Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

401,085 vulnerabilities match.

CVESeveritySummary
CVE-2026-1110566.9 MediumFOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
CVE-2026-1121587.1 HighMikroTik RouterOS ipt_SAME.ko same_check integer overflow
CVE-2026-1110536.9 MediumFOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists
CVE-2026-1110462.3 LowFOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions
CVE-2026-1123688.2 HighUnbounded Recursion in phongo_bson_visit_document/visit_array:
CVE-2026-1121572.3 LowMemTensor memmy-agent Memory Service http.ts requireAdminWrite resource consumption
CVE-2026-1110457.5 HighCLI Bridge: High-severity sandbox escape via dangling symlink
CVE-2026-122546.4 MediumNetskope Client Captive Portal WebView Persistence allowing SWG bypass issue
CVE-2026-1075717.8 HighIncorrect Default Permissions in hMailServer
CVE-2026-1075697.5 HighUnchecked Input for Loop Condition in hMailServer
CVE-2026-1075666.5 MediumMissing Authorization in hMailServer
CVE-2026-1075686.5 MediumMissing Authorization in hMailServer
CVE-2026-1075677.5 HighUse of Less Trusted Source in hMailServer
CVE-2026-1121536.9 Mediumvraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection
CVE-2026-1123668.7 HighPicomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns
CVE-2026-1123636.9 MediumCrawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo
CVE-2026-1123105.3 Mediumdocling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRef
CVE-2026-1123098.7 High@rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methods
CVE-2026-1123088.3 Highcrewai-tools through 1.15.28 SSRF via SeleniumScrapingTool
CVE-2026-1123078.4 Highsqlparse through 0.6.0 PHP Code Injection via output_format='php'
CVE-2026-1123068.6 HighNocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields
CVE-2026-1123058.7 HighSemaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override
CVE-2026-1123047.7 HighdocTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()
CVE-2026-1123035.3 MediumGDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs
CVE-2026-1121526.9 Mediumvraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection
CVE-2026-1094336.0 MediumCamunda Broken Access Control via Cockpit
CVE-2026-1094329.3 CriticalCamunda Expression Injection via orQueries RCE
CVE-2026-1094318.6 HighCamunda Missing Authorization in Task Sub-Resources
CVE-2026-1121516.9 Mediumvraj404 Criminal Management System Submission Form home.php sql injection
CVE-2026-863756.2 MediumDell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized…
CVE-2026-1123295.3 MediumSensei LMS 4.26.4 Broken Access Control via save_new_message
CVE-2026-1121506.9 Mediumvraj404 Criminal-Management-System search.php sql injection
CVE-2026-1123285.3 MediumSensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX
CVE-2026-1121496.9 Mediumvraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload
CVE-2026-1121476.9 Mediumai-genius-automations octoally index.ts information disclosure
CVE-2026-1121465.3 MediumD-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials
CVE-2026-1122969.3 CriticalFlyCms through commit edfdf724 Default Super Administrator Credentials
CVE-2026-1122955.3 MediumFlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update
CVE-2026-1122945.3 MediumFlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint
CVE-2026-1122935.3 MediumBoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API
CVE-2026-1122929.3 CriticalCheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules
CVE-2026-1122916.9 MediumFlarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API
CVE-2026-1122902.3 LowMI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item
CVE-2026-1122895.1 MediumKoalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin
CVE-2026-1122882.1 LowKrayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding
CVE-2026-1122877.1 HighKrayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module
CVE-2026-1122867.1 HighKrayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints
CVE-2026-1122855.3 MediumThelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders
CVE-2026-1122844.8 Mediumlibaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGR
CVE-2026-1122836.8 Mediumlibbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_points

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.