110,684 indexed
CVECVE vulnerabilities
110,684 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 12,501–12,550 of 110,684 · page 251 of 2214
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81568 | CVE-2026-81568 | Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - `J2StoreModelOrderdownloads::ge… |
| CVE-2026-81567 | CVE-2026-81567 | Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unau… |
| CVE-2026-81566 | CVE-2026-81566 | Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The add-to-menu routine invo… |
| CVE-2026-81565 | CVE-2026-81565 | Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The folder request paramete… |
| CVE-2026-81564 | CVE-2026-81564 | Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.… |
| CVE-2026-81563 | CVE-2026-81563 CVSS 7.5 | A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal reso… |
| CVE-2026-81562 | CVE-2026-81562 CVSS 5.3 | A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a mani… |
| CVE-2026-81560 | CVE-2026-81560 CVSS 5.3 | A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the compon… |
| CVE-2026-81554 | CVE-2026-81554 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulne… |
| CVE-2026-81552 | CVE-2026-81552 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environ… |
| CVE-2026-81551 | CVE-2026-81551 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path… |
| CVE-2026-81550 | CVE-2026-81550 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special ele… |
| CVE-2026-8155 | CVE-2026-8155 CVSS 5.4 | The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subs… |
| CVE-2026-81549 | CVE-2026-81549 CVSS 9.6ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-For… |
| CVE-2026-81548 | CVE-2026-81548 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special… |
| CVE-2026-81547 | CVE-2026-81547 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal. |
| CVE-2026-81546 | CVE-2026-81546 CVSS 7.7 | The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity document files leading t… |
| CVE-2026-81545 | CVE-2026-81545 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special… |
| CVE-2026-81543 | CVE-2026-81543 CVSS 8.8 | The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to … |
| CVE-2026-81540 | CVE-2026-81540 CVSS 8.5ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path tra… |
| CVE-2026-81539 | CVE-2026-81539 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special ele… |
| CVE-2026-81537 | CVE-2026-81537 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection. |
| CVE-2026-81536 | CVE-2026-81536 CVSS 7.7ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) inj… |
| CVE-2026-81535 | CVE-2026-81535 CVSS 9.1wolfssh | In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. … |
| CVE-2026-81534 | CVE-2026-81534 CVSS 8.8 | The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to … |
| CVE-2026-81533 | CVE-2026-81533 CVSS 7.1mongodb | An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of … |
| CVE-2026-81532 | CVE-2026-81532 CVSS 8.8mongodb | A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exce… |
| CVE-2026-81531 | CVE-2026-81531 | An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible aft… |
| CVE-2026-81530 | CVE-2026-81530 CVSS 5.6mongodb | A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the app… |
| CVE-2026-8153 | CVE-2026-8153 CVSS 9.8 | OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthenticated attacker to craft commands tha… |
| CVE-2026-81529 | CVE-2026-81529 CVSS 7.1mongodb | Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes un… |
| CVE-2026-81528 | CVE-2026-81528 CVSS 5.4mongodb | A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a repl… |
| CVE-2026-81527 | CVE-2026-81527 CVSS 6.5mongodb | A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and qu… |
| CVE-2026-81526 | CVE-2026-81526 CVSS 6.5mongodb | The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server… |
| CVE-2026-81525 | CVE-2026-81525 CVSS 8.1mongodb | The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct… |
| CVE-2026-81524 | CVE-2026-81524 CVSS 5.4mongodb | A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the dri… |
| CVE-2026-81523 | CVE-2026-81523 CVSS 4.4mongodb | A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted with… |
| CVE-2026-81522 | CVE-2026-81522 CVSS 8.1mongodb | A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An applicatio… |
| CVE-2026-81521 | CVE-2026-81521 CVSS 6.5mongodb | The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping… |
| CVE-2026-81520 | CVE-2026-81520 CVSS 7.5mongodb | A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-base… |
| CVE-2026-8152 | CVE-2026-8152 | Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with… |
| CVE-2026-81518 | CVE-2026-81518 CVSS 7.5mongodb | When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require… |
| CVE-2026-81517 | CVE-2026-81517 CVSS 7.5mongodb | An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhau… |
| CVE-2026-81516 | CVE-2026-81516 CVSS 7.5 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, ConsulDisc… |
| CVE-2026-81515 | CVE-2026-81515 CVSS 7.5 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, EurekaDisc… |
| CVE-2026-8151 | CVE-2026-8151 CVSS 5.4 | The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-… |
| CVE-2026-81508 | CVE-2026-81508 CVSS 4.3 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_me… |
| CVE-2026-81507 | CVE-2026-81507 CVSS 6.5 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuratio… |
| CVE-2026-81505 | CVE-2026-81505 | Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the proj… |
| CVE-2026-81491 | CVE-2026-81491 CVSS 7.3 | A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_notes/teleport_notes/sync_notes/project_folder of the file … |