Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
401,056 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-88041 | 7.5 High | Apache Tomcat: HTTP/2 trailer header cross-contamination | Oct 20, 2026 |
| CVE-2026-80353 | 8.1 High | Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector | Oct 20, 2026 |
| CVE-2026-74049 | 6.1 Medium | Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) | Oct 20, 2026 |
| CVE-2026-74048 | 6.5 Medium | Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up | Oct 20, 2026 |
| CVE-2026-113394 | 5.3 Medium | DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal | Oct 20, 2026 |
| CVE-2026-96406 | 4.9 Medium | VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound | Oct 20, 2026 |
| CVE-2026-113393 | 5.3 Medium | DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload | Oct 20, 2026 |
| CVE-2026-96582 | 4.9 Medium | Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser | Oct 20, 2026 |
| CVE-2026-91041 | 7.8 High | FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image | Oct 20, 2026 |
| CVE-2026-113392 | 5.3 Medium | DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal | Oct 20, 2026 |
| CVE-2026-105941 | 8.1 High | Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname | Oct 20, 2026 |
| CVE-2026-113401 | 6.5 Medium | Denial-of-service in the PDF Viewer component | Oct 20, 2026 |
| CVE-2026-113400 | 5.4 Medium | Uninitialized memory in the Audio/Video: cubeb component | Oct 20, 2026 |
| CVE-2026-113399 | 9.8 Critical | Incorrect boundary conditions in the SVG component | Oct 20, 2026 |
| CVE-2026-113470 | 5.4 Medium | Cryptographic issue in the Security Block-lists, Allow-lists, and other State component | Oct 20, 2026 |
| CVE-2026-113391 | 9.4 Critical | DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection | Oct 20, 2026 |
| CVE-2026-113620 | 9.8 Critical | Eclipse ioFog operator WebSocket accepts an unverified JWT | Oct 20, 2026 |
| CVE-2026-113390 | 9.4 Critical | DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection | Oct 20, 2026 |
| CVE-2026-113619 | 7.5 High | Eclipse ioFog renders request templates before authentication | Oct 20, 2026 |
| CVE-2026-34485 | 7.8 High | A CLI ACL Bypass vulnerability in Nokia 1830 Global Express (GX) | Oct 20, 2026 |
| CVE-2026-34484 | 6.7 Medium | A Shell Privilege Escalation vulnerability in Nokia 1830 Global Express (GX) | Oct 20, 2026 |
| CVE-2026-113389 | 9.4 Critical | DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection | Oct 20, 2026 |
| CVE-2026-113388 | 4.8 Medium | opensource-socialnetwork Cache Settings dynamic.php input code injection | Oct 20, 2026 |
| CVE-2026-113583 | 5.3 Medium | Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js | Oct 20, 2026 |
| CVE-2026-105949 | 8.8 High | Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints | Oct 20, 2026 |
| CVE-2026-105312 | 9.9 Critical | Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation | Oct 20, 2026 |
| CVE-2026-105311 | 7.7 High | Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy | Oct 20, 2026 |
| CVE-2026-18205 | 6.1 Medium | XSS in Ticimax Informatics' Ticimax E-Commerce Platform | Oct 20, 2026 |
| CVE-2026-113385 | 4.8 Medium | LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components | Oct 20, 2026 |
| CVE-2026-113496 | 5.0 Medium | Cockpit-machines: cockpit-appstream: vnc console password disclosure through virt-xml command-line arguments | Oct 20, 2026 |
| CVE-2026-113495 | 5.0 Medium | Cockpit-machines: cockpit-appstream: rhsm access-token disclosure through image helper command-line arguments | Oct 20, 2026 |
| CVE-2026-14933 | 8.6 High | Unblu Spark Cross-Site Scripting in Embedded Co-Browsing | Oct 20, 2026 |
| CVE-2026-9589 | 9.3 Critical | Unblu Spark Authorization Bypass in Configuration Cascade Operations | Oct 20, 2026 |
| CVE-2026-113384 | 5.3 Medium | Optimal IdM OptimalCloud social redirect | Oct 20, 2026 |
| CVE-2026-113383 | 5.3 Medium | Optimal IdM OptimalCloud Login cross site scripting | Oct 20, 2026 |
| CVE-2026-113358 | 8.7 High | LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes | Oct 20, 2026 |
| CVE-2026-113357 | 5.1 Medium | @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker | Oct 20, 2026 |
| CVE-2026-113356 | 7.7 High | DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition | Oct 20, 2026 |
| CVE-2026-113355 | 4.8 Medium | Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links | Oct 20, 2026 |
| CVE-2026-113354 | 7.1 High | Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content | Oct 20, 2026 |
| CVE-2026-113353 | 5.3 Medium | LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers | Oct 20, 2026 |
| CVE-2026-113352 | 7.7 High | uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers | Oct 20, 2026 |
| CVE-2026-113351 | 8.2 High | libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset | Oct 20, 2026 |
| CVE-2026-113350 | 5.1 Medium | react-admin before 5.15.5 Stored XSS via UrlField and FileField | Oct 20, 2026 |
| CVE-2026-113349 | 5.3 Medium | OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent | Oct 20, 2026 |
| CVE-2026-112787 | 5.3 Medium | OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports | Oct 20, 2026 |
| CVE-2026-112786 | 5.3 Medium | OpenCATS before 0.10.0 Missing Authorization via Import Revert Action | Oct 20, 2026 |
| CVE-2026-112785 | 5.3 Medium | OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints | Oct 20, 2026 |
| CVE-2026-112784 | 5.3 Medium | OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php | Oct 20, 2026 |
| CVE-2026-112783 | 5.3 Medium | OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints | Oct 20, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.