Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
400,982 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-107692 | 4.8 Medium | War Thunder Account Impersonation | Oct 20, 2026 |
| CVE-2026-113722 | 7.8 High | virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax | Oct 20, 2026 |
| CVE-2026-113721 | 4.5 Medium | virtualenv: Generated files can follow existing destination links | Oct 20, 2026 |
| CVE-2026-113720 | 4.4 Medium | virtualenv: Seeded files retain permissions from an older cache | Oct 20, 2026 |
| CVE-2026-113715 | 2.0 Low | virtualenv: Venv configuration readback can reinterpret path boundaries | Oct 20, 2026 |
| CVE-2026-113719 | 4.5 Medium | virtualenv: Seed replacement does not contain metadata deletion paths | Oct 20, 2026 |
| CVE-2026-113718 | 7.1 High | virtualenv: Xonsh activation literals depend on the script decoding codec | Oct 20, 2026 |
| CVE-2026-113717 | 2.3 Low | virtualenv: Pip seeding with download omits wheel digest verification | Oct 20, 2026 |
| CVE-2026-113716 | 4.5 Medium | virtualenv: Builtin creation follows linked environment directories | Oct 20, 2026 |
| CVE-2026-113869 | 5.4 Medium | Use-after-free in S/MIME decryption during a security device password prompt | Oct 20, 2026 |
| CVE-2026-113868 | 5.3 Medium | Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication | Oct 20, 2026 |
| CVE-2026-113867 | 9.1 Critical | Stanza injection in XMPP chat | Oct 20, 2026 |
| CVE-2026-113866 | 5.9 Medium | Account password sent unencrypted during Exchange account setup | Oct 20, 2026 |
| CVE-2026-113712 | 4.8 Medium | Cachet has Stored XSS in Incident Component | Oct 20, 2026 |
| CVE-2026-113714 | 2.3 Low | virtualenv: Downloaded wheel selection and caching precede verification | Oct 20, 2026 |
| CVE-2026-113713 | 4.4 Medium | virtualenv: Temporary app-data can leave dangling seed package links | Oct 20, 2026 |
| CVE-2026-111088 | 6.5 Medium | Stored XSS in the VPN logs monitor | Oct 20, 2026 |
| CVE-2026-113810 | 7.0 High | Stored XSS on SNS Enrollment Portal | Oct 20, 2026 |
| CVE-2026-111767 | 8.6 High | MCP TypeScript SDK: Experimental tasks were not tied to the session that created them | Oct 20, 2026 |
| CVE-2026-100134 | 8.8 High | Acrobat for Edge | Out-of-bounds Write (CWE-787) | Oct 20, 2026 |
| CVE-2026-100132 | 4.3 Medium | Acrobat for Edge | Out-of-bounds Read (CWE-125) | Oct 20, 2026 |
| CVE-2026-113808 | 7.1 High | Stored XSS on SNS Enrollment Portal | Oct 20, 2026 |
| CVE-2026-113643 | 5.3 Medium | EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization | Oct 20, 2026 |
| CVE-2026-97406 | 9.1 Critical | Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting | Oct 20, 2026 |
| CVE-2026-113709 | 9.9 Critical | Argo CD: A Kustomize Helm config home can run commands in the repo-server | Oct 20, 2026 |
| CVE-2026-113708 | 9.9 Critical | Argo CD: A Kustomize remote ref can run commands in the repo-server | Oct 20, 2026 |
| CVE-2026-113672 | 9.9 Critical | Argo CD: A Jsonnet import can read files from the repo-server | Oct 20, 2026 |
| CVE-2026-113802 | 9.3 Critical | Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler | Oct 20, 2026 |
| CVE-2026-111756 | 8.2 High | follow-redirects array-form headers bypass cross-origin credential stripping | Oct 20, 2026 |
| CVE-2026-105772 | 9.1 Critical | Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId | Oct 20, 2026 |
| CVE-2026-113711 | 7.5 High | ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export | Oct 20, 2026 |
| CVE-2026-112861 | 6.3 Medium | WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability | Oct 20, 2026 |
| CVE-2026-113710 | 5.9 Medium | ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing | Oct 20, 2026 |
| CVE-2026-113671 | 4.3 Medium | ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF | Oct 20, 2026 |
| CVE-2026-113669 | 5.3 Medium | ApostropheCMS: Cross-domain session token in URL confers session takeover | Oct 20, 2026 |
| CVE-2026-113667 | 5.3 Medium | ApostropheCMS: CAPTCHA response token not URL-encoded | Oct 20, 2026 |
| CVE-2026-113668 | 5.3 Medium | ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure) | Oct 20, 2026 |
| CVE-2026-113507 | 6.9 Medium | aaPanel common.py GetClientIp access control | Oct 20, 2026 |
| CVE-2026-113666 | 7.1 High | ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service | Oct 20, 2026 |
| CVE-2026-113665 | 3.7 Low | ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints | Oct 20, 2026 |
| CVE-2026-113506 | 9.4 Critical | aaPanel File Manager common.py ExecShell os command injection | Oct 20, 2026 |
| CVE-2026-113664 | 5.3 Medium | ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test | Oct 20, 2026 |
| CVE-2026-113662 | 5.4 Medium | ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document | Oct 20, 2026 |
| CVE-2026-113661 | 5.4 Medium | ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs | Oct 20, 2026 |
| CVE-2026-113660 | 4.3 Medium | ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers | Oct 20, 2026 |
| CVE-2026-113659 | 6.1 Medium | ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users | Oct 20, 2026 |
| CVE-2026-113658 | 7.5 High | ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory | Oct 20, 2026 |
| CVE-2026-92539 | 6.7 Medium | Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise | Oct 20, 2026 |
| CVE-2026-113657 | 3.7 Low | ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) | Oct 20, 2026 |
| CVE-2026-113656 | 5.3 Medium | ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS | Oct 20, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.