Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
401,056 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-92390 | 7.5 High | -J no-clobber guarantee bypassed with 103 early hints | Oct 20, 2026 |
| CVE-2026-92389 | 8.1 High | TFTP direction confusion | Oct 20, 2026 |
| CVE-2026-92388 | 9.1 Critical | FTP wildcard write callback mixup | Oct 20, 2026 |
| CVE-2026-92387 | 8.1 High | never-ending loop via server response omission | Oct 20, 2026 |
| CVE-2026-101103 | 6.8 Medium | HMS Networks PEAK-System PCAN Windows drivers Classic Buffer Overflow | Oct 20, 2026 |
| CVE-2026-92386 | 8.1 High | server-set cookie aborts cookie jar load | Oct 20, 2026 |
| CVE-2026-87866 | 9.1 Critical | wolfSSL public-key pinning bypass | Oct 20, 2026 |
| CVE-2026-109576 | 6.8 Medium | HMS Networks PEAK-System PCAN Windows drivers Out-of-bounds Write | Oct 20, 2026 |
| CVE-2026-87865 | 7.4 High | knownhost callback mismatches key as missing | Oct 20, 2026 |
| CVE-2026-87863 | 8.1 High | HSTS response erases persisted entries | Oct 20, 2026 |
| CVE-2026-87864 | 8.1 High | IMAP APPEND plus CRLF conversion command injection | Oct 20, 2026 |
| CVE-2026-87862 | 8.1 High | HSTS cache import drops longer-lived child | Oct 20, 2026 |
| CVE-2026-87861 | 9.1 Critical | cross-origin reuse of a Negotiate connection | Oct 20, 2026 |
| CVE-2026-86415 | 7.5 High | auto client cert connection reuse mixup | Oct 20, 2026 |
| CVE-2026-86414 | 9.1 Critical | leaking host credentials to HTTP proxy | Oct 20, 2026 |
| CVE-2026-86413 | 9.1 Critical | Negotiate credentials sent to redirected origin | Oct 20, 2026 |
| CVE-2026-112380 | 9.0 Critical | Missing authorization in the WhatsApp channel in Kiro Crew | Oct 20, 2026 |
| CVE-2026-86412 | 8.1 High | server-set cookie erases cookie jar | Oct 20, 2026 |
| CVE-2026-86411 | 9.1 Critical | FTP connection reuse inherits client-certificate | Oct 20, 2026 |
| CVE-2026-86410 | 8.1 High | redirect to SFTP or SCP bypasses host verification | Oct 20, 2026 |
| CVE-2026-86409 | 8.1 High | stale SigV4 headers sent unintended | Oct 20, 2026 |
| CVE-2026-113725 | 7.8 High | virtualenv bash activate runs commands from an environment name with a backslash before $ | Oct 20, 2026 |
| CVE-2026-113724 | 4.5 Medium | virtualenv: Deletion recovery can change a symlink target's mode | Oct 20, 2026 |
| CVE-2026-113723 | 7.1 High | virtualenv: Bash prompt values can change meaning under older compatibility modes | Oct 20, 2026 |
| CVE-2026-107692 | 4.8 Medium | War Thunder Account Impersonation | Oct 20, 2026 |
| CVE-2026-113722 | 7.8 High | virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax | Oct 20, 2026 |
| CVE-2026-113721 | 4.5 Medium | virtualenv: Generated files can follow existing destination links | Oct 20, 2026 |
| CVE-2026-113720 | 4.4 Medium | virtualenv: Seeded files retain permissions from an older cache | Oct 20, 2026 |
| CVE-2026-113715 | 2.0 Low | virtualenv: Venv configuration readback can reinterpret path boundaries | Oct 20, 2026 |
| CVE-2026-113719 | 4.5 Medium | virtualenv: Seed replacement does not contain metadata deletion paths | Oct 20, 2026 |
| CVE-2026-113718 | 7.1 High | virtualenv: Xonsh activation literals depend on the script decoding codec | Oct 20, 2026 |
| CVE-2026-113717 | 2.3 Low | virtualenv: Pip seeding with download omits wheel digest verification | Oct 20, 2026 |
| CVE-2026-113716 | 4.5 Medium | virtualenv: Builtin creation follows linked environment directories | Oct 20, 2026 |
| CVE-2026-113869 | 5.4 Medium | Use-after-free in S/MIME decryption during a security device password prompt | Oct 20, 2026 |
| CVE-2026-113868 | 5.3 Medium | Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication | Oct 20, 2026 |
| CVE-2026-113867 | 9.1 Critical | Stanza injection in XMPP chat | Oct 20, 2026 |
| CVE-2026-113866 | 5.9 Medium | Account password sent unencrypted during Exchange account setup | Oct 20, 2026 |
| CVE-2026-113712 | 4.8 Medium | Cachet has Stored XSS in Incident Component | Oct 20, 2026 |
| CVE-2026-113714 | 2.3 Low | virtualenv: Downloaded wheel selection and caching precede verification | Oct 20, 2026 |
| CVE-2026-113713 | 4.4 Medium | virtualenv: Temporary app-data can leave dangling seed package links | Oct 20, 2026 |
| CVE-2026-111088 | 6.5 Medium | Stored XSS in the VPN logs monitor | Oct 20, 2026 |
| CVE-2026-113810 | 7.0 High | Stored XSS on SNS Enrollment Portal | Oct 20, 2026 |
| CVE-2026-111767 | 8.6 High | MCP TypeScript SDK: Experimental tasks were not tied to the session that created them | Oct 20, 2026 |
| CVE-2026-100134 | 8.8 High | Acrobat for Edge | Out-of-bounds Write (CWE-787) | Oct 20, 2026 |
| CVE-2026-100132 | 4.3 Medium | Acrobat for Edge | Out-of-bounds Read (CWE-125) | Oct 20, 2026 |
| CVE-2026-113808 | 7.1 High | Stored XSS on SNS Enrollment Portal | Oct 20, 2026 |
| CVE-2026-113643 | 5.3 Medium | EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization | Oct 20, 2026 |
| CVE-2026-97406 | 9.1 Critical | Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting | Oct 20, 2026 |
| CVE-2026-113709 | 9.9 Critical | Argo CD: A Kustomize Helm config home can run commands in the repo-server | Oct 20, 2026 |
| CVE-2026-113708 | 9.9 Critical | Argo CD: A Kustomize remote ref can run commands in the repo-server | Oct 20, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.