Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,206 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-82961 | 7.8 High | Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode | Oct 28, 2026 |
| CVE-2026-118619 | 8.8 High | Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability | Oct 28, 2026 |
| CVE-2026-118618 | 7.8 High | Ultralytics parse_model Code Injection Remote Code Execution Vulnerability | Oct 28, 2026 |
| CVE-2026-118617 | 7.8 High | Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability | Oct 28, 2026 |
| CVE-2026-118616 | 7.8 High | Ultralytics parse_model Code Injection Remote Code Execution Vulnerability | Oct 28, 2026 |
| CVE-2026-118615 | 7.8 High | Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability | Oct 28, 2026 |
| CVE-2026-118614 | 7.8 High | Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability | Oct 28, 2026 |
| CVE-2026-118613 | 7.8 High | Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability | Oct 28, 2026 |
| CVE-2026-118581 | 6.9 Medium | NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol | Oct 28, 2026 |
| CVE-2026-118611 | 6.8 Medium | Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability | Oct 28, 2026 |
| CVE-2026-118610 | 8.8 High | Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability | Oct 28, 2026 |
| CVE-2026-118609 | 6.8 Medium | Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability | Oct 28, 2026 |
| CVE-2026-118608 | 3.5 Low | Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability | Oct 28, 2026 |
| CVE-2026-118607 | 6.8 Medium | Alpine iLX-F511 diagapp Command Injection Vulnerability | Oct 28, 2026 |
| CVE-2026-103506 | 8.9 High | SSO settings authorization bypass | Oct 28, 2026 |
| CVE-2026-118606 | 8.8 High | Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability | Oct 28, 2026 |
| CVE-2026-118605 | 8.0 High | Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability | Oct 28, 2026 |
| CVE-2026-88858 | 6.5 Medium | Server-side expression parser denial of service | Oct 28, 2026 |
| CVE-2026-118604 | 6.8 Medium | Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability | Oct 28, 2026 |
| CVE-2026-118603 | 8.0 High | Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability | Oct 28, 2026 |
| CVE-2026-118602 | 7.8 High | Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability | Oct 28, 2026 |
| CVE-2026-118601 | 6.3 Medium | Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability | Oct 28, 2026 |
| CVE-2026-88967 | 7.7 High | Azure Monitor access token disclosure via SSRF | Oct 28, 2026 |
| CVE-2026-100105 | 7.7 High | Alerting contact point authorization bypass via schema downgrade | Oct 28, 2026 |
| CVE-2026-117626 | Not scored | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the… | Oct 28, 2026 |
| CVE-2026-117625 | Not scored | A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy. | Oct 28, 2026 |
| CVE-2026-117624 | Not scored | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values,… | Oct 28, 2026 |
| CVE-2026-117623 | Not scored | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with… | Oct 28, 2026 |
| CVE-2026-117622 | Not scored | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in… | Oct 28, 2026 |
| CVE-2026-117621 | Not scored | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in… | Oct 28, 2026 |
| CVE-2026-117620 | Not scored | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding… | Oct 28, 2026 |
| CVE-2026-117619 | Not scored | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to… | Oct 28, 2026 |
| CVE-2026-117618 | Not scored | In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to… | Oct 28, 2026 |
| CVE-2026-117617 | Not scored | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace… | Oct 28, 2026 |
| CVE-2026-117616 | Not scored | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system… | Oct 28, 2026 |
| CVE-2026-117615 | Not scored | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins… | Oct 28, 2026 |
| CVE-2026-117614 | Not scored | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an… | Oct 28, 2026 |
| CVE-2026-117613 | Not scored | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted `config.xml` files that can lead to,… | Oct 28, 2026 |
| CVE-2026-117612 | Not scored | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization. | Oct 28, 2026 |
| CVE-2026-114349 | Not scored | Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches | Oct 28, 2026 |
| CVE-2026-112375 | Not scored | Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs | Oct 28, 2026 |
| CVE-2026-116593 | Not scored | Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint | Oct 28, 2026 |
| CVE-2026-115644 | Not scored | Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions | Oct 28, 2026 |
| CVE-2026-111551 | Not scored | Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation | Oct 28, 2026 |
| CVE-2026-111496 | Not scored | Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation | Oct 28, 2026 |
| CVE-2026-111115 | Not scored | Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing | Oct 28, 2026 |
| CVE-2026-111108 | Not scored | Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers | Oct 28, 2026 |
| CVE-2026-111073 | Not scored | Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service | Oct 28, 2026 |
| CVE-2026-106079 | 8.8 High | Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration | Oct 28, 2026 |
| CVE-2026-110985 | Not scored | Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured | Oct 28, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.