Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

401,078 vulnerabilities match.

CVESeveritySummary
CVE-2026-1117506.3 MediumAIOHTTP: Pure-Python parser request smuggling
CVE-2026-1117492.3 LowAIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
CVE-2026-1117486.3 MediumAIOHTTP: Absolute-form request targets can spoof Request.scheme
CVE-2026-1121955.1 MediumFusionPBX Dialplan Editor dialplan.php os command injection
CVE-2026-1110668.2 HighAIOHTTP: File descriptor exhaustion in multipart requests
CVE-2024-44122.7 LowExpression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
CVE-2026-1110656.9 MediumAIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2025-131736.5 MediumImproper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
CVE-2026-1110648.2 Highaiohttp server lacks an initial request/header timeout
CVE-2025-135915.3 MediumUsername Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery
CVE-2026-1121936.3 MediumWebkul Aureus ERP UserForm.php weak password
CVE-2026-1110636.3 MediumAIOHTTP: Secure attribute not enforced for shared cookie
CVE-2026-145116.5 MediumIBM MQ Denial of Service
CVE-2026-105728.8 HighIBM MQ Buffer Overflow
CVE-2026-105748.8 HighIBM MQ Buffer Overflow
CVE-2026-107438.8 HighIBM MQ Race Condition
CVE-2026-118285.9 MediumIBM MQ Buffer Overflow
CVE-2026-118296.5 MediumIBM MQ Buffer Overflow
CVE-2026-118315.4 MediumIBM MQ Heap-based Buffer Overflow
CVE-2026-121487.5 HighIBM MQ Deserialization of Untrusted Data
CVE-2026-121556.5 MediumIBM MQ Deserialization of Untrusted Data
CVE-2026-123436.5 MediumIBM MQ Denial of Service
CVE-2026-123506.5 MediumIBM MQ Deserialization of Untrusted Data
CVE-2025-101498.2 HighArbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover
CVE-2026-126602.7 LowIBM MQ Path Traversal
CVE-2026-126658.1 HighIBM MQ Buffer Overflow
CVE-2026-126693.1 LowIBM MQ Out-of-bounds Read
CVE-2026-127274.3 MediumIBM MQ Buffer Overflow
CVE-2026-126705.3 MediumIBM MQ Denial of Service
CVE-2025-72034.9 MediumSensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials
CVE-2026-1071889.6 CriticalEptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
CVE-2026-1118629.8 CriticalRank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code
CVE-2026-1071878.5 HighEptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables
CVE-2026-1071868.6 HighEptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse
CVE-2026-1110614.3 Mediumrussh agent server converts constraint records into unbounded never-rolled-back tasks
CVE-2026-1121906.9 MediumWebkul Aureus ERP composer.json insertion of sensitive information into debugging code
CVE-2025-70435.4 MediumRefresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption
CVE-2025-66234.3 MediumStored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
CVE-2026-1121595.1 MediumJumpServer Template Rendering os command injection
CVE-2026-1030388.6 HighPingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host
CVE-2026-1110596.1 MediumMercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
CVE-2026-1110589.8 CriticalMercury: Unauthenticated Remote Code Execution via /api/kernels
CVE-2026-11105710.0 CriticalMercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
CVE-2026-1110566.9 MediumFOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
CVE-2026-1121587.1 HighMikroTik RouterOS ipt_SAME.ko same_check integer overflow
CVE-2026-1110536.9 MediumFOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists
CVE-2026-1110462.3 LowFOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions
CVE-2026-1123688.2 HighUnbounded Recursion in phongo_bson_visit_document/visit_array:
CVE-2026-1121572.3 LowMemTensor memmy-agent Memory Service http.ts requireAdminWrite resource consumption
CVE-2026-1110457.5 HighCLI Bridge: High-severity sandbox escape via dangling symlink

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.