Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,751 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2020-37288 | 6.3 Medium | Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops | Oct 21, 2026 |
| CVE-2020-37287 | 8.2 High | Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments | Oct 21, 2026 |
| CVE-2020-37286 | 8.3 High | Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls | Oct 21, 2026 |
| CVE-2026-113738 | 5.3 Medium | R6410418 Jackrong-llm-finetuning-guide MTP weight_map qwen_mtp_gguf_pipeline.py extract_mtp_heads path traversal | Oct 21, 2026 |
| CVE-2026-114038 | 5.1 Medium | Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string | Oct 21, 2026 |
| CVE-2026-113737 | 5.1 Medium | R6410418 Jackrong-llm-finetuning-guide qwen_mtp_gguf_pipeline.py validate_indexed_tensors path traversal | Oct 21, 2026 |
| CVE-2026-113736 | 9.3 Critical | D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password | Oct 21, 2026 |
| CVE-2025-71438 | 5.5 Medium | An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. | Oct 21, 2026 |
| CVE-2025-60497 | 5.5 Medium | A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Oct 21, 2026 |
| CVE-2025-60493 | 5.5 Medium | A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Oct 21, 2026 |
| CVE-2025-60492 | 5.5 Medium | A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Oct 21, 2026 |
| CVE-2025-60491 | 5.5 Medium | A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Oct 21, 2026 |
| CVE-2025-60490 | 5.5 Medium | A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Oct 21, 2026 |
| CVE-2025-60489 | 5.5 Medium | A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Oct 21, 2026 |
| CVE-2025-60487 | 5.5 Medium | A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. | Oct 21, 2026 |
| CVE-2025-60479 | 5.5 Medium | A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file. | Oct 21, 2026 |
| CVE-2025-60478 | 5.5 Medium | A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file. | Oct 21, 2026 |
| CVE-2025-60476 | 5.5 Medium | A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. | Oct 21, 2026 |
| CVE-2025-60469 | 5.5 Medium | A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. | Oct 21, 2026 |
| CVE-2026-113735 | 6.3 Medium | D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials | Oct 20, 2026 |
| CVE-2026-113707 | 5.3 Medium | a2aproject a2a-rs inmemory.rs update race condition | Oct 20, 2026 |
| CVE-2026-113706 | 5.1 Medium | a2aproject a2a-rs inmemory.rs information disclosure | Oct 20, 2026 |
| CVE-2026-109682 | 4.7 Medium | Metasploit Framework HTTP Redirect Server-Side Request Forgery | Oct 20, 2026 |
| CVE-2026-109681 | 4.7 Medium | Metasploit Framework FTP PASV Response SSRF | Oct 20, 2026 |
| CVE-2026-113705 | 6.9 Medium | a2aproject a2a-rs error.rs information exposure | Oct 20, 2026 |
| CVE-2026-112202 | 6.5 Medium | Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images | Oct 20, 2026 |
| CVE-2026-76587 | 8.8 High | IBM Planning Analytics Buffer Overflow | Oct 20, 2026 |
| CVE-2026-113726 | 7.8 High | virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST | Oct 20, 2026 |
| CVE-2026-113776 | 7.8 High | virtualenv activation scripts run code from a path that contains a placeholder name | Oct 20, 2026 |
| CVE-2026-9825 | 3.7 Low | IBM Cyber Fraud Reachable Assertion | Oct 20, 2026 |
| CVE-2026-113732 | 7.8 High | virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote | Oct 20, 2026 |
| CVE-2026-113704 | 6.9 Medium | a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery | Oct 20, 2026 |
| CVE-2026-81212 | 10.0 Critical | DataStage on Cloud Pak for Data Improper Authorization | Oct 20, 2026 |
| CVE-2026-82891 | 8.1 High | IBM Guardium Data Protection is affected by a security vulnerability | Oct 20, 2026 |
| CVE-2026-87800 | 6.8 Medium | IBM Cyber Fraud includes components with multiple known vulnerabilities | Oct 20, 2026 |
| CVE-2026-92559 | 9.8 Critical | IBM App Connect Enterprise is vulnerable to a credential exposure | Oct 20, 2026 |
| CVE-2026-93441 | 8.6 High | IBM QRadar SIEM HTTP Receiver protocol is vulnerable to a denial of service | Oct 20, 2026 |
| CVE-2026-93442 | 8.2 High | IBM QRadar SIEM Out-of-bounds Read | Oct 20, 2026 |
| CVE-2026-93744 | 6.5 Medium | IBM i Improper Authentication | Oct 20, 2026 |
| CVE-2026-93888 | 7.8 High | IBM Sterling Connect:Direct for Unix Buffer Overflow | Oct 20, 2026 |
| CVE-2026-94402 | 6.1 Medium | IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation | Oct 20, 2026 |
| CVE-2026-113731 | 3.3 Low | djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool | Oct 20, 2026 |
| CVE-2026-85783 | 7.5 High | Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key | Oct 20, 2026 |
| CVE-2026-91668 | 8.8 High | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low… | Oct 20, 2026 |
| CVE-2026-91665 | 9.8 Critical | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.… | Oct 20, 2026 |
| CVE-2026-91664 | 7.5 High | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.… | Oct 20, 2026 |
| CVE-2026-91663 | 9.9 Critical | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase.… | Oct 20, 2026 |
| CVE-2026-91662 | 6.4 Medium | Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Essbase… | Oct 20, 2026 |
| CVE-2026-91661 | 7.7 High | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.… | Oct 20, 2026 |
| CVE-2026-91660 | 4.3 Medium | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.… | Oct 20, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.