110,684 indexed
CVECVE vulnerabilities
110,684 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 12,351–12,400 of 110,684 · page 248 of 2214
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81774 | CVE-2026-81774 CVSS 7.5 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore WooCommerce Product Attachment woo-product-attachment allo… |
| CVE-2026-81773 | CVE-2026-81773 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions. |
| CVE-2026-81772 | CVE-2026-81772 CVSS 8.8 | Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions. |
| CVE-2026-81771 | CVE-2026-81771 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions. |
| CVE-2026-81770 | CVE-2026-81770 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions. |
| CVE-2026-8177 | CVE-2026-8177 CVSS 7.5 | XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node name… |
| CVE-2026-81769 | CVE-2026-81769 CVSS 8.8 | Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1. |
| CVE-2026-81768 | CVE-2026-81768 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions. |
| CVE-2026-81767 | CVE-2026-81767 CVSS 7.5 | Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions. |
| CVE-2026-81766 | CVE-2026-81766 CVSS 6.6 | The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.… |
| CVE-2026-81765 | CVE-2026-81765 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions. |
| CVE-2026-81764 | CVE-2026-81764 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions. |
| CVE-2026-81763 | CVE-2026-81763 CVSS 9.3 | Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions. |
| CVE-2026-81762 | CVE-2026-81762 CVSS 6.5 | Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions. |
| CVE-2026-81761 | CVE-2026-81761 CVSS 4.3 | Subscriber Broken Access Control in WpEvently <= 5.5.0 versions. |
| CVE-2026-81760 | CVE-2026-81760 CVSS 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue af… |
| CVE-2026-8176 | CVE-2026-8176 CVSS 7.5 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up … |
| CVE-2026-81759 | CVE-2026-81759 CVSS 5.4 | Contributor Broken Access Control in WpEvently <= 5.5.0 versions. |
| CVE-2026-81758 | CVE-2026-81758 CVSS 6.3 | Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions. |
| CVE-2026-81757 | CVE-2026-81757 CVSS 7.2 | Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions. |
| CVE-2026-81756 | CVE-2026-81756 CVSS 9.3 | Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions. |
| CVE-2026-81754 | CVE-2026-81754 CVSS 7.2 | The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Age… |
| CVE-2026-81753 | CVE-2026-81753 | Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Merma… |
| CVE-2026-8175 | CVE-2026-8175 CVSS 9.8ibm | IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera … |
| CVE-2026-81743 | CVE-2026-81743 | Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the in… |
| CVE-2026-81742 | CVE-2026-81742 CVSS 8.8 | The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted,… |
| CVE-2026-81741 | CVE-2026-81741 CVSS 4.7 | The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirm… |
| CVE-2026-81740 | CVE-2026-81740 CVSS 5.3 | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret ke… |
| CVE-2026-8174 | CVE-2026-8174 CVSS 5.7 | Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF). This issue affects Zoho Mail wordpress plugin versions before 1.6.2. |
| CVE-2026-81739 | CVE-2026-81739 CVSS 7.5 | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin pag… |
| CVE-2026-81738 | CVE-2026-81738 | OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries |
| CVE-2026-81737 | CVE-2026-81737 CVSS 8.8 | The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it… |
| CVE-2026-81736 | CVE-2026-81736 CVSS 7.5 | If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate C… |
| CVE-2026-81735 | CVE-2026-81735 CVSS 10.0 | startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpSe… |
| CVE-2026-81733 | CVE-2026-81733 | WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The… |
| CVE-2026-81732 | CVE-2026-81732 | WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to u… |
| CVE-2026-81731 | CVE-2026-81731 CVSS 5.4frappe | Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is … |
| CVE-2026-81730 | CVE-2026-81730 CVSS 8.2dolibarr | Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The… |
| CVE-2026-8173 | CVE-2026-8173 CVSS 5.3 | The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy… |
| CVE-2026-81729 | CVE-2026-81729 CVSS 6.5dolibarr | Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php call… |
| CVE-2026-81728 | CVE-2026-81728 CVSS 8.1dolibarr | Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdo… |
| CVE-2026-81727 | CVE-2026-81727 CVSS 7.1nltk | NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows a… |
| CVE-2026-81726 | CVE-2026-81726 CVSS 7.0nltk | NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-contr… |
| CVE-2026-81725 | CVE-2026-81725 CVSS 3.7nltk | NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption… |
| CVE-2026-81724 | CVE-2026-81724 CVSS 5.3nltk | NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial… |
| CVE-2026-81723 | CVE-2026-81723 CVSS 3.7 | NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on ev… |
| CVE-2026-81722 | CVE-2026-81722 CVSS 7.5nltk | nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_co… |
| CVE-2026-81721 | CVE-2026-81721 CVSS 7.5jahlives | openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded mem… |
| CVE-2026-81720 | CVE-2026-81720 CVSS 6.2jahlives | openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory cond… |
| CVE-2026-8172 | CVE-2026-8172 CVSS 7.1 | The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on valida… |