Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
401,078 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-112774 | 8.7 High | Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout | Oct 19, 2026 |
| CVE-2026-112773 | 8.7 High | Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection | Oct 19, 2026 |
| CVE-2026-112772 | 8.7 High | Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection | Oct 19, 2026 |
| CVE-2026-112771 | 7.1 High | Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters | Oct 19, 2026 |
| CVE-2026-112770 | 8.7 High | Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable | Oct 19, 2026 |
| CVE-2026-112769 | 2.3 Low | Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass | Oct 19, 2026 |
| CVE-2026-112768 | 6.9 Medium | Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update | Oct 19, 2026 |
| CVE-2026-112252 | 6.9 Medium | Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx xp_cmdshell sql injection | Oct 19, 2026 |
| CVE-2026-112259 | 5.5 Medium | Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import | Oct 19, 2026 |
| CVE-2026-112251 | 5.3 Medium | antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect | Oct 19, 2026 |
| CVE-2026-109437 | 9.2 Critical | Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend | Oct 19, 2026 |
| CVE-2026-112249 | 4.8 Medium | grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting | Oct 19, 2026 |
| CVE-2026-109434 | 5.1 Medium | Sleipnir Browser < 3.9.0 Fullscreen Address Bar Spoofing | Oct 19, 2026 |
| CVE-2026-110688 | 7.5 High | Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse | Oct 19, 2026 |
| CVE-2026-110687 | 7.5 High | Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp | Oct 19, 2026 |
| CVE-2026-110686 | 6.5 Medium | Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv | Oct 19, 2026 |
| CVE-2026-110685 | 9.1 Critical | Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag | Oct 19, 2026 |
| CVE-2026-110684 | 8.1 High | Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify | Oct 19, 2026 |
| CVE-2026-110682 | 7.5 High | Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse | Oct 19, 2026 |
| CVE-2026-110681 | 8.1 High | Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread | Oct 19, 2026 |
| CVE-2026-110680 | 7.5 High | Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv | Oct 19, 2026 |
| CVE-2026-110678 | 7.5 High | Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse | Oct 19, 2026 |
| CVE-2026-110677 | 7.5 High | Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv | Oct 19, 2026 |
| CVE-2026-110676 | 7.5 High | Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum | Oct 19, 2026 |
| CVE-2026-110675 | 8.1 High | Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv | Oct 19, 2026 |
| CVE-2026-110674 | 6.5 Medium | Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv | Oct 19, 2026 |
| CVE-2026-110673 | 7.5 High | Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag | Oct 19, 2026 |
| CVE-2026-110672 | 7.5 High | Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv | Oct 19, 2026 |
| CVE-2026-112248 | 5.1 Medium | grandnode grandnode2 Excel Import ProductImportDataObject.PrepareProductPictures path traversal | Oct 19, 2026 |
| CVE-2026-11319 | 6.9 Medium | TickTick Android 8.2.2.0 Path Traversal via ShareReceiveActivity | Oct 19, 2026 |
| CVE-2026-55644 | 5.1 Medium | Element X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may grant mic/camera to that origin | Oct 19, 2026 |
| CVE-2026-105810 | 8.5 High | Authenticated Local Stack Overflow in TP-Link Tapo C320WS | Oct 19, 2026 |
| CVE-2023-38375 | 6.1 Medium | IBM Cloud Pak System Cross-Site Scripting | Oct 19, 2026 |
| CVE-2026-3161 | 5.9 Medium | IBM Cloud Pak System Risky Cryptographic Algorithm | Oct 19, 2026 |
| CVE-2026-3295 | 7.4 High | IBM Cloud Pak System Cross-Site Scripting | Oct 19, 2026 |
| CVE-2026-4418 | 5.4 Medium | IBM Cloud Pak System HTML Injection | Oct 19, 2026 |
| CVE-2026-111759 | 7.5 High | markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes | Oct 19, 2026 |
| CVE-2026-111757 | 5.3 Medium | Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths | Oct 19, 2026 |
| CVE-2026-111755 | 8.2 High | follow-redirects sensitiveHeaders regex escaping can expose credential headers | Oct 19, 2026 |
| CVE-2026-112377 | 9.1 Critical | CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack | Oct 19, 2026 |
| CVE-2026-1501 | 3.7 Low | IBM Concert Software Improper Certificate Validation | Oct 19, 2026 |
| CVE-2026-1510 | 4.7 Medium | IBM Concert Software Improper Clearing of Heap Memory | Oct 19, 2026 |
| CVE-2026-3303 | 3.7 Low | IBM Concert Software Permissive Cross-domain Security Policy | Oct 19, 2026 |
| CVE-2026-3628 | 5.3 Medium | IBM Concert Software Information Disclosure | Oct 19, 2026 |
| CVE-2026-4405 | 4.0 Medium | IBM Concert Software Use of Web Browser Cache Containing Sensitive Information | Oct 19, 2026 |
| CVE-2026-4413 | 6.1 Medium | IBM Concert Software Cross-Site Scripting | Oct 19, 2026 |
| CVE-2026-6719 | 7.5 High | IBM Concert Software Use of Insufficiently Random Values | Oct 19, 2026 |
| CVE-2026-112247 | 5.3 Medium | Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting | Oct 19, 2026 |
| CVE-2026-6930 | 3.7 Low | IBM Concert Software Risky Cryptographic Algorithm | Oct 19, 2026 |
| CVE-2026-15661 | 5.3 Medium | IBM Concert Software Improper Output Neutralization for Logs | Oct 19, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.