CVEs
Common Vulnerabilities & Exposures ingested from CVE Project cvelistV5, NVD and EUVD. Filter by year or search by ID / title.
252033 CVEs matched. Showing 101–150 (page 3 of 5041).
HIGH and CRITICAL CVEs are auto-promoted to the Threats table; the Threat column below shows the link when a promotion exists.
Click a column header to sort all results; click the active column again to reverse.
| CVE-ID ↕ | Title ↕ | Severity ↕ | Score (overview) ↕ | NVD Score | MSRC Score | CNA ↕ | Published ↕ | Remediations | Threat | Source |
|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-123517 |
Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint | HIGH | 7.1 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123516 |
Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import | HIGH | 7.1 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123515 |
Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Images | MEDIUM | 5.1 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123514 |
Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123513 |
Vikunja before 2.7.1 Auth Token Leak via API URL Change | HIGH | 7.6 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123512 |
Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs | HIGH | 8.4 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123511 |
Vikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entries | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123510 |
Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath | LOW | 1.0 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123509 |
Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Count | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123508 |
Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain | LOW | 2.0 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123507 |
Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter | MEDIUM | 5.1 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123506 |
Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123505 |
Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database | MEDIUM | 6.8 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123504 |
Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123503 |
Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123502 |
Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logging | MEDIUM | 6.9 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123501 |
Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes | HIGH | 7.1 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123500 |
Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump | MEDIUM | 6.9 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123499 |
Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server | MEDIUM | 6.0 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123498 |
Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata | LOW | 2.1 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123497 |
Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery | HIGH | 7.6 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123496 |
Vikunja veans before 2.7.1 Symlink Following in veans init | MEDIUM | 4.8 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123495 |
Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback | MEDIUM | 5.1 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123494 |
Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks | MEDIUM | 5.1 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123493 |
Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-120531 |
Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]'… | HIGH | 7.2 | 7.2 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-99284 |
net: skbuff: propagate shared-frag marker in skb_zerocopy() | — | — | — | — | Linux | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-124060 |
TOTOLINK CA300-PoE cstecgi.cgi UploadCustomModule buffer overflow | CRITICAL | 9.4 | — | — | VulDB | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-99283 |
netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets | — | — | — | — | Linux | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-124059 |
TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflow | CRITICAL | 9.4 | — | — | VulDB | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-124058 |
TOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflow | CRITICAL | 9.4 | — | — | VulDB | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-124057 |
TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflow | CRITICAL | 9.4 | — | — | VulDB | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123472 |
WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119522 |
WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123461 |
WordPress FOX plugin <= 1.5.6 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120836 |
WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Broken Access Control vulnerability | MEDIUM | 6.5 | 6.5 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-124258 |
WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123992 |
DataEase SVG StaticResourceServer.java StaticResourceServer.validateSvgContent cross site scripting | MEDIUM | 5.3 | — | — | VulDB | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123991 |
DataEase Authentication Filter WhitelistUtils.java WhitelistUtils.endsWithAny unrestricted upload | MEDIUM | 6.9 | — | — | VulDB | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123990 |
DataEase Chart Data ExtWhere2Str.java ExtWhere2Str.extWhere2sqlOjb sql injection | MEDIUM | 6.9 | — | — | VulDB | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123989 |
ESEngine DeepSeek-Reasonix Build Script Execution build.rs loadGitStatus permission | MEDIUM | 5.3 | — | — | VulDB | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-124318 |
Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields | HIGH | 8.6 | — | — | VulnCheck | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-124317 |
libexpat through 2.10.0 Out-of-Bounds Read via unknown_toUtf8 and unknown_toUtf16 | MEDIUM | 6.3 | — | — | VulnCheck | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-124316 |
Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-124315 |
Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items | HIGH | 7.1 | — | — | VulnCheck | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-124314 |
Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities | HIGH | 7.1 | — | — | VulnCheck | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-124313 |
Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-124312 |
Fraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfo | MEDIUM | 5.7 | — | — | VulnCheck | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-124311 |
Fraunhofer HHI VVdeC through 3.2.1 NULL Pointer Dereference via InterPrediction::xPredInterBlk | MEDIUM | 6.8 | — | — | VulnCheck | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-124310 |
Fraunhofer HHI VVdeC before 3.2.1 Out-of-Bounds Read via Slice::getRefPic | MEDIUM | 6.9 | — | — | VulnCheck | 2026-11-07 | 10 | — | raw · ⬇ |