93,331 indexed
CVECVE vulnerabilities
93,331 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 3,901–3,950 of 93,331 · page 79 of 1867
| ID | Title | Summary |
|---|---|---|
| CVE-2026-91788 | CVE-2026-91788 CVSS 4.7 | When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a resu… |
| CVE-2026-91786 | CVE-2026-91786 CVSS 6.1 | A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions aga… |
| CVE-2026-91784 | CVE-2026-91784 | cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitizatio… |
| CVE-2026-91782 | CVE-2026-91782 CVSS 3.3gnu | A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynrelocs of the file bfd/elfxx-x86.c of the… |
| CVE-2026-91781 | CVE-2026-91781 CVSS 3.3gnu | A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_index of the file bfd/elf64-x86-64.c of the… |
| CVE-2026-91780 | CVE-2026-91780 CVSS 3.3gnu | A weakness has been identified in GNU Binutils 2.47. This impacts the function elf_link_add_object_symbols of the file bfd/elflink.c. Executing a manipulation … |
| CVE-2026-9178 | CVE-2026-9178 CVSS 7.5 | The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST rout… |
| CVE-2026-91779 | CVE-2026-91779 CVSS 3.3gnu | A security flaw has been discovered in GNU Binutils 2.47. This affects the function _bfd_elf_eh_frame_section_offset of the file bfd/elf-eh-frame.c of the comp… |
| CVE-2026-91778 | CVE-2026-91778 | In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server bui… |
| CVE-2026-91777 | CVE-2026-91777 CVSS 7.5 | Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for eve… |
| CVE-2026-91776 | CVE-2026-91776 CVSS 7.5 | TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-bas… |
| CVE-2026-91775 | CVE-2026-91775 | LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulti… |
| CVE-2026-91774 | CVE-2026-91774 CVSS 4.3 | Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers… |
| CVE-2026-91773 | CVE-2026-91773 CVSS 4.3 | Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories… |
| CVE-2026-91772 | CVE-2026-91772 CVSS 6.1 | Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can c… |
| CVE-2026-91771 | CVE-2026-91771 CVSS 8.8 | Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Atta… |
| CVE-2026-91770 | CVE-2026-91770 CVSS 6.5 | IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR rec… |
| CVE-2026-9177 | CVE-2026-9177 | A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20… |
| CVE-2026-91769 | CVE-2026-91769 CVSS 4.3 | PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC… |
| CVE-2026-91768 | CVE-2026-91768 CVSS 6.5 | The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefi… |
| CVE-2026-91767 | CVE-2026-91767 CVSS 6.5 | php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard… |
| CVE-2026-91766 | CVE-2026-91766 CVSS 5.9 | When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the… |
| CVE-2026-91765 | CVE-2026-91765 CVSS 7.5 | cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containi… |
| CVE-2026-9176 | CVE-2026-9176 CVSS 6.7ibm | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this v… |
| CVE-2026-91752 | CVE-2026-91752 CVSS 7.5 | GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array … |
| CVE-2026-91751 | CVE-2026-91751 CVSS 8.3 | Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or … |
| CVE-2026-91750 | CVE-2026-91750 CVSS 6.5 | WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from … |
| CVE-2026-9175 | CVE-2026-9175 CVSS 5.3 | The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including… |
| CVE-2026-91749 | CVE-2026-91749 CVSS 9.6google | Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a cra… |
| CVE-2026-91748 | CVE-2026-91748 CVSS 8.3google | Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged… |
| CVE-2026-91747 | CVE-2026-91747 CVSS 3.1google | Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data v… |
| CVE-2026-91746 | CVE-2026-91746 CVSS 4.3google | Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromiu… |
| CVE-2026-91745 | CVE-2026-91745 CVSS 8.8google | Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
| CVE-2026-91744 | CVE-2026-91744 CVSS 5.3google | Race condition in PlatformIntegration in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and … |
| CVE-2026-91743 | CVE-2026-91743 CVSS 8.3google | Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitr… |
| CVE-2026-91742 | CVE-2026-91742 CVSS 4.8google | Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system acc… |
| CVE-2026-91741 | CVE-2026-91741 CVSS 8.8google | Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTM… |
| CVE-2026-91740 | CVE-2026-91740 CVSS 4.3google | Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium… |
| CVE-2026-91739 | CVE-2026-91739 CVSS 4.2google | Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to sp… |
| CVE-2026-91738 | CVE-2026-91738 CVSS 9.6google | Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox … |
| CVE-2026-91737 | CVE-2026-91737 CVSS 8.8google | Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (… |
| CVE-2026-91736 | CVE-2026-91736 CVSS 8.8google | Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (… |
| CVE-2026-91735 | CVE-2026-91735 CVSS 8.3google | Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially exec… |
| CVE-2026-91734 | CVE-2026-91734 CVSS 7.4google | Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code outside the sandbox vi… |
| CVE-2026-91733 | CVE-2026-91733 CVSS 8.3google | Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to read memory out… |
| CVE-2026-91732 | CVE-2026-91732 CVSS 8.1google | Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged s… |
| CVE-2026-91731 | CVE-2026-91731 CVSS 8.8google | Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… |
| CVE-2026-91730 | CVE-2026-91730 CVSS 3.1google | Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged soc… |
| CVE-2026-91729 | CVE-2026-91729 CVSS 9.6google | Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to execute arbitrary code … |
| CVE-2026-91728 | CVE-2026-91728 CVSS 9.6google | Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. … |