93,331 indexed
CVECVE vulnerabilities
93,331 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 4,001–4,050 of 93,331 · page 81 of 1867
| ID | Title | Summary |
|---|---|---|
| CVE-2026-9139 | CVE-2026-9139 CVSS 9.8 | Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentic… |
| CVE-2026-9138 | CVE-2026-9138 CVSS 6.5langflow | IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in… |
| CVE-2026-9137 | CVE-2026-9137 CVSS 7.5misp-project | The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where… |
| CVE-2026-9136 | CVE-2026-9136 CVSS 6.5misp-project | A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without … |
| CVE-2026-9135 | CVE-2026-9135 CVSS 9.9langflow | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in… |
| CVE-2026-9134 | CVE-2026-9134 CVSS 6.4 | The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attribute_key' shortcode parameter in versions up to, and incl… |
| CVE-2026-9133 | CVE-2026-9133 CVSS 7.7 | Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme (arn:aws-debug:file) accepted by the PUT /api/a… |
| CVE-2026-9132 | CVE-2026-9132 CVSS 6.5github | A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositori… |
| CVE-2026-9130 | CVE-2026-9130 CVSS 7.1langflow | IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat histo… |
| CVE-2026-9129 | CVE-2026-9129 | A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-pr… |
| CVE-2026-9128 | CVE-2026-9128 CVSS 7.5rockwellautomation | A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable pa… |
| CVE-2026-9127 | CVE-2026-9127 CVSS 7.5rockwellautomation | A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any aut… |
| CVE-2026-9126 | CVE-2026-9126 CVSS 8.8google | Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.… |
| CVE-2026-9125 | CVE-2026-9125 CVSS 6.4 | The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_overlay] shortcode in ve… |
| CVE-2026-9124 | CVE-2026-9124 CVSS 5.3google | Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer proc… |
| CVE-2026-9123 | CVE-2026-9123 CVSS 7.5google | Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a local attacker to execute arbitrary code insi… |
| CVE-2026-9122 | CVE-2026-9122 CVSS 6.5google | Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to obtain potentially sensitive information from process me… |
| CVE-2026-9121 | CVE-2026-9121 CVSS 8.8google | Out of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.… |
| CVE-2026-91206 | CVE-2026-91206 CVSS 6.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross… |
| CVE-2026-91205 | CVE-2026-91205 CVSS 6.0 | A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a… |
| CVE-2026-91204 | CVE-2026-91204 CVSS 6.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comm… |
| CVE-2026-91203 | CVE-2026-91203 CVSS 6.0 | A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged f… |
| CVE-2026-91202 | CVE-2026-91202 CVSS 6.1 | A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and … |
| CVE-2026-91201 | CVE-2026-91201 CVSS 5.4 | DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attac… |
| CVE-2026-91200 | CVE-2026-91200 CVSS 8.8 | DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can… |
| CVE-2026-9120 | CVE-2026-9120 CVSS 8.8google | Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium securi… |
| CVE-2026-91199 | CVE-2026-91199 CVSS 5.0 | Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validat… |
| CVE-2026-91198 | CVE-2026-91198 CVSS 5.3 | GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experime… |
| CVE-2026-91197 | CVE-2026-91197 CVSS 6.5 | Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable … |
| CVE-2026-91191 | CVE-2026-91191 CVSS 7.5 | The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock don… |
| CVE-2026-9119 | CVE-2026-9119 CVSS 8.8google | Heap buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
| CVE-2026-91187 | CVE-2026-91187 | Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary … |
| CVE-2026-91181 | CVE-2026-91181 CVSS 6.5mattermost | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention team… |
| CVE-2026-9118 | CVE-2026-9118 CVSS 8.8google | Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium… |
| CVE-2026-9117 | CVE-2026-9117 CVSS 7.5google | Type Confusion in GFX in Google Chrome on Linux, ChromeOS prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to potenti… |
| CVE-2026-91167 | CVE-2026-91167 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_u… |
| CVE-2026-91166 | CVE-2026-91166 CVSS 5.7 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handl… |
| CVE-2026-91165 | CVE-2026-91165 CVSS 2.4 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/… |
| CVE-2026-91164 | CVE-2026-91164 CVSS 4.3 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::valida… |
| CVE-2026-91161 | CVE-2026-91161 CVSS 6.4 | OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code endpoint and t… |
| CVE-2026-91160 | CVE-2026-91160 CVSS 8.2 | OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API k… |
| CVE-2026-9116 | CVE-2026-9116 CVSS 4.3google | Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted … |
| CVE-2026-91154 | CVE-2026-91154 | Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara… |
| CVE-2026-9115 | CVE-2026-9115 CVSS 4.3google | Insufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to bypass same origin policy via a craf… |
| CVE-2026-91149 | CVE-2026-91149 CVSS 7.5 | A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections t… |
| CVE-2026-91147 | CVE-2026-91147 CVSS 5.9 | A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafte… |
| CVE-2026-91146 | CVE-2026-91146 CVSS 6.1 | Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascr… |
| CVE-2026-91145 | CVE-2026-91145 CVSS 7.1 | Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers … |
| CVE-2026-91144 | CVE-2026-91144 CVSS 7.5 | ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can … |
| CVE-2026-91143 | CVE-2026-91143 CVSS 7.2 | goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requireme… |