Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
401,056 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-113672 | 9.9 Critical | Argo CD: A Jsonnet import can read files from the repo-server | Oct 20, 2026 |
| CVE-2026-113802 | 9.3 Critical | Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler | Oct 20, 2026 |
| CVE-2026-111756 | 8.2 High | follow-redirects array-form headers bypass cross-origin credential stripping | Oct 20, 2026 |
| CVE-2026-105772 | 9.1 Critical | Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId | Oct 20, 2026 |
| CVE-2026-113711 | 7.5 High | ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export | Oct 20, 2026 |
| CVE-2026-112861 | 6.3 Medium | WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability | Oct 20, 2026 |
| CVE-2026-113710 | 5.9 Medium | ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing | Oct 20, 2026 |
| CVE-2026-113671 | 4.3 Medium | ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF | Oct 20, 2026 |
| CVE-2026-113669 | 5.3 Medium | ApostropheCMS: Cross-domain session token in URL confers session takeover | Oct 20, 2026 |
| CVE-2026-113667 | 5.3 Medium | ApostropheCMS: CAPTCHA response token not URL-encoded | Oct 20, 2026 |
| CVE-2026-113668 | 5.3 Medium | ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure) | Oct 20, 2026 |
| CVE-2026-113507 | 6.9 Medium | aaPanel common.py GetClientIp access control | Oct 20, 2026 |
| CVE-2026-113666 | 7.1 High | ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service | Oct 20, 2026 |
| CVE-2026-113665 | 3.7 Low | ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints | Oct 20, 2026 |
| CVE-2026-113506 | 9.4 Critical | aaPanel File Manager common.py ExecShell os command injection | Oct 20, 2026 |
| CVE-2026-113664 | 5.3 Medium | ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test | Oct 20, 2026 |
| CVE-2026-113662 | 5.4 Medium | ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document | Oct 20, 2026 |
| CVE-2026-113661 | 5.4 Medium | ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs | Oct 20, 2026 |
| CVE-2026-113660 | 4.3 Medium | ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers | Oct 20, 2026 |
| CVE-2026-113659 | 6.1 Medium | ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users | Oct 20, 2026 |
| CVE-2026-113658 | 7.5 High | ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory | Oct 20, 2026 |
| CVE-2026-92539 | 6.7 Medium | Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise | Oct 20, 2026 |
| CVE-2026-113657 | 3.7 Low | ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) | Oct 20, 2026 |
| CVE-2026-113656 | 5.3 Medium | ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS | Oct 20, 2026 |
| CVE-2026-113649 | 6.5 Medium | ApostropheCMS: Import API bypasses publication roles for protected content | Oct 20, 2026 |
| CVE-2026-113655 | 4.3 Medium | ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization | Oct 20, 2026 |
| CVE-2026-113654 | 5.3 Medium | ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render | Oct 20, 2026 |
| CVE-2026-113653 | 6.9 Medium | ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) | Oct 20, 2026 |
| CVE-2026-113652 | 5.6 Medium | ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true) | Oct 20, 2026 |
| CVE-2026-28330 | 4.6 Medium | SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability | Oct 20, 2026 |
| CVE-2026-28329 | 6.4 Medium | SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF) | Oct 20, 2026 |
| CVE-2026-113651 | 3.3 Low | ApostropheCMS: Path traversal in uploadfs | Oct 20, 2026 |
| CVE-2026-113650 | 5.3 Medium | ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) | Oct 20, 2026 |
| CVE-2026-28328 | 8.8 High | SolarWinds Observability Self-Hosted broken authorization schema | Oct 20, 2026 |
| CVE-2026-113505 | 5.3 Medium | aaPanel Download Endpoint v2.py send_file path traversal | Oct 20, 2026 |
| CVE-2026-28331 | 4.4 Medium | SolarWinds Patch Manager Sensitive Information Exposure Vulnerability | Oct 20, 2026 |
| CVE-2026-113648 | 3.1 Low | ApostropheCMS: Missing Authentication in `cleanExport` Route | Oct 20, 2026 |
| CVE-2026-112958 | 5.4 Medium | ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization | Oct 20, 2026 |
| CVE-2026-112957 | 4.3 Medium | ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users | Oct 20, 2026 |
| CVE-2026-112956 | 6.5 Medium | ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content | Oct 20, 2026 |
| CVE-2026-113703 | 9.1 Critical | SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing | Oct 20, 2026 |
| CVE-2026-112955 | 6.5 Medium | ApostropheCMS: Import archives can exhaust server storage and deny service | Oct 20, 2026 |
| CVE-2026-112954 | 5.3 Medium | ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API | Oct 20, 2026 |
| CVE-2026-112953 | 6.0 Medium | ApostropheCMS: Exposure of Sensitive Information via predictable export filenames | Oct 20, 2026 |
| CVE-2026-112952 | 4.3 Medium | ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user | Oct 20, 2026 |
| CVE-2026-107755 | 6.0 Medium | Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs | Oct 20, 2026 |
| CVE-2026-90800 | 8.1 High | Apache CouchDB: Auth bypass in prefixed _users and _replicator databases | Oct 20, 2026 |
| CVE-2026-113683 | 5.1 Medium | VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename | Oct 20, 2026 |
| CVE-2026-113682 | 9.1 Critical | Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password | Oct 20, 2026 |
| CVE-2026-113681 | 6.8 Medium | OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader Heap Out-of-Bounds Read | Oct 20, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.