Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
401,056 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-112947 | 6.3 Medium | Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` | Oct 20, 2026 |
| CVE-2026-112836 | 8.8 High | WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability | Oct 20, 2026 |
| CVE-2026-92853 | 8.7 High | Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure | Oct 20, 2026 |
| CVE-2026-94018 | 8.8 High | NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path | Oct 20, 2026 |
| CVE-2026-109700 | 6.5 Medium | WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability | Oct 20, 2026 |
| CVE-2026-111764 | 7.5 High | A2A Java SDK has a fail-open default task authorization | Oct 20, 2026 |
| CVE-2026-93475 | 9.3 Critical | Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509 | Oct 20, 2026 |
| CVE-2026-112946 | 6.3 Medium | Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine | Oct 20, 2026 |
| CVE-2026-111763 | 5.7 Medium | A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect | Oct 20, 2026 |
| CVE-2026-91057 | 4.6 Medium | Out-of-bounds read when a multi-line text view string ends with a carriage return | Oct 20, 2026 |
| CVE-2026-112945 | 2.1 Low | Vite: Cross origin script execution through Vite custom middleware | Oct 20, 2026 |
| CVE-2026-92454 | 6.8 Medium | JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode | Oct 20, 2026 |
| CVE-2026-112944 | 6.3 Medium | launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors | Oct 20, 2026 |
| CVE-2026-111762 | 5.7 Medium | A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure | Oct 20, 2026 |
| CVE-2026-111761 | 5.8 Medium | A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery | Oct 20, 2026 |
| CVE-2026-91059 | 6.8 Medium | JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size | Oct 20, 2026 |
| CVE-2026-112834 | 5.3 Medium | WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Broken Access Control vulnerability | Oct 20, 2026 |
| CVE-2026-91189 | 7.1 High | GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme | Oct 20, 2026 |
| CVE-2026-112943 | 6.3 Medium | launch-editor: escapeCmdArgs() omits % escaping on Windows | Oct 20, 2026 |
| CVE-2026-112833 | 6.5 Medium | WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability | Oct 20, 2026 |
| CVE-2026-92446 | 6.8 Medium | GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader | Oct 20, 2026 |
| CVE-2026-92449 | 6.8 Medium | Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena | Oct 20, 2026 |
| CVE-2026-112942 | 7.5 High | launch-editor: `fs.existsSync()` existence check can be bypassed on Windows | Oct 20, 2026 |
| CVE-2026-91186 | 8.4 High | PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write | Oct 20, 2026 |
| CVE-2026-113466 | 6.9 Medium | MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key | Oct 20, 2026 |
| CVE-2026-112941 | 3.3 Low | filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock | Oct 20, 2026 |
| CVE-2026-112940 | 7.1 High | filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files | Oct 20, 2026 |
| CVE-2026-92162 | 7.2 High | Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream | Oct 20, 2026 |
| CVE-2026-112939 | 4.7 Medium | filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker | Oct 20, 2026 |
| CVE-2026-112937 | 6.1 Medium | filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name | Oct 20, 2026 |
| CVE-2026-95111 | 4.8 Medium | Module queue front-send validates a word count as a byte count | Oct 20, 2026 |
| CVE-2026-112936 | 6.1 Medium | filelock: ReadWriteLock follows a symlink at the lock path into SQLite | Oct 20, 2026 |
| CVE-2026-112935 | 4.7 Medium | filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders | Oct 20, 2026 |
| CVE-2026-96402 | 5.2 Medium | USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count | Oct 20, 2026 |
| CVE-2026-112934 | 6.1 Medium | filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record | Oct 20, 2026 |
| CVE-2026-113411 | 5.3 Medium | Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme | Oct 20, 2026 |
| CVE-2026-112915 | 5.5 Medium | filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout | Oct 20, 2026 |
| CVE-2026-112914 | 5.3 Medium | filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory | Oct 20, 2026 |
| CVE-2026-112912 | 2.5 Low | filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker | Oct 20, 2026 |
| CVE-2026-112911 | 6.3 Medium | filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion | Oct 20, 2026 |
| CVE-2026-112909 | 6.1 Medium | filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path | Oct 20, 2026 |
| CVE-2026-113397 | 5.3 Medium | DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection | Oct 20, 2026 |
| CVE-2026-112906 | 4.7 Medium | filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse | Oct 20, 2026 |
| CVE-2026-97400 | 6.8 Medium | jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader) | Oct 20, 2026 |
| CVE-2026-113396 | 5.3 Medium | DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection | Oct 20, 2026 |
| CVE-2026-103119 | 9.1 Critical | Apache Tomcat: AJP response mix-up | Oct 20, 2026 |
| CVE-2026-101356 | 9.1 Critical | Apache Tomcat: HTTP/2 request/response mix-up after error during async processing | Oct 20, 2026 |
| CVE-2026-101296 | 9.1 Critical | Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms | Oct 20, 2026 |
| CVE-2026-113395 | 5.3 Medium | DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal | Oct 20, 2026 |
| CVE-2026-93446 | 7.5 High | Apache Tomcat: Possible TLS 1.3 connection failures | Oct 20, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.