Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,206 vulnerabilities match.

CVESeveritySummary
CVE-2026-1186526.1 MediumEcho: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
CVE-2026-1154155.9 MediumSecret masking bypass in the environment tool in Strands Agents Tools
CVE-2026-1186515.3 MediumEcho: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
CVE-2026-631909.4 CriticalFearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
CVE-2026-1186507.5 HighEcho: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
CVE-2026-1182665.3 MediumEcho: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
CVE-2026-786748.8 HighRemote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution
CVE-2026-66477.4 HighIncomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events
CVE-2026-35833.1 LowImproper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
CVE-2026-118546.1 MediumCross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
CVE-2025-142608.3 HighServer Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
CVE-2026-1094118.1 HighSamba: access control bypass via vfs_ceph_rgw case-insensitive open
CVE-2026-1182655.3 MediumEcho: X-Real-IP extractor trusts the header value instead of the sending peer
CVE-2026-1182649.1 CriticalEcho: Rejected WebSocket upgrades can bypass Echo route-level access controls
CVE-2026-1182636.3 MediumEcho: BodyDump can discard BodyLimit overflow errors for unknown-length requests
CVE-2026-1182628.2 HighEcho: WebSocket proxy can retain connections and handlers after client disconnect
CVE-2026-1186888.8 HighWasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename
CVE-2026-1186878.3 HighCoder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication
CVE-2026-1186868.7 HighEspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex
CVE-2026-1186856.9 MediumToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard
CVE-2026-1186848.2 HighMONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads
CVE-2026-1186838.6 HighMONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf
CVE-2026-1186816.3 Mediumgo-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware
CVE-2026-1186805.9 MediumSiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias
CVE-2026-1186796.9 Mediumn8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger
CVE-2026-1186787.1 Highn8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction
CVE-2026-1186775.9 Mediumn8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance
CVE-2026-1186765.1 Mediumn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass
CVE-2026-1186755.1 Mediumn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow
CVE-2026-1186498.7 Highn8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables
CVE-2026-1186488.4 Highn8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy
CVE-2026-1186475.3 Mediumn8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data
CVE-2026-1186467.1 Highn8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node
CVE-2026-1186457.0 Highn8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter
CVE-2026-1186445.1 Mediumn8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance
CVE-2026-1186435.3 Mediumn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data
CVE-2026-1186425.1 Mediumn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows
CVE-2026-1186416.9 Mediumn8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes
CVE-2026-1186405.3 Mediumn8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass
CVE-2026-1182618.2 HighEcho: Decompress permits unbounded gzip expansion in v4
CVE-2026-1182608.2 HighEcho: BodyDump captures request and response bodies without size limits in v4
CVE-2026-1182595.3 Mediumopentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing
CVE-2026-1186339.2 CriticalA path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is…
CVE-2026-1182583.7 Lowi18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
CVE-2026-1182577.2 HighVue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
CVE-2026-1182562.1 LowVue I18n: `escapeParameter` does not escape named values when the same call also passes a list
CVE-2026-1182558.4 HighHighcharts Grid: javascript: URL in credits.href runs script on click
CVE-2026-1182548.6 HighHighcharts Grid: pagination language options are parsed as HTML
CVE-2026-1182538.4 HighHighcharts Dashboards: fullscreen labels are parsed as HTML
CVE-2026-1182528.4 HighHighcharts Dashboards: sidebar component labels are parsed as HTML

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.