112,666 indexed

CVECVE vulnerabilities

112,666 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.

Showing 13,301–13,350 of 112,666 · page 267 of 2254

IDTitleSummary
CVE-2026-81338CVE-2026-81338
CVSS 4.6
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it a…
CVE-2026-81335CVE-2026-81335
CVSS 7.5
Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/b…
CVE-2026-81334CVE-2026-81334
CVSS 6.1
darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-…
CVE-2026-81330CVE-2026-81330
CVSS 6.5
The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, a…
CVE-2026-81326CVE-2026-81326
CVSS 5.5
QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to …
CVE-2026-81322CVE-2026-81322Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash r…
CVE-2026-81321CVE-2026-81321
CVSS 9.8
CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through ph…
CVE-2026-81320CVE-2026-81320
CVSS 5.5
A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object…
CVE-2026-81319CVE-2026-81319Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEA…
CVE-2026-81318CVE-2026-81318Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed fro…
CVE-2026-81316CVE-2026-81316Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should …
CVE-2026-81315CVE-2026-81315Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-sit…
CVE-2026-81310CVE-2026-81310
CVSS 6.6
Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwri…
CVE-2026-81305CVE-2026-81305
CVSS 6.8
CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An attacker with physical …
CVE-2026-81303CVE-2026-81303
CVSS 6.3
A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName val…
CVE-2026-81302CVE-2026-81302
CVSS 7.8
PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privilege…
CVE-2026-81301CVE-2026-81301Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The …
CVE-2026-81300CVE-2026-81300
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.
CVE-2026-81299CVE-2026-81299
CVSS 4.3
Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.
CVE-2026-81298CVE-2026-81298
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
CVE-2026-81297CVE-2026-81297
CVSS 7.5
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
CVE-2026-81296CVE-2026-81296
CVSS 7.5
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
CVE-2026-81295CVE-2026-81295
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.
CVE-2026-81294CVE-2026-81294
CVSS 9.8
Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.
CVE-2026-81293CVE-2026-81293
CVSS 9.3
Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.
CVE-2026-81292CVE-2026-81292
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.
CVE-2026-81291CVE-2026-81291
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.
CVE-2026-81290CVE-2026-81290
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
CVE-2026-81289CVE-2026-81289
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions.
CVE-2026-81288CVE-2026-81288
CVSS 7.1
Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.
CVE-2026-81287CVE-2026-81287
CVSS 8.5
Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.
CVE-2026-81286CVE-2026-81286
CVSS 9.3
Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.
CVE-2026-81285CVE-2026-81285
CVSS 7.5
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.
CVE-2026-81284CVE-2026-81284
CVSS 4.3
Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.
CVE-2026-81283CVE-2026-81283
CVSS 8.8
Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.
CVE-2026-81282CVE-2026-81282
CVSS 6.5
Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.
CVE-2026-81281CVE-2026-81281
CVSS 6.5
Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions.
CVE-2026-81280CVE-2026-81280
CVSS 6.5
Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.
CVE-2026-81279CVE-2026-81279
CVSS 5.4
Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
CVE-2026-81278CVE-2026-81278
CVSS 5.4
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SM…
CVE-2026-81277CVE-2026-81277
CVSS 8.5
Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.
CVE-2026-81276CVE-2026-81276
CVSS 5.3
Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.
CVE-2026-81275CVE-2026-81275
CVSS 6.5
Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.
CVE-2026-81274CVE-2026-81274
CVSS 5.3
Subscriber Broken Access Control in Ditty <= 3.1.67 versions.
CVE-2026-81273CVE-2026-81273
CVSS 8.1
Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.
CVE-2026-81272CVE-2026-81272
CVSS 4.9
Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.
CVE-2026-81271CVE-2026-81271
CVSS 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.
CVE-2026-81270CVE-2026-81270
CVSS 7.5
Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to versi…
CVE-2026-81269CVE-2026-81269
CVSS 5.3data_field_project
Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.
CVE-2026-81268CVE-2026-81268
CVSS 8.1langflow
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session…
Sourced from NVD + CISA KEV + FIRST EPSS. Curated by Adam Lundqvist, Founder at SQUR.