Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
401,085 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-112093 | 5.3 Medium | subhajitkhan online-clinic-management-system feedback.php cross site scripting | Oct 19, 2026 |
| CVE-2026-112092 | 5.3 Medium | subhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting | Oct 19, 2026 |
| CVE-2026-112091 | 6.9 Medium | Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure | Oct 19, 2026 |
| CVE-2026-112090 | 5.3 Medium | Dav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection | Oct 19, 2026 |
| CVE-2026-94294 | 5.3 Medium | App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php | Oct 19, 2026 |
| CVE-2026-94272 | 5.3 Medium | Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions | Oct 19, 2026 |
| CVE-2026-94231 | 5.3 Medium | TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification | Oct 19, 2026 |
| CVE-2026-94230 | 5.3 Medium | TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions | Oct 19, 2026 |
| CVE-2026-94229 | 5.3 Medium | TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter | Oct 19, 2026 |
| CVE-2026-94228 | 5.3 Medium | TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data | Oct 19, 2026 |
| CVE-2026-91831 | 3.8 Low | Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting | Oct 19, 2026 |
| CVE-2026-86791 | 5.3 Medium | iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Forgery | Oct 19, 2026 |
| CVE-2026-74922 | 5.3 Medium | Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass | Oct 19, 2026 |
| CVE-2026-74921 | 6.8 Medium | Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes | Oct 19, 2026 |
| CVE-2026-110034 | 3.7 Low | Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code | Oct 19, 2026 |
| CVE-2026-106010 | 5.3 Medium | BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery | Oct 19, 2026 |
| CVE-2026-103311 | 5.3 Medium | Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared Secret | Oct 19, 2026 |
| CVE-2026-112089 | 5.1 Medium | Dav-ee dairy-management-system delete.php mysqli_query sql injection | Oct 19, 2026 |
| CVE-2026-16460 | 7.4 High | Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization | Oct 19, 2026 |
| CVE-2026-112088 | 5.3 Medium | Dav-ee dairy-management-system add.php mysqli_query sql injection | Oct 19, 2026 |
| CVE-2026-76740 | 7.2 High | HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers, Remote Command Execution vulnerability | Oct 19, 2026 |
| CVE-2026-112087 | 5.3 Medium | itsourcecode Online Cake Ordering System confirm.php sql injection | Oct 19, 2026 |
| CVE-2026-112086 | 5.3 Medium | ESPnet Inference Model inference_model.py build_model deserialization | Oct 19, 2026 |
| CVE-2026-94273 | 5.3 Medium | Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment | Oct 19, 2026 |
| CVE-2026-106014 | 5.3 Medium | Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery | Oct 19, 2026 |
| CVE-2026-89286 | 5.3 Medium | FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File | Oct 19, 2026 |
| CVE-2026-91047 | 5.3 Medium | ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter | Oct 19, 2026 |
| CVE-2026-91046 | 4.3 Medium | ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing Authorization | Oct 19, 2026 |
| CVE-2026-106933 | 6.8 Medium | Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload | Oct 19, 2026 |
| CVE-2026-106028 | 5.3 Medium | ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation | Oct 19, 2026 |
| CVE-2026-76739 | 4.3 Medium | HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server, Remote RMC file modification | Oct 19, 2026 |
| CVE-2026-112083 | 6.9 Medium | sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service | Oct 19, 2026 |
| CVE-2026-112082 | 8.7 High | sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service | Oct 19, 2026 |
| CVE-2026-112081 | 5.3 Medium | hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization | Oct 19, 2026 |
| CVE-2026-108120 | 7.7 High | path traversal inKoozali - SME Server | Oct 19, 2026 |
| CVE-2026-108121 | 6.9 Medium | Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service | Oct 19, 2026 |
| CVE-2026-112080 | 5.3 Medium | LlamaChinese Llama-Chinese Adapter Config chat_gradio_no_merge.py get_class_from_dynamic_module code injection | Oct 19, 2026 |
| CVE-2026-112079 | 5.3 Medium | hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization | Oct 19, 2026 |
| CVE-2026-112078 | 5.3 Medium | RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection | Oct 19, 2026 |
| CVE-2026-112077 | 6.3 Medium | radareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechanism | Oct 19, 2026 |
| CVE-2026-112076 | 6.3 Medium | alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgery | Oct 19, 2026 |
| CVE-2026-111440 | 7.0 High | JDBC LogFactory 任意类加载/构造导致潜在 RCE | Oct 19, 2026 |
| CVE-2026-112075 | 5.3 Medium | unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code | Oct 19, 2026 |
| CVE-2026-112074 | 5.3 Medium | Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflow | Oct 19, 2026 |
| CVE-2026-112073 | 5.3 Medium | Tencent ncnn MatMul matmul.cpp matmul_transb out-of-bounds | Oct 19, 2026 |
| CVE-2026-112045 | 5.3 Medium | donetick History Deletion model.go CanDeleteHistory improper authorization | Oct 19, 2026 |
| CVE-2026-112044 | 6.9 Medium | dotnet eShop Catalog API Extensions.cs AddApplicationServices improper authentication | Oct 19, 2026 |
| CVE-2026-111441 | 8.1 High | HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写 | Oct 19, 2026 |
| CVE-2026-112043 | 5.3 Medium | calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization | Oct 19, 2026 |
| CVE-2026-103091 | 9.3 Critical | Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM) | Oct 19, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.