94,138 indexed
CVECVE vulnerabilities
94,138 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 4,101–4,150 of 94,138 · page 83 of 1883
| ID | Title | Summary |
|---|---|---|
| CVE-2026-91123 | CVE-2026-91123 CVSS 7.2 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal back… |
| CVE-2026-91122 | CVE-2026-91122 CVSS 8.7 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to c… |
| CVE-2026-91121 | CVE-2026-91121 CVSS 5.0 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message… |
| CVE-2026-91120 | CVE-2026-91120 CVSS 5.4 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds cou… |
| CVE-2026-9112 | CVE-2026-9112 CVSS 8.8google | Use after free in GPU in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HT… |
| CVE-2026-91119 | CVE-2026-91119 CVSS 6.4 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components… |
| CVE-2026-9111 | CVE-2026-9111 CVSS 8.8google | Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromi… |
| CVE-2026-91109 | CVE-2026-91109 CVSS 6.5 | The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the… |
| CVE-2026-91108 | CVE-2026-91108 CVSS 4.3 | The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up… |
| CVE-2026-91107 | CVE-2026-91107 | openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Info… |
| CVE-2026-91106 | CVE-2026-91106 CVSS 9.8hp | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
| CVE-2026-91105 | CVE-2026-91105 CVSS 9.8hp | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
| CVE-2026-91104 | CVE-2026-91104 CVSS 9.8hp | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
| CVE-2026-91103 | CVE-2026-91103 CVSS 9.8hp | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
| CVE-2026-91102 | CVE-2026-91102 CVSS 9.8hp | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
| CVE-2026-91101 | CVE-2026-91101 CVSS 9.8hp | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
| CVE-2026-91100 | CVE-2026-91100 CVSS 9.8hp | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
| CVE-2026-9110 | CVE-2026-9110 CVSS 4.2google | Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to pe… |
| CVE-2026-91099 | CVE-2026-91099 CVSS 9.8hp | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
| CVE-2026-91098 | CVE-2026-91098 CVSS 9.8hp | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
| CVE-2026-91097 | CVE-2026-91097 CVSS 9.8hp | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
| CVE-2026-91096 | CVE-2026-91096 CVSS 7.5 | In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) f… |
| CVE-2026-91095 | CVE-2026-91095 CVSS 5.3 | In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could ret… |
| CVE-2026-91092 | CVE-2026-91092 CVSS 4.3 | The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly… |
| CVE-2026-91091 | CVE-2026-91091 CVSS 4.3 | A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_node_list_insert_child of the file scenegraph/base_scenegraph.c … |
| CVE-2026-91090 | CVE-2026-91090 CVSS 3.9 | A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This … |
| CVE-2026-9109 | CVE-2026-9109 CVSS 7.2 | The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
| CVE-2026-91089 | CVE-2026-91089 CVSS 6.3 | A vulnerability was found in GPAC up to f1219cde. Impacted is the function gf_node_get_name_and_id of the file scenegraph/base_scenegraph.c. The manipulation r… |
| CVE-2026-91088 | CVE-2026-91088 CVSS 4.8 | A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gf_url_concatenate_ex of the file utils/url.c of the component URL Handl… |
| CVE-2026-91087 | CVE-2026-91087 CVSS 7.3 | A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Co… |
| CVE-2026-91086 | CVE-2026-91086 CVSS 6.3 | A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmx_process of the file filters/reframe_mpgvid.… |
| CVE-2026-91085 | CVE-2026-91085 CVSS 6.3apache | Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactor… |
| CVE-2026-91081 | CVE-2026-91081 CVSS 5.8 | Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by… |
| CVE-2026-91080 | CVE-2026-91080 CVSS 7.5 | webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sendin… |
| CVE-2026-9108 | CVE-2026-9108 CVSS 7.5rockwellautomation | A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does … |
| CVE-2026-91079 | CVE-2026-91079 CVSS 8.5 | Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authentic… |
| CVE-2026-91078 | CVE-2026-91078 CVSS 8.2 | The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be chan… |
| CVE-2026-91077 | CVE-2026-91077 CVSS 2.7 | The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted t… |
| CVE-2026-91073 | CVE-2026-91073 CVSS 6.8 | The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated… |
| CVE-2026-91072 | CVE-2026-91072 CVSS 4.4 | The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, l… |
| CVE-2026-9107 | CVE-2026-9107 CVSS 6.4 | The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'meta[kaliforms_field_component… |
| CVE-2026-9106 | CVE-2026-9106 CVSS 5.5github | A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization'… |
| CVE-2026-91051 | CVE-2026-91051 CVSS 6.6 | The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a … |
| CVE-2026-91050 | CVE-2026-91050 CVSS 4.3 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missi… |
| CVE-2026-9105 | CVE-2026-9105 CVSS 6.5tp-link | An authenticated stack-based buffer overflow vulnerability exists in the web management interface of TP-Link TL-WR841N v14. A remote authenticated attacker ca… |
| CVE-2026-91048 | CVE-2026-91048 CVSS 9.8apache | The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no match… |
| CVE-2026-91043 | CVE-2026-91043 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host an… |
| CVE-2026-9104 | CVE-2026-9104 CVSS 6.4 | The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Draft Post Title in all versions up to, and including, 2.6.3 due to insuff… |
| CVE-2026-91039 | CVE-2026-91039 | Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynami… |
| CVE-2026-9103 | CVE-2026-9103 CVSS 9.8langflow | IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login … |