Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
401,056 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-113680 | 6.8 Medium | HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS | Oct 20, 2026 |
| CVE-2026-113679 | 7.3 High | HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string | Oct 20, 2026 |
| CVE-2026-113678 | 9.4 Critical | Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron | Oct 20, 2026 |
| CVE-2026-113677 | 5.3 Medium | Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API | Oct 20, 2026 |
| CVE-2026-113676 | 5.3 Medium | Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API | Oct 20, 2026 |
| CVE-2026-113613 | 9.2 Critical | FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin | Oct 20, 2026 |
| CVE-2026-113612 | 5.3 Medium | SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint | Oct 20, 2026 |
| CVE-2026-113611 | 6.9 Medium | Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions | Oct 20, 2026 |
| CVE-2026-113610 | 5.3 Medium | Xen Orchestra before 6.9.0 Authorization Bypass via user.set API | Oct 20, 2026 |
| CVE-2026-113609 | 4.8 Medium | Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts | Oct 20, 2026 |
| CVE-2026-113608 | 6.0 Medium | Configurable Reports block for Moodle before 5.3.1 SQL Injection via filter_var | Oct 20, 2026 |
| CVE-2026-113607 | 7.1 High | Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data | Oct 20, 2026 |
| CVE-2026-113606 | 7.1 High | Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders | Oct 20, 2026 |
| CVE-2026-113605 | 8.6 High | Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database | Oct 20, 2026 |
| CVE-2026-113604 | 6.8 Medium | Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts | Oct 20, 2026 |
| CVE-2026-113603 | 6.9 Medium | x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource | Oct 20, 2026 |
| CVE-2026-113602 | 6.9 Medium | json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character | Oct 20, 2026 |
| CVE-2026-113601 | 5.3 Medium | Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity | Oct 20, 2026 |
| CVE-2026-113600 | 5.3 Medium | Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy | Oct 20, 2026 |
| CVE-2026-113599 | 5.3 Medium | Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation | Oct 20, 2026 |
| CVE-2026-113598 | 5.3 Medium | Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete | Oct 20, 2026 |
| CVE-2026-113597 | 5.3 Medium | Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures | Oct 20, 2026 |
| CVE-2026-113596 | 2.3 Low | Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds | Oct 20, 2026 |
| CVE-2026-113595 | 5.3 Medium | Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route | Oct 20, 2026 |
| CVE-2026-113594 | 5.3 Medium | Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route | Oct 20, 2026 |
| CVE-2026-113359 | 5.3 Medium | Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint | Oct 20, 2026 |
| CVE-2025-71436 | 7.1 High | Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag | Oct 20, 2026 |
| CVE-2026-90799 | 1.3 Low | Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values | Oct 20, 2026 |
| CVE-2026-90798 | 0.6 Low | Apache CouchDB: Replicator follows redirects indefinitely | Oct 20, 2026 |
| CVE-2026-90797 | 7.7 High | Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session | Oct 20, 2026 |
| CVE-2026-86471 | 9.3 Critical | Apache CouchDB: Admin credentials leading to code execution as operating system user | Oct 20, 2026 |
| CVE-2026-112951 | 5.4 Medium | ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix | Oct 20, 2026 |
| CVE-2026-93003 | 6.9 Medium | NetX Duo Web HTTP server interprets request body content as HTTP header fields | Oct 20, 2026 |
| CVE-2026-112950 | 5.9 Medium | Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix | Oct 20, 2026 |
| CVE-2026-95107 | 7.0 High | Module object allocation size overflow corrupts the manager object pool | Oct 20, 2026 |
| CVE-2026-94202 | 4.8 Medium | Module block-pool create validates two of the four parameter words it reads | Oct 20, 2026 |
| CVE-2026-95108 | 6.8 Medium | Deleting a user-mode module thread leaks its privileged kernel stack | Oct 20, 2026 |
| CVE-2026-112949 | 4.7 Medium | Vitest: Code injection via unauthenticated manual mock registration | Oct 20, 2026 |
| CVE-2026-94024 | 6.9 Medium | Module Manager object lookup validates one byte of a module's search name | Oct 20, 2026 |
| CVE-2026-94023 | 6.9 Medium | Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion | Oct 20, 2026 |
| CVE-2026-95109 | 8.5 High | Cortex-A7 module data validation checks only the first address of a caller-supplied range | Oct 20, 2026 |
| CVE-2026-94192 | 8.5 High | Module object deallocation can free a live ThreadX kernel object | Oct 20, 2026 |
| CVE-2026-112948 | 6.5 Medium | Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file | Oct 20, 2026 |
| CVE-2026-112823 | 4.3 Medium | WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability | Oct 20, 2026 |
| CVE-2026-112824 | 5.3 Medium | WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability | Oct 20, 2026 |
| CVE-2026-92843 | 8.7 High | Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure | Oct 20, 2026 |
| CVE-2026-111843 | 6.5 Medium | WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability | Oct 20, 2026 |
| CVE-2026-112829 | 5.3 Medium | WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability | Oct 20, 2026 |
| CVE-2026-112840 | 6.5 Medium | WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability | Oct 20, 2026 |
| CVE-2026-111765 | 7.5 High | A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix | Oct 20, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.