110,684 indexed

CVECVE vulnerabilities

110,684 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.

Showing 12,651–12,700 of 110,684 · page 254 of 2214

IDTitleSummary
CVE-2026-81318CVE-2026-81318Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed fro…
CVE-2026-81316CVE-2026-81316Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should …
CVE-2026-81315CVE-2026-81315Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-sit…
CVE-2026-81310CVE-2026-81310
CVSS 6.6
Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwri…
CVE-2026-81305CVE-2026-81305
CVSS 6.8
CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An attacker with physical …
CVE-2026-81303CVE-2026-81303
CVSS 6.3
A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName val…
CVE-2026-81302CVE-2026-81302
CVSS 7.8
PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privilege…
CVE-2026-81301CVE-2026-81301Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The …
CVE-2026-81300CVE-2026-81300
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.
CVE-2026-81299CVE-2026-81299
CVSS 4.3
Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.
CVE-2026-81298CVE-2026-81298
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
CVE-2026-81297CVE-2026-81297
CVSS 7.5
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
CVE-2026-81296CVE-2026-81296
CVSS 7.5
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
CVE-2026-81295CVE-2026-81295
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.
CVE-2026-81294CVE-2026-81294
CVSS 9.8
Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.
CVE-2026-81293CVE-2026-81293
CVSS 9.3
Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.
CVE-2026-81292CVE-2026-81292
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.
CVE-2026-81291CVE-2026-81291
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.
CVE-2026-81290CVE-2026-81290
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
CVE-2026-81289CVE-2026-81289
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions.
CVE-2026-81288CVE-2026-81288
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.
CVE-2026-81287CVE-2026-81287
CVSS 8.5
Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.
CVE-2026-81286CVE-2026-81286
CVSS 9.3
Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.
CVE-2026-81285CVE-2026-81285
CVSS 7.5
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.
CVE-2026-81284CVE-2026-81284
CVSS 4.3
Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.
CVE-2026-81283CVE-2026-81283
CVSS 8.8
Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.
CVE-2026-81282CVE-2026-81282
CVSS 6.5
Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.
CVE-2026-81281CVE-2026-81281
CVSS 6.5
Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions.
CVE-2026-81280CVE-2026-81280
CVSS 6.5
Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.
CVE-2026-81279CVE-2026-81279
CVSS 5.4
Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
CVE-2026-81278CVE-2026-81278
CVSS 5.4
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SM…
CVE-2026-81277CVE-2026-81277
CVSS 8.5
Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.
CVE-2026-81276CVE-2026-81276
CVSS 5.3
Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.
CVE-2026-81275CVE-2026-81275
CVSS 6.5
Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.
CVE-2026-81274CVE-2026-81274
CVSS 5.3
Subscriber Broken Access Control in Ditty <= 3.1.67 versions.
CVE-2026-81273CVE-2026-81273
CVSS 8.1
Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.
CVE-2026-81272CVE-2026-81272
CVSS 4.9
Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.
CVE-2026-81271CVE-2026-81271
CVSS 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.
CVE-2026-81270CVE-2026-81270
CVSS 7.5
Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to versi…
CVE-2026-81269CVE-2026-81269
CVSS 5.3data_field_project
Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.
CVE-2026-81268CVE-2026-81268
CVSS 8.1langflow
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session…
CVE-2026-81267CVE-2026-81267
CVSS 5.4mozilla
A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to r…
CVE-2026-81265CVE-2026-81265
CVSS 7.5langflow
IBM Langflow OSS 1.0.0 through 1.11.5.
CVE-2026-81240CVE-2026-81240
CVSS 8.6dell
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attack…
CVE-2026-81239CVE-2026-81239
CVSS 8.6dell
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attack…
CVE-2026-81238CVE-2026-81238
CVSS 7.5dell
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker w…
CVE-2026-81237CVE-2026-81237
CVSS 6.5dell
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access co…
CVE-2026-81236CVE-2026-81236
CVSS 8.6dell
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attack…
CVE-2026-81235CVE-2026-81235
CVSS 8.0dell
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cryptographic Step vulnerability. A high privileged attacker with remote access c…
CVE-2026-81213CVE-2026-81213
CVSS 8.6langflow
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation …
Sourced from NVD + CISA KEV + FIRST EPSS. Curated by Adam Lundqvist, Founder at SQUR.