Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
401,085 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-112199 | 6.5 Medium | WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerability | Oct 19, 2026 |
| CVE-2026-112140 | 5.3 Medium | llSourcell Doctor-Dignity chat_module.py _get_lib_module code injection | Oct 19, 2026 |
| CVE-2026-112139 | 6.9 Medium | subhajitkhan online-clinic-management-system Administrative Mutation admindocview.php sql injection | Oct 19, 2026 |
| CVE-2026-112210 | 6.0 Medium | Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service | Oct 19, 2026 |
| CVE-2026-112138 | 5.1 Medium | diem-project diem dmCodeEditor actions.class.php join path traversal | Oct 19, 2026 |
| CVE-2026-112108 | 5.3 Medium | ztxz16 fastllm String Parsing gguf.cpp ReadString buffer overflow | Oct 19, 2026 |
| CVE-2026-88900 | 8.8 High | Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution | Oct 19, 2026 |
| CVE-2026-112107 | 5.3 Medium | ztxz16 fastllm Safetensors Weight Loading model.cpp CreateBuffer buffer overflow | Oct 19, 2026 |
| CVE-2026-91858 | 6.5 Medium | Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present | Oct 19, 2026 |
| CVE-2026-112106 | 6.3 Medium | TufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validation | Oct 19, 2026 |
| CVE-2026-88901 | 8.2 High | Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default | Oct 19, 2026 |
| CVE-2026-85317 | 4.8 Medium | Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache | Oct 19, 2026 |
| CVE-2026-85316 | 4.8 Medium | Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching | Oct 19, 2026 |
| CVE-2026-85315 | 5.3 Medium | Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions | Oct 19, 2026 |
| CVE-2026-85314 | 6.5 Medium | Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584) | Oct 19, 2026 |
| CVE-2026-85313 | 4.3 Medium | Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set | Oct 19, 2026 |
| CVE-2026-85312 | 4.8 Medium | Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header | Oct 19, 2026 |
| CVE-2026-85300 | 5.5 Medium | Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions | Oct 19, 2026 |
| CVE-2026-85301 | 4.8 Medium | Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim | Oct 19, 2026 |
| CVE-2026-85296 | 6.5 Medium | Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State | Oct 19, 2026 |
| CVE-2026-85260 | 5.5 Medium | Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default | Oct 19, 2026 |
| CVE-2026-85257 | 5.3 Medium | Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions | Oct 19, 2026 |
| CVE-2026-85254 | 6.5 Medium | Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing | Oct 19, 2026 |
| CVE-2026-71253 | 9.8 Critical | Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON | Oct 19, 2026 |
| CVE-2026-85251 | 7.5 High | Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets | Oct 19, 2026 |
| CVE-2026-85250 | 7.5 High | Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option | Oct 19, 2026 |
| CVE-2026-85249 | 6.5 Medium | Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata | Oct 19, 2026 |
| CVE-2026-85248 | 5.9 Medium | Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance | Oct 19, 2026 |
| CVE-2026-85247 | 5.9 Medium | Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore | Oct 19, 2026 |
| CVE-2026-85246 | 5.3 Medium | Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions | Oct 19, 2026 |
| CVE-2026-85245 | 5.9 Medium | Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target | Oct 19, 2026 |
| CVE-2026-85243 | 5.9 Medium | Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure | Oct 19, 2026 |
| CVE-2026-84181 | 5.9 Medium | Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse | Oct 19, 2026 |
| CVE-2026-84180 | 5.3 Medium | Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions | Oct 19, 2026 |
| CVE-2026-84178 | 6.1 Medium | Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow | Oct 19, 2026 |
| CVE-2026-112105 | 6.3 Medium | GlitterWare Passy TLS main.dart MyHttpOverrides certificate validation | Oct 19, 2026 |
| CVE-2026-84176 | 6.5 Medium | Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection | Oct 19, 2026 |
| CVE-2026-83531 | 8.8 High | Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages | Oct 19, 2026 |
| CVE-2026-80344 | 8.2 High | Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address | Oct 19, 2026 |
| CVE-2026-80343 | 8.2 High | Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching | Oct 19, 2026 |
| CVE-2026-80312 | 8.2 High | Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors | Oct 19, 2026 |
| CVE-2026-79986 | 7.4 High | Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside | Oct 19, 2026 |
| CVE-2026-79985 | 7.4 High | Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside | Oct 19, 2026 |
| CVE-2026-79984 | 7.4 High | Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside | Oct 19, 2026 |
| CVE-2026-112104 | 6.9 Medium | eremef bandcamp-player Remote Control Server database.ts missing authentication | Oct 19, 2026 |
| CVE-2026-79983 | 7.4 High | Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside | Oct 19, 2026 |
| CVE-2026-78165 | 8.8 High | Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads | Oct 19, 2026 |
| CVE-2026-78164 | 8.2 High | Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers | Oct 19, 2026 |
| CVE-2026-78163 | 5.9 Medium | Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure | Oct 19, 2026 |
| CVE-2026-78162 | 10.0 Critical | Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) | Oct 19, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.