110,684 indexed
CVECVE vulnerabilities
110,684 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 12,701–12,750 of 110,684 · page 255 of 2214
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81211 | CVE-2026-81211 CVSS 8.8langflow | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom comp… |
| CVE-2026-81210 | CVE-2026-81210 CVSS 7.7ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns … |
| CVE-2026-81208 | CVE-2026-81208 CVSS 7.7ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials… |
| CVE-2026-81207 | CVE-2026-81207 CVSS 8.5ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant — with no project membership or role — fully controls scheme/host/port/path of an o… |
| CVE-2026-81205 | CVE-2026-81205 CVSS 5.3miniorange | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP In… |
| CVE-2026-81204 | CVE-2026-81204 CVSS 9.8langflow | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction. |
| CVE-2026-81203 | CVE-2026-81203 CVSS 7.3 | A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=lo… |
| CVE-2026-81202 | CVE-2026-81202 CVSS 7.3 | A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component … |
| CVE-2026-81201 | CVE-2026-81201 CVSS 6.1monster_menus_project | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affect… |
| CVE-2026-81200 | CVE-2026-81200 CVSS 2.7 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instru… |
| CVE-2026-81199 | CVE-2026-81199 CVSS 5.3 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, … |
| CVE-2026-81198 | CVE-2026-81198 CVSS 3.8 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing au… |
| CVE-2026-81197 | CVE-2026-81197 CVSS 5.3 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filte… |
| CVE-2026-81196 | CVE-2026-81196 CVSS 2.7 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instr… |
| CVE-2026-81195 | CVE-2026-81195 CVSS 5.3 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and… |
| CVE-2026-81194 | CVE-2026-81194 CVSS 4.3 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any … |
| CVE-2026-81192 | CVE-2026-81192 CVSS 7.0 | `OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability o… |
| CVE-2026-81182 | CVE-2026-81182 CVSS 4.2 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can d… |
| CVE-2026-81181 | CVE-2026-81181 CVSS 3.7 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the… |
| CVE-2026-81180 | CVE-2026-81180 CVSS 8.8 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose form… |
| CVE-2026-8118 | CVE-2026-8118 CVSS 6.5 | The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through … |
| CVE-2026-81179 | CVE-2026-81179 CVSS 8.1 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOS… |
| CVE-2026-81178 | CVE-2026-81178 CVSS 3.5 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide col… |
| CVE-2026-81176 | CVE-2026-81176 CVSS 5.3 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does… |
| CVE-2026-81168 | CVE-2026-81168 CVSS 3.7captcha_protected_page_project | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA… |
| CVE-2026-81167 | CVE-2026-81167 CVSS 4.8address_suggestion_project | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XS… |
| CVE-2026-81166 | CVE-2026-81166 CVSS 5.3lakedrops | Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0… |
| CVE-2026-81165 | CVE-2026-81165 CVSS 5.3blazy_project | Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18. |
| CVE-2026-81164 | CVE-2026-81164 CVSS 5.4entity_pdf_project | Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5. |
| CVE-2026-81162 | CVE-2026-81162 CVSS 5.3dxpr_builder_project | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. T… |
| CVE-2026-81161 | CVE-2026-81161 CVSS 3.3content_moderation_notifications_project | Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderati… |
| CVE-2026-81160 | CVE-2026-81160 CVSS 6.1slick_carousel_project | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affec… |
| CVE-2026-81159 | CVE-2026-81159 CVSS 3.7centarro | Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to … |
| CVE-2026-81158 | CVE-2026-81158 CVSS 5.3entity_api_project | Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0. |
| CVE-2026-81156 | CVE-2026-81156 CVSS 6.8 | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, al… |
| CVE-2026-81155 | CVE-2026-81155 CVSS 6.8 | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the… |
| CVE-2026-81154 | CVE-2026-81154 CVSS 6.8 | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users … |
| CVE-2026-81153 | CVE-2026-81153 CVSS 6.8 | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing user… |
| CVE-2026-8111 | CVE-2026-8111 CVSS 8.8 | SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution. |
| CVE-2026-81102 | CVE-2026-81102 CVSS 3.1 | The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_server_dash.py constructed the server for it… |
| CVE-2026-81101 | CVE-2026-81101 CVSS 6.5 | The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given … |
| CVE-2026-81100 | CVE-2026-81100 CVSS 6.8 | tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpSe… |
| CVE-2026-81099 | CVE-2026-81099 CVSS 6.8 | tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServer… |
| CVE-2026-81098 | CVE-2026-81098 CVSS 9.1 | The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the … |
| CVE-2026-81097 | CVE-2026-81097 CVSS 8.4 | The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning metho… |
| CVE-2026-81096 | CVE-2026-81096 CVSS 10.0 | ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_cod… |
| CVE-2026-81095 | CVE-2026-81095 CVSS 6.8 | pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFacto… |
| CVE-2026-81094 | CVE-2026-81094 CVSS 9.1 | The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/… |
| CVE-2026-81093 | CVE-2026-81093 CVSS 8.6 | The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the… |
| CVE-2026-81092 | CVE-2026-81092 CVSS 6.8 | mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamable_http.go and SSEServer.Ser… |