94,138 indexed
CVECVE vulnerabilities
94,138 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 4,251–4,300 of 94,138 · page 86 of 1883
| ID | Title | Summary |
|---|---|---|
| CVE-2026-90914 | CVE-2026-90914 CVSS 6.4joomla | Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability … |
| CVE-2026-90913 | CVE-2026-90913 CVSS 5.5joomla | Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allo… |
| CVE-2026-90912 | CVE-2026-90912 CVSS 7.5 | IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion. |
| CVE-2026-90911 | CVE-2026-90911 CVSS 7.5 | IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. |
| CVE-2026-90907 | CVE-2026-90907 CVSS 5.3joomla | Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save control… |
| CVE-2026-90906 | CVE-2026-90906 CVSS 8.3joomla | Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link metho… |
| CVE-2026-90905 | CVE-2026-90905 | Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrat… |
| CVE-2026-90904 | CVE-2026-90904 | Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() me… |
| CVE-2026-90903 | CVE-2026-90903 | Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administr… |
| CVE-2026-90902 | CVE-2026-90902 | Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update … |
| CVE-2026-90901 | CVE-2026-90901 | Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion e… |
| CVE-2026-90900 | CVE-2026-90900 | Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product r… |
| CVE-2026-90899 | CVE-2026-90899 | Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser … |
| CVE-2026-90898 | CVE-2026-90898 CVSS 9.8 | Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the clie… |
| CVE-2026-90896 | CVE-2026-90896 | Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /… |
| CVE-2026-90895 | CVE-2026-90895 | Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsi… |
| CVE-2026-90894 | CVE-2026-90894 CVSS 7.8 | Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accept… |
| CVE-2026-90893 | CVE-2026-90893 | MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle we… |
| CVE-2026-90891 | CVE-2026-90891 CVSS 5.5 | ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authenticated local attackers can send a spe… |
| CVE-2026-90890 | CVE-2026-90890 CVSS 5.5 | ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. Authenticated local attackers can send… |
| CVE-2026-9089 | CVE-2026-9089 CVSS 8.8connectwise | The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is a… |
| CVE-2026-90887 | CVE-2026-90887 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions. |
| CVE-2026-90884 | CVE-2026-90884 CVSS 5.4 | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 du… |
| CVE-2026-90882 | CVE-2026-90882 | The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the a… |
| CVE-2026-90881 | CVE-2026-90881 CVSS 5.3 | A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Execut… |
| CVE-2026-90880 | CVE-2026-90880 CVSS 7.4 | A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of t… |
| CVE-2026-9088 | CVE-2026-9088 CVSS 2.7 | A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by ac… |
| CVE-2026-90879 | CVE-2026-90879 CVSS 7.3 | A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Pu… |
| CVE-2026-90878 | CVE-2026-90878 CVSS 4.3 | A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template… |
| CVE-2026-90877 | CVE-2026-90877 CVSS 7.3 | A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update_requi… |
| CVE-2026-90876 | CVE-2026-90876 CVSS 7.3 | A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /d… |
| CVE-2026-9087 | CVE-2026-9087 CVSS 6.4redhat | A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was… |
| CVE-2026-90860 | CVE-2026-90860 CVSS 7.1 | The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor w… |
| CVE-2026-9086 | CVE-2026-9086 CVSS 7.3redhat | A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registra… |
| CVE-2026-90858 | CVE-2026-90858 CVSS 7.3 | A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the fun… |
| CVE-2026-90857 | CVE-2026-90857 CVSS 6.3 | A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown function of the file /dashboard/userprofile.… |
| CVE-2026-90856 | CVE-2026-90856 CVSS 7.3 | A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts an unknown function of the file signup.p… |
| CVE-2026-90855 | CVE-2026-90855 CVSS 7.3 | A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown function of the file /web/order.php. Thi… |
| CVE-2026-90854 | CVE-2026-90854 CVSS 7.3 | A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /we… |
| CVE-2026-90852 | CVE-2026-90852 CVSS 7.3 | A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.j… |
| CVE-2026-90851 | CVE-2026-90851 CVSS 6.3 | A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of… |
| CVE-2026-90850 | CVE-2026-90850 CVSS 2.4 | A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-student… |
| CVE-2026-9085 | CVE-2026-9085 CVSS 8.8 | Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-… |
| CVE-2026-90849 | CVE-2026-90849 CVSS 7.3 | A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown function… |
| CVE-2026-90848 | CVE-2026-90848 CVSS 4.3 | A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a ma… |
| CVE-2026-90847 | CVE-2026-90847 CVSS 9.1 | A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. Th… |
| CVE-2026-90846 | CVE-2026-90846 CVSS 7.3 | A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manip… |
| CVE-2026-90845 | CVE-2026-90845 CVSS 3.5 | A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Execut… |
| CVE-2026-90844 | CVE-2026-90844 CVSS 7.3 | A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the compone… |
| CVE-2026-90843 | CVE-2026-90843 CVSS 8.3 | A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the function nmap_newscan of t… |