93,331 indexed
CVECVE vulnerabilities
93,331 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 3,801–3,850 of 93,331 · page 77 of 1867
| ID | Title | Summary |
|---|---|---|
| CVE-2026-91942 | CVE-2026-91942 CVSS 5.4 | crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.inner… |
| CVE-2026-91941 | CVE-2026-91941 CVSS 7.5 | Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial o… |
| CVE-2026-91940 | CVE-2026-91940 CVSS 7.5 | crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validat… |
| CVE-2026-91939 | CVE-2026-91939 CVSS 9.8 | Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantia… |
| CVE-2026-91938 | CVE-2026-91938 CVSS 7.1 | Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF … |
| CVE-2026-91937 | CVE-2026-91937 CVSS 7.5 | Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated… |
| CVE-2026-91936 | CVE-2026-91936 CVSS 6.8 | Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated… |
| CVE-2026-91935 | CVE-2026-91935 CVSS 8.3 | Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers … |
| CVE-2026-91934 | CVE-2026-91934 CVSS 8.8 | Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers … |
| CVE-2026-91933 | CVE-2026-91933 CVSS 7.1 | Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from Chat… |
| CVE-2026-91932 | CVE-2026-91932 CVSS 8.5 | Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an u… |
| CVE-2026-91931 | CVE-2026-91931 CVSS 8.5 | Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by sup… |
| CVE-2026-91930 | CVE-2026-91930 CVSS 7.5 | Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitr… |
| CVE-2026-9193 | CVE-2026-9193 CVSS 9.9progress | An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user wit… |
| CVE-2026-91929 | CVE-2026-91929 CVSS 7.1 | Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attacke… |
| CVE-2026-91928 | CVE-2026-91928 CVSS 6.1apache | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS:… |
| CVE-2026-91926 | CVE-2026-91926 CVSS 3.7 | A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV… |
| CVE-2026-91925 | CVE-2026-91925 CVSS 8.8 | Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticate… |
| CVE-2026-91924 | CVE-2026-91924 CVSS 8.5 | pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary d… |
| CVE-2026-91923 | CVE-2026-91923 CVSS 7.7 | KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-suppl… |
| CVE-2026-91922 | CVE-2026-91922 CVSS 6.1 | Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to proper… |
| CVE-2026-91921 | CVE-2026-91921 | Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unaut… |
| CVE-2026-9192 | CVE-2026-9192 CVSS 9.8progress | An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker t… |
| CVE-2026-9190 | CVE-2026-9190 CVSS 9.1progress | An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authent… |
| CVE-2026-9189 | CVE-2026-9189 CVSS 5.3 | The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress is vulnerable to Payment Bypass via Insufficient Verification of Data Authenticity in all vers… |
| CVE-2026-9188 | CVE-2026-9188 CVSS 5.3 | The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up … |
| CVE-2026-9187 | CVE-2026-9187 CVSS 5.3 | The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a… |
| CVE-2026-91867 | CVE-2026-91867 CVSS 4.3apache | When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fe… |
| CVE-2026-91866 | CVE-2026-91866 CVSS 7.5apache | A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (deni… |
| CVE-2026-91865 | CVE-2026-91865 CVSS 7.5apache | A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming hug… |
| CVE-2026-91864 | CVE-2026-91864 CVSS 7.5apache | A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its si… |
| CVE-2026-91863 | CVE-2026-91863 CVSS 7.5apache | A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the pa… |
| CVE-2026-91862 | CVE-2026-91862 CVSS 6.4 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, an… |
| CVE-2026-91860 | CVE-2026-91860 | A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not con… |
| CVE-2026-9186 | CVE-2026-9186 CVSS 6.5langflow | IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For… |
| CVE-2026-91859 | CVE-2026-91859 | Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController… |
| CVE-2026-91857 | CVE-2026-91857 | Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: - EventReportsCont… |
| CVE-2026-91855 | CVE-2026-91855 CVSS 5.3 | A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality of the file lib/pfcp/handler.c of the co… |
| CVE-2026-91854 | CVE-2026-91854 CVSS 4.3 | A vulnerability was identified in code-projects Record Management System 1.0. Affected is an unknown function of the file main/reg.php. Such manipulation of th… |
| CVE-2026-91853 | CVE-2026-91853 CVSS 7.4 | A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?acti… |
| CVE-2026-91852 | CVE-2026-91852 CVSS 6.1apache | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS:… |
| CVE-2026-91851 | CVE-2026-91851 | Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. DashboardsController::listTemplates() all… |
| CVE-2026-9185 | CVE-2026-9185 CVSS 7.5 | The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the … |
| CVE-2026-91849 | CVE-2026-91849 CVSS 6.3 | A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of … |
| CVE-2026-91848 | CVE-2026-91848 CVSS 7.3 | A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=articl… |
| CVE-2026-91847 | CVE-2026-91847 CVSS 4.8 | The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversatio… |
| CVE-2026-91846 | CVE-2026-91846 | Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access … |
| CVE-2026-91844 | CVE-2026-91844 CVSS 7.3 | Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files… |
| CVE-2026-91843 | CVE-2026-91843 CVSS 9.8 | A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges. |
| CVE-2026-91842 | CVE-2026-91842 CVSS 4.1 | A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/src/main/scala/code/… |