112,666 indexed
CVECVE vulnerabilities
112,666 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 14,051–14,100 of 112,666 · page 282 of 2254
| ID | Title | Summary |
|---|---|---|
| CVE-2026-80238 | CVE-2026-80238 CVSS 9.3dell | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privilege… |
| CVE-2026-80237 | CVE-2026-80237 CVSS 8.8 | EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell ba… |
| CVE-2026-80236 | CVE-2026-80236 CVSS 8.2 | Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and r… |
| CVE-2026-80235 | CVE-2026-80235 CVSS 9.8 | EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell … |
| CVE-2026-80234 | CVE-2026-80234 CVSS 5.3 | CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists… |
| CVE-2026-80233 | CVE-2026-80233 CVSS 7.2 | CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload… |
| CVE-2026-80231 | CVE-2026-80231 CVSS 7.5haxx | A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLO… |
| CVE-2026-80230 | CVE-2026-80230 CVSS 7.5haxx | When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOS… |
| CVE-2026-8023 | CVE-2026-8023 CVSS 7.5zephyrproject | Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_FILE_SYSTEM is enabl… |
| CVE-2026-80229 | CVE-2026-80229 CVSS 7.5haxx | When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configuration… |
| CVE-2026-80227 | CVE-2026-80227 | Incorrect Comparison vulnerability in ash-project ash_sql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and p… |
| CVE-2026-80225 | CVE-2026-80225 CVSS 5.3nlnetlabs | In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on … |
| CVE-2026-80223 | CVE-2026-80223 | Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to receive another tenant's records over Grap… |
| CVE-2026-80219 | CVE-2026-80219 | Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed. |
| CVE-2026-80218 | CVE-2026-80218 | Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed … |
| CVE-2026-80217 | CVE-2026-80217 CVSS 8.8 | Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to ex… |
| CVE-2026-80216 | CVE-2026-80216 | Rejected reason: duplicate record |
| CVE-2026-80214 | CVE-2026-80214 | LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server. |
| CVE-2026-80213 | CVE-2026-80213 CVSS 4.0 | An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking it… |
| CVE-2026-80212 | CVE-2026-80212 CVSS 7.5 | An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcPa… |
| CVE-2026-80211 | CVE-2026-80211 CVSS 5.9 | FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and upd… |
| CVE-2026-80210 | CVE-2026-80210 CVSS 6.5 | FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it re… |
| CVE-2026-80209 | CVE-2026-80209 CVSS 4.3 | The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSION_DENIE… |
| CVE-2026-80208 | CVE-2026-80208 CVSS 8.2 | APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterce… |
| CVE-2026-80207 | CVE-2026-80207 CVSS 5.3 | APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation… |
| CVE-2026-80206 | CVE-2026-80206 CVSS 5.9nltk | NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-sup… |
| CVE-2026-80205 | CVE-2026-80205 CVSS 7.5nltk | NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user… |
| CVE-2026-80204 | CVE-2026-80204 CVSS 5.4 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController whe… |
| CVE-2026-80203 | CVE-2026-80203 CVSS 9.8 | The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sen… |
| CVE-2026-80202 | CVE-2026-80202 CVSS 8.8 | Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timeshe… |
| CVE-2026-80201 | CVE-2026-80201 CVSS 2.0 | Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() me… |
| CVE-2026-80200 | CVE-2026-80200 CVSS 4.7 | Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as r… |
| CVE-2026-80199 | CVE-2026-80199 CVSS 3.7 | Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-… |
| CVE-2026-80198 | CVE-2026-80198 CVSS 7.5 | Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary… |
| CVE-2026-80197 | CVE-2026-80197 CVSS 4.3 | Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to mani… |
| CVE-2026-80196 | CVE-2026-80196 CVSS 7.5 | Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signat… |
| CVE-2026-80195 | CVE-2026-80195 CVSS 5.4 | Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all… |
| CVE-2026-80194 | CVE-2026-80194 CVSS 4.3 | Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization gu… |
| CVE-2026-80193 | CVE-2026-80193 CVSS 8.8 | Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with vie… |
| CVE-2026-80192 | CVE-2026-80192 CVSS 8.1 | @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws. When … |
| CVE-2026-80191 | CVE-2026-80191 CVSS 7.5 | GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in app… |
| CVE-2026-80190 | CVE-2026-80190 CVSS 6.1 | Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP hea… |
| CVE-2026-80189 | CVE-2026-80189 CVSS 6.5 | LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip_extractor.go opens e… |
| CVE-2026-80186 | CVE-2026-80186 CVSS 7.6 | A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a speciall… |
| CVE-2026-80185 | CVE-2026-80185 CVSS 5.7 | BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML pars… |
| CVE-2026-80184 | CVE-2026-80184 | In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be s… |
| CVE-2026-80183 | CVE-2026-80183 | In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain b… |
| CVE-2026-80182 | CVE-2026-80182 | In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-live… |
| CVE-2026-80181 | CVE-2026-80181 CVSS 9.1 | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. Users are recommended t… |
| CVE-2026-80180 | CVE-2026-80180 CVSS 6.1 | Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to vers… |