112,666 indexed
CVECVE vulnerabilities
112,666 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 14,001–14,050 of 112,666 · page 281 of 2254
| ID | Title | Summary |
|---|---|---|
| CVE-2026-80423 | CVE-2026-80423 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to the exposure of namespace-wide s… |
| CVE-2026-80412 | CVE-2026-80412 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector propert… |
| CVE-2026-8039 | CVE-2026-8039 CVSS 6.4 | The Fancy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' shortcode attribute in the 'testimonial' shortcode in… |
| CVE-2026-80381 | CVE-2026-80381 CVSS 9.8ibm | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection. |
| CVE-2026-80380 | CVE-2026-80380 CVSS 7.1ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to perform unauthorized actions due to cross-site request forgery. |
| CVE-2026-8038 | CVE-2026-8038 CVSS 6.4 | The Faces of Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in the 'facesofusers' shortcode in a… |
| CVE-2026-80379 | CVE-2026-80379 CVSS 8.8ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special… |
| CVE-2026-80378 | CVE-2026-80378 CVSS 8.5ibm | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper authorization. |
| CVE-2026-8037 | Progress LoadMaster Command Injection Vulnerability KEVCVSS 9.6Progress | Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster applian… |
| CVE-2026-8036 | CVE-2026-8036 CVSS 7.1ni | Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially leading to privilege escalation. This v… |
| CVE-2026-80359 | CVE-2026-80359 CVSS 6.8 | Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerabili… |
| CVE-2026-80358 | CVE-2026-80358 CVSS 5.1 | Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerabili… |
| CVE-2026-80357 | CVE-2026-80357 CVSS 7.0 | Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerabili… |
| CVE-2026-80356 | CVE-2026-80356 CVSS 7.3dell | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. A low p… |
| CVE-2026-80355 | CVE-2026-80355 CVSS 5.4dell | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with … |
| CVE-2026-80354 | CVE-2026-80354 CVSS 8.1apache | Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resolution allows a tena… |
| CVE-2026-80353 | CVE-2026-80353 | Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unaut… |
| CVE-2026-80352 | CVE-2026-80352 CVSS 9.8apache | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration a… |
| CVE-2026-80351 | CVE-2026-80351 CVSS 9.8apache | Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K. An improper neutralization of direct… |
| CVE-2026-80350 | CVE-2026-80350 CVSS 7.1 | OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped I… |
| CVE-2026-8035 | CVE-2026-8035 CVSS 7.1ni | Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause a denial of service by triggering a crash due to a NULL poi… |
| CVE-2026-80349 | CVE-2026-80349 CVSS 9.8 | TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming whi… |
| CVE-2026-80348 | CVE-2026-80348 CVSS 8.8 | TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.… |
| CVE-2026-80347 | CVE-2026-80347 CVSS 7.5 | mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parse… |
| CVE-2026-80346 | CVE-2026-80346 CVSS 7.1 | StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor c… |
| CVE-2026-80344 | CVE-2026-80344 CVSS 8.2 | Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before … |
| CVE-2026-80343 | CVE-2026-80343 CVSS 8.2 | Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.… |
| CVE-2026-80342 | CVE-2026-80342 CVSS 6.5 | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooC… |
| CVE-2026-80341 | CVE-2026-80341 CVSS 5.9 | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowi… |
| CVE-2026-80340 | CVE-2026-80340 CVSS 5.3 | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configurat… |
| CVE-2026-8034 | CVE-2026-8034 CVSS 9.8 | A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal s… |
| CVE-2026-80339 | CVE-2026-80339 CVSS 5.3 | The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configurat… |
| CVE-2026-80338 | CVE-2026-80338 CVSS 6.8 | The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to cr… |
| CVE-2026-80337 | CVE-2026-80337 CVSS 5.3 | Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue aff… |
| CVE-2026-80333 | CVE-2026-80333 CVSS 5.3 | The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticat… |
| CVE-2026-80327 | CVE-2026-80327 | An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 202… |
| CVE-2026-80312 | CVE-2026-80312 CVSS 8.2 | Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1… |
| CVE-2026-80311 | CVE-2026-80311 CVSS 4.3 | The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting cust… |
| CVE-2026-8030 | CVE-2026-8030 CVSS 4.3gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain co… |
| CVE-2026-80298 | CVE-2026-80298 CVSS 8.8 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows SQL Inject… |
| CVE-2026-8029 | CVE-2026-8029 CVSS 3.9 | The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback… |
| CVE-2026-80276 | CVE-2026-80276 CVSS 7.5 | Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not requi… |
| CVE-2026-80275 | CVE-2026-80275 CVSS 8.8 | Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative passw… |
| CVE-2026-80274 | CVE-2026-80274 CVSS 7.5 | If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 pro… |
| CVE-2026-80255 | CVE-2026-80255 CVSS 7.5haxx | A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store… |
| CVE-2026-80254 | CVE-2026-80254 CVSS 6.5 | Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who can log in to the product may change the … |
| CVE-2026-80253 | CVE-2026-80253 CVSS 6.8 | An improper physical access control issue exists in ShizenBox2 (dev-conf). If exploited, an attacker with physical access to the product may execute bootloader… |
| CVE-2026-8025 | CVE-2026-8025 CVSS 9.8 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in MOSK Information Technologies Ltd. CBS Platform allows SQ… |
| CVE-2026-8024 | CVE-2026-8024 CVSS 9.8 | A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoordinator to gain full access to the affe… |
| CVE-2026-80239 | CVE-2026-80239 CVSS 2.4dell | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensitive System Informa… |