Search
23,172 CVEs
CVEs (23,172, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 351–375 of 23,172 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-40967 | HIGH | Patched | 8.6 | 2026-04-28 | In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several ca… |
| CVE-2026-5306 | MEDIUM | Patched | 5.4 | 2026-04-28 | The Check & Log Email WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when… |
| CVE-2026-7229 | MEDIUM | 6.3 | 2026-04-28 | A vulnerability was found in code-projects Coaching Management System 1.0. This affects an unknown function of the file /cims/modules/admin/reply.php of the component POST … | |
| CVE-2026-7230 | MEDIUM | 4.3 | 2026-04-28 | A vulnerability was found in SourceCodester Safety Anger Pad 1.0. The affected element is an unknown function. The manipulation of the argument angerDisplay results in cros… | |
| CVE-2026-7233 | LOW | Patched | 3.3 | 2026-04-28 | A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Inde… |
| CVE-2026-7234 | HIGH | 7.3 | 2026-04-28 | A weakness has been identified in BrowserOperator browser-operator-core up to 0.6.0. Affected is the function startsWith of the file scripts/component_server/server.js. Exe… | |
| CVE-2024-54011 | MEDIUM | Patched | 6.5 | 2026-04-28 | Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in certain requests, causing a service disrupt… |
| CVE-2024-54012 | MEDIUM | Patched | 5.3 | 2026-04-28 | Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate input, allowing specially crafted requests containing… |
| CVE-2024-54013 | HIGH | Patched | 8.8 | 2026-04-28 | Penetration Testing engineers at Amazon have identified a security flaw related to request handling in the web server component that could, under certain conditions, lead t… |
| CVE-2026-40966 | MEDIUM | Patched | 5.9 | 2026-04-28 | In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injectin… |
| CVE-2026-41525 | MEDIUM | Patched | 6.5 | 2026-04-28 | KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny. D… |
| CVE-2026-41526 | MEDIUM | Patched | 6.5 | 2026-04-28 | In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately hand… |
| CVE-2026-4805 | MEDIUM | 6.4 | 2026-04-28 | The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input sanitization and ou… | |
| CVE-2026-4911 | MEDIUM | 5.3 | 2026-04-28 | The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 This is due to the intentForStripe() function passing … | |
| CVE-2026-7235 | MEDIUM | 5.3 | 2026-04-28 | A security vulnerability has been detected in ErlichLiu claude-agent-sdk-master up to b185aa7ff0d864581257008077b4010fca1747bf. Affected by this vulnerability is an unknown… | |
| CVE-2026-7237 | HIGH | 7.3 | 2026-04-28 | A vulnerability was detected in AgiFlow scaffold-mcp up to 1.0.27. Affected by this issue is some unknown functionality of the file packages/scaffold-mcp/src/server/index.t… | |
| CVE-2026-7238 | MEDIUM | 4.7 | 2026-04-28 | A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminUpdateAlbum.php. This manipulation of the arg… | |
| CVE-2026-7240 | CRITICAL | 9.8 | 2026-04-28 | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi of the com… | |
| CVE-2025-10539 | MEDIUM | Patched | 4.8 | 2026-04-28 | Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the c… |
| CVE-2026-40978 | HIGH | Patched | 8.8 | 2026-04-28 | SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions: Spring AI: … |
| CVE-2026-40979 | MEDIUM | Patched | 6.1 | 2026-04-28 | In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 … |
| CVE-2026-40980 | MEDIUM | Patched | 6.5 | 2026-04-28 | In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`. Affected vers… |
| CVE-2026-7241 | CRITICAL | 9.8 | 2026-04-28 | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Han… | |
| CVE-2026-7242 | CRITICAL | 9.8 | 2026-04-28 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the component CGI H… | |
| CVE-2026-7243 | CRITICAL | 9.8 | 2026-04-28 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component C… |