Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

401,085 vulnerabilities match.

CVESeveritySummary
CVE-2026-1122826.8 MediumVideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_point
CVE-2026-1122816.9 Mediumlibaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi
CVE-2026-1122806.9 Mediumlibaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body
CVE-2026-1122797.1 Highrdesktop through 1.9.0 Heap Out-of-Bounds Read via process_bmpcache2
CVE-2026-1122787.1 Highrdesktop through 1.9.0 Heap Out-of-Bounds Read via process_raw_bmpcache
CVE-2026-1122777.1 Highrdesktop through 1.9.0 Heap Out-of-Bounds Read via process_plane
CVE-2026-1122766.9 MediumNetpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap
CVE-2026-1122756.9 MediumNetpbm through 11.16.00 Heap Out-of-Bounds Write via rasttopnm pr_load_image
CVE-2026-1122746.3 Mediumlibtins through 4.6 Out-of-Bounds Read via DNS::soa_record::init
CVE-2026-1122736.9 Mediumlibtins through 4.6 Heap Out-of-Bounds Read via DNS::compose_name
CVE-2026-1122726.8 Mediumlibdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parser
CVE-2026-1122716.8 Mediumlibdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser
CVE-2026-1122707.1 HighSGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx
CVE-2026-1122697.1 HighSGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations
CVE-2026-1122685.3 Mediumsglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes
CVE-2026-1122676.9 MediumSGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker
CVE-2026-1122668.2 HighSGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching
CVE-2026-1122658.3 HighLangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification
CVE-2026-1122648.5 HighBentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys
CVE-2026-1122638.5 HighTelevision 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting
CVE-2026-1122627.1 HighRisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors
CVE-2026-1119395.1 MediumFrappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
CVE-2026-1119385.3 MediumFrappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log
CVE-2026-1119375.3 MediumFrappe CRM before 1.81.2 Missing Authorization on CRM Notification Records
CVE-2026-1119365.3 MediumSigma File Manager through 2.2.0 SSRF via Extension Download Commands
CVE-2026-1119352.1 LowNoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis
CVE-2026-1119256.9 MediumMopidy before 4.0.5 Path Traversal via File Backend library.lookup
CVE-2026-1119158.2 HighYank Note before 3.93.1 Path Traversal via /api/help Endpoint
CVE-2026-1118995.3 MediumKitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch
CVE-2026-1118835.3 MediumLocust through 2.46.7 CSRF via Web UI /stop and /stats/reset
CVE-2026-1121456.9 Mediumspeaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn externally-controlled input to select classes or code
CVE-2026-1121446.9 Mediumsatya-vinay Events-Management-System project.sql file access
CVE-2026-1118284.3 MediumWordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability
CVE-2026-1122225.4 MediumWordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability
CVE-2026-1118296.5 MediumWordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability
CVE-2026-1109024.3 MediumWordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability
CVE-2026-1100084.2 Medium@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback
CVE-2026-1121436.9 Mediumsatya-vinay Events-Management-System missing authentication
CVE-2026-81687.1 HighDenial-of-service vulnerability in the SVG parser and renderer impacts Qt
CVE-2026-1121426.9 Mediumsatya-vinay Events-Management-System Registration-Delete dodelete.php sql injection
CVE-2026-1118455.3 MediumWordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability
CVE-2026-1121416.9 Mediumsatya-vinay Events-Management-System Registration-Edit doedit.php mysqli_query sql injection
CVE-2026-1118315.3 MediumWordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability
CVE-2026-1103635.4 MediumWordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability
CVE-2026-1118364.3 MediumWordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerability
CVE-2026-1114146.5 MediumWordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1114106.5 MediumWordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1122146.5 MediumGstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser
CVE-2026-1033147.4 HighStackrox: stackrox: saml response replay allows multiple central authentication tokens
CVE-2026-1118395.3 MediumWordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerability

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.