Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,206 vulnerabilities match.

CVESeveritySummary
CVE-2026-544537.2 HighOpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)
CVE-2026-615717.3 HighAVideo-Encoder: missing authentication on control and status endpoints
CVE-2026-1166417.6 HighThe DB Tools trust certificates issued by recoverable eMudhra intermediate CAs
CVE-2026-615728.6 HighAVideo-Encoder: unauthenticated full-response server-side request forgery
CVE-2026-615736.1 MediumAVideo-Encoder: reflected cross-site scripting in the login interface
CVE-2026-1185375.3 Mediuma2ui Image Player/Video Player/Audio Player Image.js input validation
CVE-2026-544557.6 HighOpenCATS: Authenticated SQL injection in activity DataGrid date filters
CVE-2026-6156710.0 CriticalAVideo-Encoder: unauthenticated command execution through streamer login trust
CVE-2026-6156410.0 CriticalAVideo-Encoder: unauthenticated installer PHP code injection
CVE-2026-574486.2 MediumBlombooru: administrator image-proxy server-side request forgery
CVE-2026-938518.0 HighPath traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post
CVE-2026-615468.8 HighAnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools
CVE-2026-1188047.5 HighBricks Broken Access Control via query_result Endpoint
CVE-2026-1188037.5 HighBricks Theme Unauthenticated Dynamic Data Tag Injection via query_result
CVE-2026-1187576.9 MediumPiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees
CVE-2026-1187566.7 Mediumgopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir
CVE-2026-1187558.6 HighVolmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path
CVE-2026-1187546.9 MediumDolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php
CVE-2026-1187538.5 HighFreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing
CVE-2026-1187528.5 HighFreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder
CVE-2026-1186948.7 Highpython-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations
CVE-2026-1186935.6 MediumCherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path
CVE-2026-1186927.1 HighCherryTree through 1.7.2 OS Command Injection via Custom Web Link Action
CVE-2026-1186916.3 Mediumxianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message
CVE-2026-1186909.3 CriticalSignal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs
CVE-2026-1186898.7 HighOvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length
CVE-2026-1186827.7 HighClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM
CVE-2026-1186698.4 HighOAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
CVE-2026-1186688.6 HighLangGraph JavaScript custom authentication may permit cross-user Store access
CVE-2026-1186674.3 MediumLangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests
CVE-2026-1186666.0 MediumGraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
CVE-2026-1186658.2 HighGraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
CVE-2026-1186648.2 Highdecode-uri-component: Denial of service via quadratic replacement of percent-encoded runs
CVE-2026-1186635.3 Medium@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
CVE-2026-1186626.9 MediumVite: `server.fs.deny` bypassed with queries
CVE-2026-1186616.5 MediumHappy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
CVE-2026-1186608.6 HighHappy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
CVE-2026-1186597.5 High@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy
CVE-2026-1186584.7 MediumEcho: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto
CVE-2026-1186575.9 MediumEcho: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
CVE-2026-1186566.1 MediumEcho: Open Redirect via Control-Character Prefix Defeating sanitizeURI
CVE-2026-764188.6 HighCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
CVE-2026-1186555.9 MediumEcho: Static Middleware Double-Unescape Path Traversal
CVE-2026-1175749.1 CriticalAi-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization
CVE-2026-1186545.9 MediumEcho static file middleware route protection bypass via encoded dot-dot traversal
CVE-2026-134517.7 HighKserve: kserve: server-side request forgery via malicious storageuri
CVE-2026-615428.6 HighGearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools
CVE-2026-541624.7 MediumEmber: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI
CVE-2026-615294.7 MediumEndatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)
CVE-2026-1186535.3 MediumEcho: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.