94,138 indexed
CVECVE vulnerabilities
94,138 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 4,151–4,200 of 94,138 · page 84 of 1883
| ID | Title | Summary |
|---|---|---|
| CVE-2026-91025 | CVE-2026-91025 CVSS 4.3 | The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific … |
| CVE-2026-91024 | CVE-2026-91024 CVSS 6.8 | The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL… |
| CVE-2026-91023 | CVE-2026-91023 CVSS 3.1 | The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing managem… |
| CVE-2026-91022 | CVE-2026-91022 CVSS 6.8 | The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users … |
| CVE-2026-91021 | CVE-2026-91021 CVSS 5.4 | Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper… |
| CVE-2026-91020 | CVE-2026-91020 CVSS 5.3 | The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the ca… |
| CVE-2026-9102 | CVE-2026-9102 | A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber file upload APIs. A … |
| CVE-2026-91019 | CVE-2026-91019 CVSS 4.9 | The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing user… |
| CVE-2026-91018 | CVE-2026-91018 CVSS 8.8 | lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim syst… |
| CVE-2026-91017 | CVE-2026-91017 CVSS 3.7 | The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-def… |
| CVE-2026-91016 | CVE-2026-91016 CVSS 5.3 | The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowin… |
| CVE-2026-91015 | CVE-2026-91015 CVSS 5.3 | The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder po… |
| CVE-2026-91014 | CVE-2026-91014 CVSS 7.1 | The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back… |
| CVE-2026-91012 | CVE-2026-91012 CVSS 9.8apache | org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the fil… |
| CVE-2026-91011 | CVE-2026-91011 CVSS 6.8 | The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated use… |
| CVE-2026-91010 | CVE-2026-91010 CVSS 4.3 | The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message del… |
| CVE-2026-9101 | CVE-2026-9101 CVSS 4.3mongodb | Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user beh… |
| CVE-2026-91009 | CVE-2026-91009 CVSS 4.3 | The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actio… |
| CVE-2026-91008 | CVE-2026-91008 CVSS 3.7 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirma… |
| CVE-2026-91006 | CVE-2026-91006 CVSS 8.8apache | Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then execute… |
| CVE-2026-91005 | CVE-2026-91005 CVSS 6.3 | A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded_file of the file production/edit_pictu… |
| CVE-2026-91004 | CVE-2026-91004 CVSS 7.3 | A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete_faculty1.… |
| CVE-2026-91003 | CVE-2026-91003 CVSS 9.1 | A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI Service. This manipulat… |
| CVE-2026-91002 | CVE-2026-91002 CVSS 5.3 | A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function _blacklist of the file core/httpd.py of the component … |
| CVE-2026-91001 | CVE-2026-91001 CVSS 9.9 | A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS Configuration. Perf… |
| CVE-2026-9100 | CVE-2026-9100 CVSS 5.9mongodb | The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collectio… |
| CVE-2026-90999 | CVE-2026-90999 CVSS 9.8 | Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed b… |
| CVE-2026-90997 | CVE-2026-90997 CVSS 7.4 | A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak… |
| CVE-2026-90996 | CVE-2026-90996 CVSS 4.0fedoraproject | A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) respo… |
| CVE-2026-90995 | CVE-2026-90995 CVSS 5.5 | A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder… |
| CVE-2026-90994 | CVE-2026-90994 CVSS 4.0 | A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client wi… |
| CVE-2026-90992 | CVE-2026-90992 CVSS 6.4 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to… |
| CVE-2026-90990 | CVE-2026-90990 | Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject a… |
| CVE-2026-9099 | CVE-2026-9099 CVSS 7.7redhat | A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user wit… |
| CVE-2026-90988 | CVE-2026-90988 CVSS 5.3 | The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticat… |
| CVE-2026-90987 | CVE-2026-90987 CVSS 5.3 | The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field,… |
| CVE-2026-90986 | CVE-2026-90986 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions. |
| CVE-2026-90985 | CVE-2026-90985 CVSS 5.3 | The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through … |
| CVE-2026-90984 | CVE-2026-90984 CVSS 5.8 | The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted… |
| CVE-2026-90983 | CVE-2026-90983 CVSS 8.2 | Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass. This issue affects… |
| CVE-2026-90982 | CVE-2026-90982 CVSS 5.3 | @fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such… |
| CVE-2026-90981 | CVE-2026-90981 CVSS 6.1 | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions… |
| CVE-2026-9098 | CVE-2026-9098 CVSS 9.1 | In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifyi… |
| CVE-2026-90979 | CVE-2026-90979 CVSS 7.3apache | LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn … |
| CVE-2026-90978 | CVE-2026-90978 CVSS 7.1 | The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capa… |
| CVE-2026-90977 | CVE-2026-90977 CVSS 5.3 | The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to… |
| CVE-2026-90976 | CVE-2026-90976 CVSS 5.3 | The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowi… |
| CVE-2026-90974 | CVE-2026-90974 CVSS 6.5 | The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauth… |
| CVE-2026-90972 | CVE-2026-90972 CVSS 5.4 | The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber… |
| CVE-2026-90971 | CVE-2026-90971 CVSS 6.5 | Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user… |