Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

401,085 vulnerabilities match.

CVESeveritySummary
CVE-2026-1121036.3 Mediumf3-factory fatfree-core HTTP Client web.php _curl certificate validation
CVE-2026-1121025.3 MediumAXA Group NLP.js Condition Expression Pipeline evaluator.js Evaluator.walkFunction code injection
CVE-2026-909109.8 CriticalApache Answer: Reaction API authorization bypass for restricted content
CVE-2026-865895.4 MediumApache Answer: User Center integration does not revoke first-login sessions after central account suspension
CVE-2026-796338.1 HighApache Answer: Missing Authorization Allows Mutations of Non-Public Content
CVE-2026-796249.8 CriticalApache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
CVE-2026-796204.3 MediumApache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata
CVE-2026-796135.3 MediumApache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles
CVE-2026-769947.5 HighApache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
CVE-2026-715634.3 MediumApache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions
CVE-2026-684825.3 MediumApache Answer: Improper Authorization in Question Invite User Lookup
CVE-2026-672495.4 MediumApache Answer: Email Code Purpose Confusion May Allow Account Takeover
CVE-2026-649457.5 HighApache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
CVE-2026-1121015.3 MediumBlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation
CVE-2026-1121925.3 MediumMISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
CVE-2026-649445.4 MediumApache Answer: Stored XSS via unsanitized HTML in imported question content
CVE-2026-649438.1 HighApache Answer: API keys logged in plaintext during authentication
CVE-2026-1121887.1 HighMISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
CVE-2026-1088377.5 HighApache Kylin: Potential computed-column resource exhaustion
CVE-2026-1088337.5 HighApache Kylin: default startup profile miss security settings
CVE-2026-1088237.5 HighApache Kylin: Potential unauthenticated job metadata replacement
CVE-2026-1087806.5 MediumApache Kylin: Potential JDBC source configuration validation issue
CVE-2026-1087765.3 MediumApache Kylin: tables/names SparkSQL injection
CVE-2026-1087719.8 CriticalApache Kylin: unauthenticated broadcast API and polymorphic deserialization
CVE-2026-1087666.5 MediumApache Kylin: missing JDBC-config authorization
CVE-2026-1121844.8 MediumMISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels
CVE-2026-1087646.5 MediumApache Kylin: job-driver UI proxy SSRF
CVE-2026-1087627.3 HighApache Kylin: delete metadata backup path-confinement bypass
CVE-2026-1121834.8 MediumMISP CSS Injection via Remote Tag Colour in Event Preview
CVE-2026-1121005.1 MediumDeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.__init__ code injection
CVE-2026-1108879.9 CriticalWordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability
CVE-2026-1113987.7 HighWordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability
CVE-2026-1108986.4 MediumWordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability
CVE-2026-1114076.5 MediumWordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1114088.8 HighWordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability
CVE-2026-1103797.1 HighWordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1114069.9 CriticalWordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability
CVE-2026-1120985.3 MediumDeepPavlov Config Reference Resolver params.py resolve code injection
CVE-2026-1121805.1 MediumMISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
CVE-2026-1121795.3 MediumMISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
CVE-2026-1121787.1 HighMISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control
CVE-2026-1120975.1 MediumSourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting
CVE-2026-136958.8 HighSQL Injection in the Integratec Application
CVE-2026-1046796.9 MediumVOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of…
CVE-2026-1120965.1 MediumSourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting
CVE-2026-1121618.5 HighLack of integrity checks in Mobatek’s MobaXterm
CVE-2026-1120955.1 MediumSourceCodester Inventory System Product Management products_handler.php save cross site scripting
CVE-2026-1114386.5 Mediumcheck_hba_replication 认证与访问控制绕过
CVE-2026-1120945.1 Mediummichaelrsweet mxml mxml-file.c mxml_load_data use after free
CVE-2026-1114394.3 Mediumpg_read_binary_file_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.