Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
401,789 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-112291 | 6.9 Medium | Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API | Oct 19, 2026 |
| CVE-2026-112290 | 2.3 Low | MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item | Oct 19, 2026 |
| CVE-2026-112289 | 5.1 Medium | Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin | Oct 19, 2026 |
| CVE-2026-112288 | 2.1 Low | Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding | Oct 19, 2026 |
| CVE-2026-112287 | 7.1 High | Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module | Oct 19, 2026 |
| CVE-2026-112286 | 7.1 High | Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints | Oct 19, 2026 |
| CVE-2026-112285 | 5.3 Medium | Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders | Oct 19, 2026 |
| CVE-2026-112284 | 4.8 Medium | libaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGR | Oct 19, 2026 |
| CVE-2026-112283 | 6.8 Medium | libbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_points | Oct 19, 2026 |
| CVE-2026-112282 | 6.8 Medium | VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_point | Oct 19, 2026 |
| CVE-2026-112281 | 6.9 Medium | libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi | Oct 19, 2026 |
| CVE-2026-112280 | 6.9 Medium | libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body | Oct 19, 2026 |
| CVE-2026-112279 | 7.1 High | rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_bmpcache2 | Oct 19, 2026 |
| CVE-2026-112278 | 7.1 High | rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_raw_bmpcache | Oct 19, 2026 |
| CVE-2026-112277 | 7.1 High | rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_plane | Oct 19, 2026 |
| CVE-2026-112276 | 6.9 Medium | Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap | Oct 19, 2026 |
| CVE-2026-112275 | 6.9 Medium | Netpbm through 11.16.00 Heap Out-of-Bounds Write via rasttopnm pr_load_image | Oct 19, 2026 |
| CVE-2026-112274 | 6.3 Medium | libtins through 4.6 Out-of-Bounds Read via DNS::soa_record::init | Oct 19, 2026 |
| CVE-2026-112273 | 6.9 Medium | libtins through 4.6 Heap Out-of-Bounds Read via DNS::compose_name | Oct 19, 2026 |
| CVE-2026-112272 | 6.8 Medium | libdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parser | Oct 19, 2026 |
| CVE-2026-112271 | 6.8 Medium | libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser | Oct 19, 2026 |
| CVE-2026-112270 | 7.1 High | SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx | Oct 19, 2026 |
| CVE-2026-112269 | 7.1 High | SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations | Oct 19, 2026 |
| CVE-2026-112268 | 5.3 Medium | sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes | Oct 19, 2026 |
| CVE-2026-112267 | 6.9 Medium | SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker | Oct 19, 2026 |
| CVE-2026-112266 | 8.2 High | SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching | Oct 19, 2026 |
| CVE-2026-112265 | 8.3 High | LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification | Oct 19, 2026 |
| CVE-2026-112264 | 8.5 High | BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys | Oct 19, 2026 |
| CVE-2026-112263 | 8.5 High | Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting | Oct 19, 2026 |
| CVE-2026-112262 | 7.1 High | RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors | Oct 19, 2026 |
| CVE-2026-111939 | 5.1 Medium | Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation | Oct 19, 2026 |
| CVE-2026-111938 | 5.3 Medium | Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log | Oct 19, 2026 |
| CVE-2026-111937 | 5.3 Medium | Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records | Oct 19, 2026 |
| CVE-2026-111936 | 5.3 Medium | Sigma File Manager through 2.2.0 SSRF via Extension Download Commands | Oct 19, 2026 |
| CVE-2026-111935 | 2.1 Low | NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis | Oct 19, 2026 |
| CVE-2026-111925 | 6.9 Medium | Mopidy before 4.0.5 Path Traversal via File Backend library.lookup | Oct 19, 2026 |
| CVE-2026-111915 | 8.2 High | Yank Note before 3.93.1 Path Traversal via /api/help Endpoint | Oct 19, 2026 |
| CVE-2026-111899 | 5.3 Medium | KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch | Oct 19, 2026 |
| CVE-2026-111883 | 5.3 Medium | Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset | Oct 19, 2026 |
| CVE-2026-112145 | 6.9 Medium | speaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn externally-controlled input to select classes or code | Oct 19, 2026 |
| CVE-2026-112144 | 6.9 Medium | satya-vinay Events-Management-System project.sql file access | Oct 19, 2026 |
| CVE-2026-111828 | 4.3 Medium | WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability | Oct 19, 2026 |
| CVE-2026-112222 | 5.4 Medium | WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability | Oct 19, 2026 |
| CVE-2026-111829 | 6.5 Medium | WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability | Oct 19, 2026 |
| CVE-2026-110902 | 4.3 Medium | WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability | Oct 19, 2026 |
| CVE-2026-110008 | 4.2 Medium | @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback | Oct 19, 2026 |
| CVE-2026-112143 | 6.9 Medium | satya-vinay Events-Management-System missing authentication | Oct 19, 2026 |
| CVE-2026-8168 | 7.1 High | Denial-of-service vulnerability in the SVG parser and renderer impacts Qt | Oct 19, 2026 |
| CVE-2026-112142 | 6.9 Medium | satya-vinay Events-Management-System Registration-Delete dodelete.php sql injection | Oct 19, 2026 |
| CVE-2026-111845 | 5.3 Medium | WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability | Oct 19, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.