Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
401,233 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-112042 | 5.1 Medium | diem-project diem dmWidget dmBaseLinkTag.php text cross site scripting | Oct 19, 2026 |
| CVE-2026-112041 | 6.3 Medium | diem-project diem dmString.php random weak prng | Oct 19, 2026 |
| CVE-2026-112040 | 5.3 Medium | diem-project diem Sign-In BasedmUserActions.class.php redirect | Oct 19, 2026 |
| CVE-2026-112039 | 4.8 Medium | diem-project diem Administrative Console actions.class.php append cross site scripting | Oct 19, 2026 |
| CVE-2026-112038 | 4.8 Medium | diem-project diem Version Check Service dmAdminCtrl.js html cross site scripting | Oct 19, 2026 |
| CVE-2026-112037 | 6.3 Medium | diem-project diem Google Analytics Client gapi.class.php certificate validation | Oct 19, 2026 |
| CVE-2026-108984 | 7.5 High | GV-ASManager Web Server Buffer Overflow Vulnerability | Oct 19, 2026 |
| CVE-2026-108983 | 9.8 Critical | GV-ASManager Web Server Command Injection Vulnerability | Oct 19, 2026 |
| CVE-2026-112036 | 5.3 Medium | Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free | Oct 19, 2026 |
| CVE-2026-112035 | 5.3 Medium | aircheng-org iWebShop-5 simple.php send_message_mobile password recovery | Oct 19, 2026 |
| CVE-2026-112034 | 5.3 Medium | aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect | Oct 19, 2026 |
| CVE-2026-112033 | 5.3 Medium | aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgery | Oct 19, 2026 |
| CVE-2026-38671 | 6.1 Medium | Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of… | Oct 19, 2026 |
| CVE-2026-107084 | 8.8 High | Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_history_maintenance.php because the action=run GET parameter performs privileged, destructive… | Oct 19, 2026 |
| CVE-2026-107083 | 9.8 Critical | SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID. | Oct 19, 2026 |
| CVE-2026-107082 | 8.8 High | Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied… | Oct 19, 2026 |
| CVE-2026-107081 | 9.8 Critical | SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management… | Oct 19, 2026 |
| CVE-2025-60482 | 5.5 Medium | A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. | Oct 19, 2026 |
| CVE-2025-60480 | 5.5 Medium | A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. | Oct 19, 2026 |
| CVE-2025-55667 | 5.5 Medium | A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Oct 19, 2026 |
| CVE-2025-55654 | 5.5 Medium | A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file. | Oct 19, 2026 |
| CVE-2025-52290 | 7.5 High | A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file. | Oct 19, 2026 |
| CVE-2026-112032 | 5.1 Medium | aircheng-org iWebShop-5 util.php search sql injection | Oct 18, 2026 |
| CVE-2026-112031 | 5.1 Medium | Chamilo LMS Ticket TicketManager.php addProject cross site scripting | Oct 18, 2026 |
| CVE-2026-112030 | 5.3 Medium | diem-project diem dmDataLoad.php default password | Oct 18, 2026 |
| CVE-2026-112112 | 2.3 Low | An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure.… | Oct 18, 2026 |
| CVE-2026-112029 | 2.0 Low | diem-project diem SHA1 PluginDmUser.class.php weak password hash | Oct 18, 2026 |
| CVE-2026-112028 | 6.9 Medium | light0011 cms Vote VoteController.class.php logic error | Oct 18, 2026 |
| CVE-2026-112111 | 5.1 Medium | The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an… | Oct 18, 2026 |
| CVE-2026-112027 | 6.9 Medium | light0011 cms Uploadify check-exists.php file_exists file information disclosure | Oct 18, 2026 |
| CVE-2026-112026 | 6.3 Medium | light0011 cms UserModel.class.php sha1 weak password hash | Oct 18, 2026 |
| CVE-2026-112025 | 6.9 Medium | light0011 cms Captcha Validation UserController.class.php access control | Oct 18, 2026 |
| CVE-2026-97859 | 6.5 Medium | Gitea API disclosure of private user social graph, keys and stars | Oct 18, 2026 |
| CVE-2026-97204 | 3.1 Low | Gitea label deletion across repository and organization IDs | Oct 18, 2026 |
| CVE-2026-110494 | 6.3 Medium | Gitea release attachment re-linking of issue attachments | Oct 18, 2026 |
| CVE-2026-110324 | 6.5 Medium | Gitea private profile information disclosure through POST request | Oct 18, 2026 |
| CVE-2026-110311 | 4.3 Medium | Gitea draft release creation disclosing attachment metadata | Oct 18, 2026 |
| CVE-2026-109844 | 4.3 Medium | Gitea watched repositories API disclosure after access revocation | Oct 18, 2026 |
| CVE-2026-107686 | 4.3 Medium | Gitea reactions accepted on locked issues and comments | Oct 18, 2026 |
| CVE-2026-107618 | 8.1 High | Gitea cross-site request forgery on repository topics | Oct 18, 2026 |
| CVE-2026-105964 | 6.5 Medium | Gitea Actions artifact v4 API unbounded request body | Oct 18, 2026 |
| CVE-2026-105661 | 5.3 Medium | Gitea panic on the repositories route of individual users | Oct 18, 2026 |
| CVE-2026-109553 | 7.5 High | Gitea SSH certificate principal impersonation of other users | Oct 18, 2026 |
| CVE-2026-104627 | 5.4 Medium | Gitea OpenID account linking without session binding | Oct 18, 2026 |
| CVE-2024-4457 | 9.1 Critical | Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution | Oct 18, 2026 |
| CVE-2026-111993 | 4.8 Medium | Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage | Oct 18, 2026 |
| CVE-2026-111992 | 5.3 Medium | itsmeravitejak Online-Examination-System Exam exam.php startExam sql injection | Oct 18, 2026 |
| CVE-2026-98868 | Not scored | dm-pcache: reject a kset that overruns its segment | Oct 18, 2026 |
| CVE-2026-98867 | Not scored | dm-pcache: bound the logical key offset from persistent memory | Oct 18, 2026 |
| CVE-2026-98866 | Not scored | sched/cache: Introduce task_struct->sched_cache_grp to fix UAF | Oct 18, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.