Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,751 vulnerabilities match.

CVESeveritySummary
CVE-2026-711959.9 CriticalIn OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public…
CVE-2026-828197.1 HighUniversal Naming Convention (UNC) Path Injection in Cerberus FTP Server
CVE-2026-1140405.1 MediumDT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversal
CVE-2026-1140395.3 Mediumprojectworlds Advanced Library Management System report_search.php mysqli_query sql injection
CVE-2026-928246.2 MediumLibmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts
CVE-2026-928226.2 MediumLibmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml
CVE-2026-928236.2 MediumLibmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml
CVE-2026-828148.8 HighDuplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection
CVE-2026-11374410.0 CriticalTenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow
CVE-2026-1137435.3 MediumTenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal
CVE-2026-1050448.5 HighOS Command Injection in Qingteng Host Adaptive Security Platform Security Toolbox
CVE-2026-1137415.3 Mediumitsourcecode Online Cake Ordering System 404.php cross site scripting
CVE-2026-1119436.8 MediumDistrust compromised intermediate certificates in crypto/x509
CVE-2026-1137405.3 Mediumitsourcecode Online Cake Ordering System deletecustomer.php sql injection
CVE-2026-1141988.7 HighDeserialization of untrusted data in floss
CVE-2026-1141978.7 HighDeserialization of untrusted data in capa
CVE-2026-1141199.3 CriticalBest Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential
CVE-2026-1141186.3 MediumVyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound
CVE-2026-1141178.2 HighVyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches
CVE-2026-1141166.0 MediumVyper through 0.5.0b1 Literal Value Manipulation via Line Separators
CVE-2026-1141156.3 MediumVyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection
CVE-2026-1141146.0 MediumVyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters
CVE-2026-1141138.4 HighSharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders
CVE-2026-1141128.9 HighSharp before 0.35.4 RCE via bundled libheif AVIF decoding
CVE-2026-1141118.9 HighSharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability
CVE-2026-1141108.7 HighAstral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries
CVE-2026-1141098.7 Highuv before 0.11.15 Arbitrary File Write via Entry Point Names
CVE-2026-1141089.3 CriticalHKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE
CVE-2026-1141078.7 HighHKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool
CVE-2026-1141068.7 HighHKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path
CVE-2026-1141056.9 MediumAdm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits
CVE-2026-1141048.2 Highadm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass
CVE-2026-1141036.9 Mediumadm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()
CVE-2026-1141028.7 Highadm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event
CVE-2026-1141016.3 MediumCoraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass
CVE-2026-1141006.9 MediumCoraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type
CVE-2026-1140996.9 MediumCoraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision
CVE-2026-1140987.3 HighDulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks
CVE-2026-1140977.3 HighDulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter
CVE-2026-1140967.3 HighDulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths
CVE-2026-1140957.1 HighDulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object
CVE-2026-1140948.7 HighDulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths
CVE-2026-1140935.3 MediumTrigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint
CVE-2026-1140928.3 HighTrigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action
CVE-2026-1140916.0 MediumTrigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route
CVE-2026-1140907.6 HighTrigger.dev CLI 3.0.0 before 4.5.4 Missing Authentication in MCP Server
CVE-2026-1140898.7 HighTrigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover
CVE-2026-1140888.3 HighTrigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO
CVE-2026-1140879.2 CriticalTrigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets
CVE-2026-1140866.9 MediumTrigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.