2026-81904 | Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack, Container, or layout area without checking whether the requesting user could vi… |
| CVE-2026-81903 | CVE-2026-81903 CVSS 5.4concretecms | Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known contai… |
| CVE-2026-81902 | CVE-2026-81902 CVSS 8.1concretecms | Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote attacker could craft a r… |
| CVE-2026-81901 | CVE-2026-81901 CVSS 8.7concretecms | In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-typ… |
| CVE-2026-81900 | CVE-2026-81900 CVSS 6.1concretecms | Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escapi… |
| CVE-2026-8190 | CVE-2026-8190 CVSS 6.3wavlink | A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. Affected by this issue is the function wan of the file /cgi-bin/adm.cgi. This manipulation of … |
| CVE-2026-81899 | CVE-2026-81899 | Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page, resulting in stor… |
| CVE-2026-81898 | CVE-2026-81898 | In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association view… |
| CVE-2026-81897 | CVE-2026-81897 CVSS 5.4concretecms | In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller did not validate the anti-CSRF token. By causing an… |
| CVE-2026-81896 | CVE-2026-81896 CVSS 5.4concretecms | Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard… |
| CVE-2026-81895 | CVE-2026-81895 CVSS 7.2concretecms | In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID[] without validating them as integers, and when… |
| CVE-2026-81894 | CVE-2026-81894 CVSS 5.4concretecms | Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-image Caption field because the bundled M… |
| CVE-2026-81893 | CVE-2026-81893 CVSS 4.7 | A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can lea… |
| CVE-2026-81892 | CVE-2026-81892 CVSS 8.1 | EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a si… |
| CVE-2026-81891 | CVE-2026-81891 CVSS 8.1 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.… |
| CVE-2026-81890 | CVE-2026-81890 CVSS 5.4 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector… |
| CVE-2026-8189 | CVE-2026-8189 CVSS 6.3wavlink | A vulnerability was found in Wavlink NU516U1 M16U1_V240425. Affected by this vulnerability is the function wzdrepeater of the file /cgi-bin/adm.cgi. The manipu… |
| CVE-2026-81889 | CVE-2026-81889 CVSS 8.6 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can byp… |
| CVE-2026-81888 | CVE-2026-81888 CVSS 5.4 | @hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the… |
| CVE-2026-81887 | CVE-2026-81887 | Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, in… |
| CVE-2026-81886 | CVE-2026-81886 CVSS 5.5radare | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable … |