Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
401,078 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-112361 | 5.3 Medium | Dolibarr CSP document.php protection mechanism | Oct 19, 2026 |
| CVE-2026-112261 | 7.8 High | Gimp: gimp: use-after-free in xcf loader via prop_selected_path | Oct 19, 2026 |
| CVE-2026-112258 | 7.8 High | Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels | Oct 19, 2026 |
| CVE-2026-112257 | 7.8 High | Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033) | Oct 19, 2026 |
| CVE-2026-112892 | 8.7 High | Pillow: MSP RLE decoder expands a tiny file into unbounded memory | Oct 19, 2026 |
| CVE-2026-112891 | 6.9 Medium | Pillow: Quadratic GIF comment copying during save | Oct 19, 2026 |
| CVE-2026-112406 | 8.7 High | Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle | Oct 19, 2026 |
| CVE-2026-112360 | 8.9 High | Netis EAP930 CGI Endpoint debug return200 backdoor | Oct 19, 2026 |
| CVE-2026-112405 | 8.7 High | Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0 | Oct 19, 2026 |
| CVE-2026-112404 | 8.8 High | Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels | Oct 19, 2026 |
| CVE-2026-105815 | 7.1 High | Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210 | Oct 19, 2026 |
| CVE-2026-105814 | 5.3 Medium | Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210 | Oct 19, 2026 |
| CVE-2026-112403 | 9.2 Critical | Pillow: Heap buffer overflow in ImagingJpegDecode | Oct 19, 2026 |
| CVE-2026-112402 | 8.7 High | Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform | Oct 19, 2026 |
| CVE-2026-112397 | 8.7 High | Pillow: Out-of-bounds access in _imagingmorph on a zero-width image | Oct 19, 2026 |
| CVE-2026-112392 | 8.2 High | Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images | Oct 19, 2026 |
| CVE-2026-112401 | 6.9 Medium | Pillow: Quadratic GIF comment concatenation allows DoS in Image.open() | Oct 19, 2026 |
| CVE-2026-112358 | 2.1 Low | TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgery | Oct 19, 2026 |
| CVE-2026-112400 | 8.7 High | Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS | Oct 19, 2026 |
| CVE-2026-112399 | 8.7 High | Pillow: APNG background disposal allocates full canvas before decompression bomb check | Oct 19, 2026 |
| CVE-2026-112398 | 9.2 Critical | Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution | Oct 19, 2026 |
| CVE-2026-53995 | 8.8 High | MLflow 3.17.1 and prior Path Traversal via Trace ID API | Oct 19, 2026 |
| CVE-2026-112396 | 5.9 Medium | Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer | Oct 19, 2026 |
| CVE-2026-112302 | 5.3 Medium | kiwilan php-archive Extraction ArchiveZip.php extract path traversal | Oct 19, 2026 |
| CVE-2026-112395 | 6.5 Medium | Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290) | Oct 19, 2026 |
| CVE-2026-111946 | 5.3 Medium | Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header | Oct 19, 2026 |
| CVE-2026-112394 | 6.3 Medium | Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size | Oct 19, 2026 |
| CVE-2026-112393 | 9.2 Critical | Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO | Oct 19, 2026 |
| CVE-2026-112301 | 6.9 Medium | orbitale imagemagick-php Command.php font os command injection | Oct 19, 2026 |
| CVE-2026-112391 | 6.3 Medium | Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree() | Oct 19, 2026 |
| CVE-2026-76788 | 8.8 High | Stack out-of-bounds write in the OSDP Control Panel reply parser | Oct 19, 2026 |
| CVE-2026-76787 | 5.9 Medium | NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum | Oct 19, 2026 |
| CVE-2026-112390 | 8.2 High | Pillow: Infinite loop in MIC n_frames when the embedded TIFF | Oct 19, 2026 |
| CVE-2026-112300 | 6.9 Medium | DiffSK configobj __init__.py _sectionmarker redos | Oct 19, 2026 |
| CVE-2026-112299 | 5.3 Medium | smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery | Oct 19, 2026 |
| CVE-2026-111766 | 3.7 Low | markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled | Oct 19, 2026 |
| CVE-2026-112297 | 5.3 Medium | ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery | Oct 19, 2026 |
| CVE-2026-71169 | 7.0 High | Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to… | Oct 19, 2026 |
| CVE-2026-82166 | 8.8 High | Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to… | Oct 19, 2026 |
| CVE-2026-71170 | 7.8 High | Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to an Elevation of Privilege and… | Oct 19, 2026 |
| CVE-2026-112254 | 5.3 Medium | agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery | Oct 19, 2026 |
| CVE-2026-112260 | 7.1 High | Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing | Oct 19, 2026 |
| CVE-2026-112782 | 8.7 High | Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service | Oct 19, 2026 |
| CVE-2026-112781 | 8.7 High | Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives | Oct 19, 2026 |
| CVE-2026-112780 | 9.3 Critical | Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@ | Oct 19, 2026 |
| CVE-2026-112779 | 9.3 Critical | Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass | Oct 19, 2026 |
| CVE-2026-112778 | 6.4 Medium | Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations | Oct 19, 2026 |
| CVE-2026-112777 | 8.7 High | Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE | Oct 19, 2026 |
| CVE-2026-112776 | 9.3 Critical | Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations | Oct 19, 2026 |
| CVE-2026-112775 | 8.7 High | Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password | Oct 19, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.