Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
401,078 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-113385 | 4.8 Medium | LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components | Oct 20, 2026 |
| CVE-2026-113496 | 5.0 Medium | Cockpit-machines: cockpit-appstream: vnc console password disclosure through virt-xml command-line arguments | Oct 20, 2026 |
| CVE-2026-113495 | 5.0 Medium | Cockpit-machines: cockpit-appstream: rhsm access-token disclosure through image helper command-line arguments | Oct 20, 2026 |
| CVE-2026-14933 | 8.6 High | Unblu Spark Cross-Site Scripting in Embedded Co-Browsing | Oct 20, 2026 |
| CVE-2026-9589 | 9.3 Critical | Unblu Spark Authorization Bypass in Configuration Cascade Operations | Oct 20, 2026 |
| CVE-2026-113384 | 5.3 Medium | Optimal IdM OptimalCloud social redirect | Oct 20, 2026 |
| CVE-2026-113383 | 5.3 Medium | Optimal IdM OptimalCloud Login cross site scripting | Oct 20, 2026 |
| CVE-2026-113358 | 8.7 High | LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes | Oct 20, 2026 |
| CVE-2026-113357 | 5.1 Medium | @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker | Oct 20, 2026 |
| CVE-2026-113356 | 7.7 High | DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition | Oct 20, 2026 |
| CVE-2026-113355 | 4.8 Medium | Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links | Oct 20, 2026 |
| CVE-2026-113354 | 7.1 High | Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content | Oct 20, 2026 |
| CVE-2026-113353 | 5.3 Medium | LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers | Oct 20, 2026 |
| CVE-2026-113352 | 7.7 High | uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers | Oct 20, 2026 |
| CVE-2026-113351 | 8.2 High | libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset | Oct 20, 2026 |
| CVE-2026-113350 | 5.1 Medium | react-admin before 5.15.5 Stored XSS via UrlField and FileField | Oct 20, 2026 |
| CVE-2026-113349 | 5.3 Medium | OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent | Oct 20, 2026 |
| CVE-2026-112787 | 5.3 Medium | OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports | Oct 20, 2026 |
| CVE-2026-112786 | 5.3 Medium | OpenCATS before 0.10.0 Missing Authorization via Import Revert Action | Oct 20, 2026 |
| CVE-2026-112785 | 5.3 Medium | OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints | Oct 20, 2026 |
| CVE-2026-112784 | 5.3 Medium | OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php | Oct 20, 2026 |
| CVE-2026-112783 | 5.3 Medium | OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints | Oct 20, 2026 |
| CVE-2026-108089 | 7.5 High | Apache Cocoon: Unauthenticated access to diagnostic interfaces | Oct 20, 2026 |
| CVE-2026-108088 | 7.5 High | Apache Cocoon: Cross-user cache poisoning | Oct 20, 2026 |
| CVE-2026-108087 | 8.8 High | Apache Cocoon: SQL Injection | Oct 20, 2026 |
| CVE-2026-108086 | 7.5 High | Apache Cocoon: XEE could lead to SSRF and information disclosure | Oct 20, 2026 |
| CVE-2026-113382 | 5.3 Medium | arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload | Oct 20, 2026 |
| CVE-2026-107597 | 5.1 Medium | jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme | Oct 20, 2026 |
| CVE-2026-108062 | 6.9 Medium | Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop | Oct 20, 2026 |
| CVE-2026-111844 | 6.5 Medium | WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability | Oct 20, 2026 |
| CVE-2026-113381 | 6.9 Medium | Osclass Item Model Item.php findUserItems sql injection | Oct 20, 2026 |
| CVE-2026-112069 | 6.3 Medium | Broken Access Control in extension "FAL Protect" (fal_protect) | Oct 20, 2026 |
| CVE-2026-112065 | 5.3 Medium | Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin) | Oct 20, 2026 |
| CVE-2026-112064 | 7.1 High | SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin) | Oct 20, 2026 |
| CVE-2026-112066 | 7.1 High | Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin) | Oct 20, 2026 |
| CVE-2026-112067 | 6.9 Medium | Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha) | Oct 20, 2026 |
| CVE-2026-112068 | 5.3 Medium | Insecure Direct Object Reference in extension "Analytics" (analytics) | Oct 20, 2026 |
| CVE-2026-112237 | 6.9 Medium | Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf) | Oct 20, 2026 |
| CVE-2026-112240 | 6.3 Medium | Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) | Oct 20, 2026 |
| CVE-2026-113442 | 5.3 Medium | Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) | Oct 20, 2026 |
| CVE-2026-112238 | 8.7 High | SQL Injection in extension "File manager" (ameos_filemanager) | Oct 20, 2026 |
| CVE-2026-112071 | 6.9 Medium | Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop) | Oct 20, 2026 |
| CVE-2026-113468 | 6.9 Medium | Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop) | Oct 20, 2026 |
| CVE-2026-112239 | 7.2 High | Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai) | Oct 20, 2026 |
| CVE-2026-113459 | 7.1 High | Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai) | Oct 20, 2026 |
| CVE-2026-112070 | 5.3 Medium | Broken Access Control in extension "Analytics" (analytics) | Oct 20, 2026 |
| CVE-2026-113378 | 4.8 Medium | mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection | Oct 20, 2026 |
| CVE-2026-43858 | 8.6 High | A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution. | Oct 20, 2026 |
| CVE-2026-43857 | 8.6 High | A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service. | Oct 20, 2026 |
| CVE-2026-85267 | 8.7 High | Cross-Site WebSocket Hijacking in Google Cloud Shell | Oct 20, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.