112,666 indexed
CVECVE vulnerabilities
112,666 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 13,951–14,000 of 112,666 · page 280 of 2254
| ID | Title | Summary |
|---|---|---|
| CVE-2026-80527 | CVE-2026-80527 CVSS 7.5 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging __ceph_get_caps() with stale mds_wanted A reader can hang forever in __… |
| CVE-2026-80526 | CVE-2026-80526 CVSS 7.8 | In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562_volume_control_put() does not do… |
| CVE-2026-80525 | CVE-2026-80525 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup The ipc_config_d… |
| CVE-2026-80524 | CVE-2026-80524 | In the Linux kernel, the following vulnerability has been resolved: optee: ffa: Add NULL check in optee_ffa_lend_protmem Sashiko (locally) reports a possible… |
| CVE-2026-80523 | CVE-2026-80523 CVSS 7.1 | In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: k3: set hdma clock as critical HDMA clock is responsible for the internal … |
| CVE-2026-80522 | CVE-2026-80522 CVSS 7.8 | In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Perform rctx->cr… |
| CVE-2026-80521 | CVE-2026-80521 CVSS 7.8 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dea… |
| CVE-2026-80520 | CVE-2026-80520 CVSS 7.5 | In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when killing missing key ovpn_crypto_kill_key assumes both cry… |
| CVE-2026-80519 | CVE-2026-80519 CVSS 9.8 | In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold… |
| CVE-2026-80518 | CVE-2026-80518 CVSS 3.7 | The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes u… |
| CVE-2026-80517 | CVE-2026-80517 CVSS 3.5 | The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content… |
| CVE-2026-80515 | CVE-2026-80515 | In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its ch… |
| CVE-2026-80514 | CVE-2026-80514 CVSS 5.3 | The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-vis… |
| CVE-2026-80513 | CVE-2026-80513 CVSS 7.5 | The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, al… |
| CVE-2026-8050 | CVE-2026-8050 CVSS 7.5 | In SignalRGB versions prior to 1.3.7.0, seven of the thirteen IOCTL handlers dereference the SystemBuffer pointer without first verifying that it is non-NULL. … |
| CVE-2026-80494 | CVE-2026-80494 CVSS 8.6 | The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint tha… |
| CVE-2026-80491 | CVE-2026-80491 CVSS 8.6 | The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated action… |
| CVE-2026-80490 | CVE-2026-80490 | Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified. The matches, first_match and match… |
| CVE-2026-8049 | CVE-2026-8049 CVSS 5.3 | In SignalRGB versions prior to 1.3.7.0, the \\.\SignalIo device object is created without an explicit SDDL security descriptor and without FILE_DEVICE_SECURE_O… |
| CVE-2026-80489 | CVE-2026-80489 CVSS 5.9 | Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may re… |
| CVE-2026-80488 | CVE-2026-80488 CVSS 4.1 | The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, whi… |
| CVE-2026-8047 | CVE-2026-8047 CVSS 7.5 | The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated… |
| CVE-2026-80469 | CVE-2026-80469 CVSS 8.3 | An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, a… |
| CVE-2026-80467 | CVE-2026-80467 CVSS 8.1 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the for… |
| CVE-2026-80465 | CVE-2026-80465 CVSS 8.7 | A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.3), … |
| CVE-2026-80464 | CVE-2026-80464 CVSS 4.9 | Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue affects Sef - AI Ch… |
| CVE-2026-80462 | CVE-2026-80462 CVSS 10.0 | A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Auto… |
| CVE-2026-8046 | CVE-2026-8046 CVSS 8.1 | The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerabil… |
| CVE-2026-8045 | CVE-2026-8045 CVSS 6.5schneider-electric | CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side file contents when an… |
| CVE-2026-80444 | CVE-2026-80444 CVSS 5.4 | URL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS… |
| CVE-2026-80443 | CVE-2026-80443 CVSS 7.4 | Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle (AiTM). This issue affects Sef - AI Ch… |
| CVE-2026-80442 | CVE-2026-80442 CVSS 9.9ibm | IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful explo… |
| CVE-2026-80441 | CVE-2026-80441 CVSS 9.8ibm | IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of chan… |
| CVE-2026-80440 | CVE-2026-80440 CVSS 4.8 | The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the … |
| CVE-2026-8044 | CVE-2026-8044 | CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an at… |
| CVE-2026-80439 | CVE-2026-80439 CVSS 4.8 | The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it s… |
| CVE-2026-80438 | CVE-2026-80438 CVSS 5.9 | The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2… |
| CVE-2026-80437 | CVE-2026-80437 CVSS 4.8 | The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them … |
| CVE-2026-80436 | CVE-2026-80436 CVSS 8.5ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service by deleting arbitrary RabbitMQ queues or e… |
| CVE-2026-80434 | CVE-2026-80434 CVSS 7.4ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an in… |
| CVE-2026-80433 | CVE-2026-80433 CVSS 7.5 | Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions. |
| CVE-2026-80432 | CVE-2026-80432 | Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to ob… |
| CVE-2026-80431 | CVE-2026-80431 | Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to writ… |
| CVE-2026-80430 | CVE-2026-80430 | Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program w… |
| CVE-2026-8043 | CVE-2026-8043 CVSS 9.6 | External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HT… |
| CVE-2026-80428 | CVE-2026-80428 CVSS 9.8 | ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arb… |
| CVE-2026-80427 | CVE-2026-80427 CVSS 8.4 | bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied sour… |
| CVE-2026-80426 | CVE-2026-80426 CVSS 7.1 | FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.t… |
| CVE-2026-80425 | CVE-2026-80425 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special… |
| CVE-2026-80424 | CVE-2026-80424 CVSS 9.1ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extracti… |