112,666 indexed
CVECVE vulnerabilities
112,666 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 13,351–13,400 of 112,666 · page 268 of 2254
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81267 | CVE-2026-81267 CVSS 5.4mozilla | A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to r… |
| CVE-2026-81265 | CVE-2026-81265 CVSS 7.5langflow | IBM Langflow OSS 1.0.0 through 1.11.5. |
| CVE-2026-81240 | CVE-2026-81240 CVSS 8.6dell | Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attack… |
| CVE-2026-81239 | CVE-2026-81239 CVSS 8.6dell | Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attack… |
| CVE-2026-81238 | CVE-2026-81238 CVSS 7.5dell | Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker w… |
| CVE-2026-81237 | CVE-2026-81237 CVSS 6.5dell | Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access co… |
| CVE-2026-81236 | CVE-2026-81236 CVSS 8.6dell | Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attack… |
| CVE-2026-81235 | CVE-2026-81235 CVSS 8.0dell | Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cryptographic Step vulnerability. A high privileged attacker with remote access c… |
| CVE-2026-81213 | CVE-2026-81213 CVSS 8.6langflow | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation … |
| CVE-2026-81212 | CVE-2026-81212 CVSS 10.0 | IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collaps… |
| CVE-2026-81211 | CVE-2026-81211 CVSS 8.8langflow | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom comp… |
| CVE-2026-81210 | CVE-2026-81210 CVSS 7.7ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns … |
| CVE-2026-81208 | CVE-2026-81208 CVSS 7.7ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials… |
| CVE-2026-81207 | CVE-2026-81207 CVSS 8.5ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant — with no project membership or role — fully controls scheme/host/port/path of an o… |
| CVE-2026-81205 | CVE-2026-81205 CVSS 5.3miniorange | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP In… |
| CVE-2026-81204 | CVE-2026-81204 CVSS 9.8langflow | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction. |
| CVE-2026-81203 | CVE-2026-81203 CVSS 7.3 | A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=lo… |
| CVE-2026-81202 | CVE-2026-81202 CVSS 7.3 | A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component … |
| CVE-2026-81201 | CVE-2026-81201 CVSS 6.1monster_menus_project | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affect… |
| CVE-2026-81200 | CVE-2026-81200 CVSS 2.7 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instru… |
| CVE-2026-81199 | CVE-2026-81199 CVSS 5.3 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, … |
| CVE-2026-81198 | CVE-2026-81198 CVSS 3.8 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing au… |
| CVE-2026-81197 | CVE-2026-81197 CVSS 5.3 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filte… |
| CVE-2026-81196 | CVE-2026-81196 CVSS 2.7 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instr… |
| CVE-2026-81195 | CVE-2026-81195 CVSS 5.3 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and… |
| CVE-2026-81194 | CVE-2026-81194 CVSS 4.3 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any … |
| CVE-2026-81192 | CVE-2026-81192 CVSS 7.0 | `OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability o… |
| CVE-2026-81182 | CVE-2026-81182 CVSS 4.2 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can d… |
| CVE-2026-81181 | CVE-2026-81181 CVSS 3.7 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the… |
| CVE-2026-81180 | CVE-2026-81180 CVSS 8.8 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose form… |
| CVE-2026-8118 | CVE-2026-8118 CVSS 6.5 | The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through … |
| CVE-2026-81179 | CVE-2026-81179 CVSS 8.1 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOS… |
| CVE-2026-81178 | CVE-2026-81178 CVSS 3.5 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide col… |
| CVE-2026-81176 | CVE-2026-81176 CVSS 5.3 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does… |
| CVE-2026-81168 | CVE-2026-81168 CVSS 3.7captcha_protected_page_project | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA… |
| CVE-2026-81167 | CVE-2026-81167 CVSS 4.8address_suggestion_project | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XS… |
| CVE-2026-81166 | CVE-2026-81166 CVSS 5.3lakedrops | Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0… |
| CVE-2026-81165 | CVE-2026-81165 CVSS 5.3blazy_project | Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18. |
| CVE-2026-81164 | CVE-2026-81164 CVSS 5.4entity_pdf_project | Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5. |
| CVE-2026-81162 | CVE-2026-81162 CVSS 5.3dxpr_builder_project | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. T… |
| CVE-2026-81161 | CVE-2026-81161 CVSS 3.3content_moderation_notifications_project | Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderati… |
| CVE-2026-81160 | CVE-2026-81160 CVSS 6.1slick_carousel_project | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affec… |
| CVE-2026-81159 | CVE-2026-81159 CVSS 3.7centarro | Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to … |
| CVE-2026-81158 | CVE-2026-81158 CVSS 5.3entity_api_project | Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0. |
| CVE-2026-81156 | CVE-2026-81156 CVSS 6.8 | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, al… |
| CVE-2026-81155 | CVE-2026-81155 CVSS 6.8 | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the… |
| CVE-2026-81154 | CVE-2026-81154 CVSS 6.8 | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users … |
| CVE-2026-81153 | CVE-2026-81153 CVSS 6.8 | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing user… |
| CVE-2026-8111 | CVE-2026-8111 CVSS 8.8 | SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution. |
| CVE-2026-81102 | CVE-2026-81102 CVSS 3.1 | The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_server_dash.py constructed the server for it… |