112,666 indexed
CVECVE vulnerabilities
112,666 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 13,251–13,300 of 112,666 · page 266 of 2254
| ID | Title | Summary |
|---|---|---|
| CVE-2026-8141 | CVE-2026-8141 CVSS 7.2 | The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'taxonomy_include_children' parameter in all versions up… |
| CVE-2026-81404 | CVE-2026-81404 CVSS 7.1 | The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenti… |
| CVE-2026-81402 | CVE-2026-81402 CVSS 9.8 | The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, … |
| CVE-2026-81401 | CVE-2026-81401 CVSS 5.5microsoft | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81400 | CVE-2026-81400 CVSS 5.5microsoft | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-8140 | CVE-2026-8140 CVSS 6.5concretecms | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/<remoteId>. The download() method … |
| CVE-2026-81399 | CVE-2026-81399 CVSS 5.5microsoft | Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81398 | CVE-2026-81398 CVSS 7.8microsoft | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81397 | CVE-2026-81397 CVSS 7.8microsoft | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81396 | CVE-2026-81396 CVSS 7.8microsoft | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81395 | CVE-2026-81395 CVSS 5.5microsoft | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81394 | CVE-2026-81394 CVSS 5.5microsoft | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information lo… |
| CVE-2026-81393 | CVE-2026-81393 CVSS 5.5microsoft | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81392 | CVE-2026-81392 CVSS 5.5microsoft | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81391 | CVE-2026-81391 CVSS 5.5microsoft | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81390 | CVE-2026-81390 CVSS 5.5microsoft | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-8139 | CVE-2026-8139 CVSS 5.4concretecms | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized. The Conc… |
| CVE-2026-81389 | CVE-2026-81389 CVSS 7.0microsoft | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81388 | CVE-2026-81388 CVSS 7.8microsoft | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81387 | CVE-2026-81387 CVSS 5.5microsoft | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information lo… |
| CVE-2026-81386 | CVE-2026-81386 CVSS 7.8microsoft | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81385 | CVE-2026-81385 CVSS 8.8microsoft | Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. |
| CVE-2026-81383 | CVE-2026-81383 CVSS 7.4microsoft | Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-81381 | CVE-2026-81381 CVSS 6.5microsoft | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-81380 | CVE-2026-81380 CVSS 5.3microsoft | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to… |
| CVE-2026-8138 | CVE-2026-8138 CVSS 8.8 | A vulnerability was found in Tenda CX12L 16.03.53.12. This issue affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg”. The manipulation… |
| CVE-2026-81379 | CVE-2026-81379 CVSS 8.2microsoft | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81378 | CVE-2026-81378 CVSS 8.2microsoft | Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81377 | CVE-2026-81377 CVSS 6.5microsoft | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over … |
| CVE-2026-81376 | CVE-2026-81376 CVSS 9.6microsoft | Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81375 | CVE-2026-81375 | A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows… |
| CVE-2026-8137 | CVE-2026-8137 CVSS 8.8 | A vulnerability has been found in Totolink X5000R 9.1.0u.6369_B20230113. This vulnerability affects the function sub_458E40 of the file /boafrm/formDdns. The m… |
| CVE-2026-81357 | CVE-2026-81357 CVSS 8.2microsoft | Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81356 | CVE-2026-81356 CVSS 8.2microsoft | Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security fea… |
| CVE-2026-81355 | CVE-2026-81355 CVSS 7.5microsoft | Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to execute code locally. |
| CVE-2026-81354 | CVE-2026-81354 CVSS 8.2microsoft | Heap-based buffer overflow in Windows Hello allows an authorized attacker to elevate privileges locally. |
| CVE-2026-81353 | CVE-2026-81353 CVSS 7.8microsoft | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally. |
| CVE-2026-81352 | CVE-2026-81352 CVSS 8.8microsoft | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. |
| CVE-2026-8135 | CVE-2026-8135 CVSS 7.2concretecms | Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller. An rog… |
| CVE-2026-81349 | CVE-2026-81349 CVSS 7.2microsoft | Improper neutralization of special elements used in an os command ('os command injection') in Azure HDInsights allows an authorized attacker to elevate privile… |
| CVE-2026-81348 | CVE-2026-81348 CVSS 3.7 | The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing … |
| CVE-2026-81347 | CVE-2026-81347 CVSS 5.9 | The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it,… |
| CVE-2026-81346 | CVE-2026-81346 CVSS 4.3 | The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated use… |
| CVE-2026-81344 | CVE-2026-81344 CVSS 6.6 | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post … |
| CVE-2026-81343 | CVE-2026-81343 CVSS 5.3 | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing … |
| CVE-2026-81342 | CVE-2026-81342 CVSS 4.7 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, … |
| CVE-2026-81341 | CVE-2026-81341 CVSS 6.5wolfssl | wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number car… |
| CVE-2026-81340 | CVE-2026-81340 CVSS 3.8 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through it… |
| CVE-2026-8134 | CVE-2026-8134 CVSS 7.2concretecms | Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type compose… |
| CVE-2026-81339 | CVE-2026-81339 CVSS 4.3 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowi… |