110,684 indexed
CVECVE vulnerabilities
110,684 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 12,451–12,500 of 110,684 · page 250 of 2214
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81664 | CVE-2026-81664 CVSS 5.3 | The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.De… |
| CVE-2026-81662 | CVE-2026-81662 | Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized … |
| CVE-2026-81660 | CVE-2026-81660 CVSS 8.8 | The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web fo… |
| CVE-2026-8166 | CVE-2026-8166 CVSS 5.4 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing P… |
| CVE-2026-81659 | CVE-2026-81659 | Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local fil… |
| CVE-2026-81658 | CVE-2026-81658 CVSS 6.5redhat | A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authen… |
| CVE-2026-81657 | CVE-2026-81657 CVSS 9.8ibm | IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted… |
| CVE-2026-81656 | CVE-2026-81656 CVSS 8.8ibm | IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user c… |
| CVE-2026-81655 | CVE-2026-81655 CVSS 7.5 | The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user un… |
| CVE-2026-81654 | CVE-2026-81654 CVSS 3.1 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing set… |
| CVE-2026-81653 | CVE-2026-81653 CVSS 4.2 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allow… |
| CVE-2026-81652 | CVE-2026-81652 CVSS 2.7 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before re… |
| CVE-2026-81651 | CVE-2026-81651 CVSS 3.1 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its … |
| CVE-2026-81650 | CVE-2026-81650 CVSS 7.2 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive… |
| CVE-2026-81649 | CVE-2026-81649 CVSS 9.1 | The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credentia… |
| CVE-2026-81648 | CVE-2026-81648 CVSS 10.0 | The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated use… |
| CVE-2026-81647 | CVE-2026-81647 CVSS 5.3 | Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-81646 | CVE-2026-81646 CVSS 5.9 | Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-81645 | CVE-2026-81645 CVSS 5.9 | Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-81644 | CVE-2026-81644 CVSS 4.3 | DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-81643 | CVE-2026-81643 | Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In … |
| CVE-2026-81642 | CVE-2026-81642 CVSS 9.8nlnetlabs | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code exe… |
| CVE-2026-81640 | CVE-2026-81640 CVSS 8.8 | An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point pas… |
| CVE-2026-8164 | CVE-2026-8164 CVSS 7.3 | Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijackin… |
| CVE-2026-81638 | CVE-2026-81638 | Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the sam… |
| CVE-2026-81637 | CVE-2026-81637 | Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the call… |
| CVE-2026-81636 | CVE-2026-81636 | Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass the configured GraphQL… |
| CVE-2026-81635 | CVE-2026-81635 CVSS 5.4 | A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses … |
| CVE-2026-81634 | CVE-2026-81634 CVSS 7.5nlnetlabs | In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonic… |
| CVE-2026-81633 | CVE-2026-81633 | Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay node(id: ...) query with an unhandled KeyE… |
| CVE-2026-81632 | CVE-2026-81632 | Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or b… |
| CVE-2026-81630 | CVE-2026-81630 CVSS 8.1 | The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmware through an unprot… |
| CVE-2026-8163 | CVE-2026-8163 CVSS 8.8 | The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL… |
| CVE-2026-81627 | CVE-2026-81627 CVSS 8.2 | A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A pr… |
| CVE-2026-81626 | CVE-2026-81626 CVSS 8.6ibm | IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL … |
| CVE-2026-81625 | CVE-2026-81625 CVSS 8.8 | A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a stack buffer overf… |
| CVE-2026-81624 | CVE-2026-81624 CVSS 7.5 | Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certa… |
| CVE-2026-81623 | CVE-2026-81623 CVSS 6.3ibm | IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system due to improper valida… |
| CVE-2026-81583 | CVE-2026-81583 CVSS 5.4 | The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowi… |
| CVE-2026-81581 | CVE-2026-81581 CVSS 8.8 | Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the… |
| CVE-2026-8158 | CVE-2026-8158 CVSS 5.3 | The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to crash. The issue exclusively affects th… |
| CVE-2026-81579 | CVE-2026-81579 CVSS 8.8 | In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to expl… |
| CVE-2026-81578 | PaperCut NG/MF Missing Authentication for Critical Function Vulnerability KEVCVSS 9.8PaperCut | PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system c… |
| CVE-2026-81576 | CVE-2026-81576 CVSS 7.7 | If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole au… |
| CVE-2026-81575 | CVE-2026-81575 CVSS 7.5 | If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itsel… |
| CVE-2026-81574 | CVE-2026-81574 CVSS 8.2 | In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style f… |
| CVE-2026-81573 | CVE-2026-81573 CVSS 8.6 | If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands … |
| CVE-2026-81572 | CVE-2026-81572 CVSS 7.8 | In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file un… |
| CVE-2026-81571 | CVE-2026-81571 CVSS 4.8 | The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allow… |
| CVE-2026-81569 | CVE-2026-81569 CVSS 4.3 | An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target pro… |