94,138 indexed
CVECVE vulnerabilities
94,138 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 4,551–4,600 of 94,138 · page 92 of 1883
| ID | Title | Summary |
|---|---|---|
| CVE-2026-9050 | CVE-2026-9050 CVSS 4.3 | The Slider Revolution plugin for WordPress in versions 6.0.0-6.7.55 and 7.0.0-7.0.14 is vulnerable to unauthorized modification of data. This is due to the plu… |
| CVE-2026-90499 | CVE-2026-90499 CVSS 5.4 | A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Pass… |
| CVE-2026-90498 | CVE-2026-90498 CVSS 7.3 | A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to u… |
| CVE-2026-90497 | CVE-2026-90497 CVSS 3.5 | A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/view… |
| CVE-2026-90496 | CVE-2026-90496 CVSS 4.7 | A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function update_system_module_order/update_dimension_order of the file ap… |
| CVE-2026-90495 | CVE-2026-90495 CVSS 7.3 | A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file application/models… |
| CVE-2026-90494 | CVE-2026-90494 CVSS 5.3 | A flaw has been found in restify node-restify up to 12.0.0. This affects the function serveStatic in the library /lib/plugins/static.js. This manipulation caus… |
| CVE-2026-90493 | CVE-2026-90493 CVSS 8.8 | A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.… |
| CVE-2026-90492 | CVE-2026-90492 CVSS 6.3 | A security vulnerability has been detected in webgjc web_robot 2.4.0/2.5.0/2.8.0. The affected element is the function controller_listen/controller_recover of … |
| CVE-2026-90491 | CVE-2026-90491 CVSS 6.3 | A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component El… |
| CVE-2026-90490 | CVE-2026-90490 CVSS 6.3 | A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Performing a manipulat… |
| CVE-2026-90489 | CVE-2026-90489 CVSS 3.5 | A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the ar… |
| CVE-2026-90488 | CVE-2026-90488 CVSS 6.3 | A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/co… |
| CVE-2026-90487 | CVE-2026-90487 CVSS 4.3 | A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/… |
| CVE-2026-90486 | CVE-2026-90486 CVSS 6.3 | A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown function… |
| CVE-2026-90485 | CVE-2026-90485 CVSS 5.5 | A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub_11838 of the file IURegistryFilter.sys of the component IOCTL … |
| CVE-2026-90481 | CVE-2026-90481 | In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel. |
| CVE-2026-9048 | CVE-2026-9048 CVSS 4.3 | The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 7.0.0 - 7.0.14, via the 'slider.get.full' AJAX Action. T… |
| CVE-2026-90474 | CVE-2026-90474 CVSS 6.8 | MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by … |
| CVE-2026-90473 | CVE-2026-90473 CVSS 5.3 | msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element count… |
| CVE-2026-90472 | CVE-2026-90472 CVSS 5.3 | msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nest… |
| CVE-2026-9047 | CVE-2026-9047 CVSS 7.6devolutions | Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's… |
| CVE-2026-90467 | CVE-2026-90467 CVSS 4.0 | aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT T… |
| CVE-2026-90466 | CVE-2026-90466 CVSS 6.5 | Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specif… |
| CVE-2026-90463 | CVE-2026-90463 CVSS 4.0 | A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests t… |
| CVE-2026-90462 | CVE-2026-90462 CVSS 5.4fedoraproject | A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the … |
| CVE-2026-90461 | CVE-2026-90461 CVSS 6.3 | OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication. |
| CVE-2026-90460 | CVE-2026-90460 | An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OA… |
| CVE-2026-9046 | CVE-2026-9046 CVSS 7.0 | A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chines… |
| CVE-2026-90457 | CVE-2026-90457 CVSS 6.2 | The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file contain… |
| CVE-2026-90456 | CVE-2026-90456 CVSS 8.1 | An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment… |
| CVE-2026-90455 | CVE-2026-90455 CVSS 3.7 | A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerab… |
| CVE-2026-90454 | CVE-2026-90454 CVSS 4.3 | A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but … |
| CVE-2026-90453 | CVE-2026-90453 CVSS 3.5 | A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it again… |
| CVE-2026-90452 | CVE-2026-90452 CVSS 5.3 | Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provide… |
| CVE-2026-90451 | CVE-2026-90451 CVSS 5.9 | An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis com… |
| CVE-2026-90450 | CVE-2026-90450 CVSS 4.3 | The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather … |
| CVE-2026-9045 | CVE-2026-9045 CVSS 7.8 | During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that coul… |
| CVE-2026-90449 | CVE-2026-90449 CVSS 6.5 | When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that in… |
| CVE-2026-90448 | CVE-2026-90448 CVSS 6.5 | A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which reques… |
| CVE-2026-90447 | CVE-2026-90447 CVSS 6.5 | A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, … |
| CVE-2026-90446 | CVE-2026-90446 CVSS 4.3 | An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying s… |
| CVE-2026-90445 | CVE-2026-90445 CVSS 6.5 | An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain … |
| CVE-2026-90444 | CVE-2026-90444 CVSS 8.8 | A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process … |
| CVE-2026-90443 | CVE-2026-90443 CVSS 5.4 | A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentic… |
| CVE-2026-90441 | CVE-2026-90441 CVSS 8.1watchguard | A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (includin… |
| CVE-2026-90440 | CVE-2026-90440 | Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonbloc… |
| CVE-2026-9044 | CVE-2026-9044 CVSS 8.0tp-link | An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to ex… |
| CVE-2026-90439 | CVE-2026-90439 CVSS 6.5 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain … |
| CVE-2026-90438 | CVE-2026-90438 CVSS 7.2 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) Field… |