Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
401,789 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-79986 | 7.4 High | Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside | Oct 19, 2026 |
| CVE-2026-79985 | 7.4 High | Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside | Oct 19, 2026 |
| CVE-2026-79984 | 7.4 High | Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside | Oct 19, 2026 |
| CVE-2026-112104 | 6.9 Medium | eremef bandcamp-player Remote Control Server database.ts missing authentication | Oct 19, 2026 |
| CVE-2026-79983 | 7.4 High | Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside | Oct 19, 2026 |
| CVE-2026-78165 | 8.8 High | Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads | Oct 19, 2026 |
| CVE-2026-78164 | 8.2 High | Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers | Oct 19, 2026 |
| CVE-2026-78163 | 5.9 Medium | Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure | Oct 19, 2026 |
| CVE-2026-78162 | 10.0 Critical | Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) | Oct 19, 2026 |
| CVE-2026-112103 | 6.3 Medium | f3-factory fatfree-core HTTP Client web.php _curl certificate validation | Oct 19, 2026 |
| CVE-2026-112102 | 5.3 Medium | AXA Group NLP.js Condition Expression Pipeline evaluator.js Evaluator.walkFunction code injection | Oct 19, 2026 |
| CVE-2026-90910 | 9.8 Critical | Apache Answer: Reaction API authorization bypass for restricted content | Oct 19, 2026 |
| CVE-2026-86589 | 5.4 Medium | Apache Answer: User Center integration does not revoke first-login sessions after central account suspension | Oct 19, 2026 |
| CVE-2026-79633 | 8.1 High | Apache Answer: Missing Authorization Allows Mutations of Non-Public Content | Oct 19, 2026 |
| CVE-2026-79624 | 9.8 Critical | Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation | Oct 19, 2026 |
| CVE-2026-79620 | 4.3 Medium | Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata | Oct 19, 2026 |
| CVE-2026-79613 | 5.3 Medium | Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles | Oct 19, 2026 |
| CVE-2026-76994 | 7.5 High | Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles | Oct 19, 2026 |
| CVE-2026-71563 | 4.3 Medium | Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions | Oct 19, 2026 |
| CVE-2026-68482 | 5.3 Medium | Apache Answer: Improper Authorization in Question Invite User Lookup | Oct 19, 2026 |
| CVE-2026-67249 | 5.4 Medium | Apache Answer: Email Code Purpose Confusion May Allow Account Takeover | Oct 19, 2026 |
| CVE-2026-64945 | 7.5 High | Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions | Oct 19, 2026 |
| CVE-2026-112101 | 5.3 Medium | BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation | Oct 19, 2026 |
| CVE-2026-112192 | 5.3 Medium | MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings | Oct 19, 2026 |
| CVE-2026-64944 | 5.4 Medium | Apache Answer: Stored XSS via unsanitized HTML in imported question content | Oct 19, 2026 |
| CVE-2026-64943 | 8.1 High | Apache Answer: API keys logged in plaintext during authentication | Oct 19, 2026 |
| CVE-2026-112188 | 7.1 High | MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution | Oct 19, 2026 |
| CVE-2026-108837 | 7.5 High | Apache Kylin: Potential computed-column resource exhaustion | Oct 19, 2026 |
| CVE-2026-108833 | 7.5 High | Apache Kylin: default startup profile miss security settings | Oct 19, 2026 |
| CVE-2026-108823 | 7.5 High | Apache Kylin: Potential unauthenticated job metadata replacement | Oct 19, 2026 |
| CVE-2026-108780 | 6.5 Medium | Apache Kylin: Potential JDBC source configuration validation issue | Oct 19, 2026 |
| CVE-2026-108776 | 5.3 Medium | Apache Kylin: tables/names SparkSQL injection | Oct 19, 2026 |
| CVE-2026-108771 | 9.8 Critical | Apache Kylin: unauthenticated broadcast API and polymorphic deserialization | Oct 19, 2026 |
| CVE-2026-108766 | 6.5 Medium | Apache Kylin: missing JDBC-config authorization | Oct 19, 2026 |
| CVE-2026-112184 | 4.8 Medium | MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels | Oct 19, 2026 |
| CVE-2026-108764 | 6.5 Medium | Apache Kylin: job-driver UI proxy SSRF | Oct 19, 2026 |
| CVE-2026-108762 | 7.3 High | Apache Kylin: delete metadata backup path-confinement bypass | Oct 19, 2026 |
| CVE-2026-112183 | 4.8 Medium | MISP CSS Injection via Remote Tag Colour in Event Preview | Oct 19, 2026 |
| CVE-2026-112100 | 5.1 Medium | DeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.__init__ code injection | Oct 19, 2026 |
| CVE-2026-110887 | 9.9 Critical | WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability | Oct 19, 2026 |
| CVE-2026-111398 | 7.7 High | WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability | Oct 19, 2026 |
| CVE-2026-110898 | 6.4 Medium | WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability | Oct 19, 2026 |
| CVE-2026-111407 | 6.5 Medium | WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability | Oct 19, 2026 |
| CVE-2026-111408 | 8.8 High | WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability | Oct 19, 2026 |
| CVE-2026-110379 | 7.1 High | WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability | Oct 19, 2026 |
| CVE-2026-111406 | 9.9 Critical | WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability | Oct 19, 2026 |
| CVE-2026-112098 | 5.3 Medium | DeepPavlov Config Reference Resolver params.py resolve code injection | Oct 19, 2026 |
| CVE-2026-112180 | 5.1 Medium | MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records | Oct 19, 2026 |
| CVE-2026-112179 | 5.3 Medium | MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances | Oct 19, 2026 |
| CVE-2026-112178 | 7.1 High | MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control | Oct 19, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.