Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
401,078 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-43856 | 8.6 High | A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes. | Oct 20, 2026 |
| CVE-2026-43855 | 7.5 High | A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution. | Oct 20, 2026 |
| CVE-2026-43854 | 6.3 Medium | A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices. | Oct 20, 2026 |
| CVE-2026-43853 | 8.2 High | A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash. | Oct 20, 2026 |
| CVE-2026-43852 | 8.2 High | A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system. | Oct 20, 2026 |
| CVE-2026-43851 | 8.2 High | A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system. | Oct 20, 2026 |
| CVE-2026-43850 | 8.6 High | A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system. | Oct 20, 2026 |
| CVE-2026-43849 | 6.9 Medium | A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data. | Oct 20, 2026 |
| CVE-2026-43848 | 6.9 Medium | A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service. | Oct 20, 2026 |
| CVE-2026-43847 | 8.2 High | A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled. | Oct 20, 2026 |
| CVE-2026-43846 | 8.6 High | A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution. | Oct 20, 2026 |
| CVE-2026-43845 | 9.2 Critical | A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism. | Oct 20, 2026 |
| CVE-2026-43844 | 9.3 Critical | A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism. | Oct 20, 2026 |
| CVE-2026-43843 | 6.9 Medium | An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service. | Oct 20, 2026 |
| CVE-2026-43842 | 6.9 Medium | A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0. | Oct 20, 2026 |
| CVE-2026-43841 | 6.9 Medium | A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function. | Oct 20, 2026 |
| CVE-2026-113469 | 7.5 High | Improper Signature Verification of Active Update Files | Oct 20, 2026 |
| CVE-2026-43840 | 6.9 Medium | A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the on_disconnected callback function. | Oct 20, 2026 |
| CVE-2026-43839 | 8.7 High | A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service. | Oct 20, 2026 |
| CVE-2026-101201 | 4.3 Medium | QBinaryJson::fromBinaryData() integer overflow leading to OOB read | Oct 20, 2026 |
| CVE-2026-43838 | 9.2 Critical | A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution. | Oct 20, 2026 |
| CVE-2026-92287 | 8.1 High | Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation | Oct 20, 2026 |
| CVE-2026-43837 | 7.5 High | A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution. | Oct 20, 2026 |
| CVE-2026-11960 | 6.9 Medium | Multiple vulnerabilities in FacturaScripts | Oct 20, 2026 |
| CVE-2026-11959 | 6.9 Medium | Multiple vulnerabilities in FacturaScripts | Oct 20, 2026 |
| CVE-2026-113465 | 6.6 Medium | Possible DOM XSS in SNS Web Administration Portal | Oct 20, 2026 |
| CVE-2026-43836 | 9.3 Critical | A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges. | Oct 20, 2026 |
| CVE-2026-43835 | 8.6 High | A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently. | Oct 20, 2026 |
| CVE-2026-43834 | 7.5 High | A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution. | Oct 20, 2026 |
| CVE-2024-2323 | 4.8 Medium | Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery | Oct 20, 2026 |
| CVE-2026-111090 | 7.8 High | Improper Signature Verification of Firmware Update Files | Oct 20, 2026 |
| CVE-2026-112177 | 7.3 High | Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8 | Oct 20, 2026 |
| CVE-2026-113407 | 8.7 High | YS-infoware｜BA-Workflow - SQL Injection | Oct 20, 2026 |
| CVE-2026-113406 | 8.7 High | YS-infoware｜BA-Workflow - SQL Injection | Oct 20, 2026 |
| CVE-2026-113405 | 8.7 High | YS-infoware｜BA-Workflow - SQL Injection | Oct 20, 2026 |
| CVE-2026-110725 | 3.7 Low | fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references | Oct 20, 2026 |
| CVE-2026-113403 | 7.1 High | ArmorX Global Technology｜ArmorX Spam - Command Injection | Oct 20, 2026 |
| CVE-2026-110306 | 6.1 Medium | fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding | Oct 20, 2026 |
| CVE-2026-110180 | 4.8 Medium | fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization | Oct 20, 2026 |
| CVE-2026-110095 | 3.7 Low | fast-uri vulnerable to improper path equivalence in relative reference normalization | Oct 20, 2026 |
| CVE-2026-93878 | 6.4 Medium | DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action | Oct 20, 2026 |
| CVE-2026-112148 | 5.1 Medium | A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint… | Oct 20, 2026 |
| CVE-2026-113402 | 7.1 High | ArmorX Global Technology｜ArmorX Spam - Local File Inclusion | Oct 20, 2026 |
| CVE-2026-113404 | 8.7 High | Uniong｜WebITR - Insecure Deserialization | Oct 20, 2026 |
| CVE-2026-96903 | 4.3 Medium | Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers | Oct 20, 2026 |
| CVE-2026-96902 | 5.3 Medium | Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API | Oct 20, 2026 |
| CVE-2026-93300 | 7.5 High | EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter | Oct 20, 2026 |
| CVE-2026-97627 | 8.6 High | Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands. | Oct 20, 2026 |
| CVE-2026-100737 | 6.9 Medium | Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized… | Oct 20, 2026 |
| CVE-2026-113386 | 7.1 High | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource… | Oct 20, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.