Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

401,789 vulnerabilities match.

CVESeveritySummary
CVE-2026-1120975.1 MediumSourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting
CVE-2026-136958.8 HighSQL Injection in the Integratec Application
CVE-2026-1046796.9 MediumVOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of…
CVE-2026-1120965.1 MediumSourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting
CVE-2026-1121618.5 HighLack of integrity checks in Mobatek’s MobaXterm
CVE-2026-1120955.1 MediumSourceCodester Inventory System Product Management products_handler.php save cross site scripting
CVE-2026-1114386.5 Mediumcheck_hba_replication 认证与访问控制绕过
CVE-2026-1120945.1 Mediummichaelrsweet mxml mxml-file.c mxml_load_data use after free
CVE-2026-1114394.3 Mediumpg_read_binary_file_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块
CVE-2026-1120935.3 Mediumsubhajitkhan online-clinic-management-system feedback.php cross site scripting
CVE-2026-1120925.3 Mediumsubhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting
CVE-2026-1120916.9 MediumDav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure
CVE-2026-1120905.3 MediumDav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection
CVE-2026-942945.3 MediumApp Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php
CVE-2026-942725.3 MediumSnap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions
CVE-2026-942315.3 MediumTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification
CVE-2026-942305.3 MediumTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions
CVE-2026-942295.3 MediumTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter
CVE-2026-942285.3 MediumTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data
CVE-2026-918313.8 LowSubscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting
CVE-2026-867915.3 MediumiPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Forgery
CVE-2026-749225.3 MediumDocument Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass
CVE-2026-749216.8 MediumDocument Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes
CVE-2026-1100343.7 LowSalon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code
CVE-2026-1060105.3 MediumBDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery
CVE-2026-1033115.3 MediumCoinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared Secret
CVE-2026-1120895.1 MediumDav-ee dairy-management-system delete.php mysqli_query sql injection
CVE-2026-164607.4 HighBootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization
CVE-2026-1120885.3 MediumDav-ee dairy-management-system add.php mysqli_query sql injection
CVE-2026-767407.2 HighHPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers, Remote Command Execution vulnerability
CVE-2026-1120875.3 Mediumitsourcecode Online Cake Ordering System confirm.php sql injection
CVE-2026-1120865.3 MediumESPnet Inference Model inference_model.py build_model deserialization
CVE-2026-942735.3 MediumSnap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment
CVE-2026-1060145.3 MediumGateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery
CVE-2026-892865.3 MediumFormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
CVE-2026-910475.3 MediumElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter
CVE-2026-910464.3 MediumElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing Authorization
CVE-2026-1069336.8 MediumBlaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload
CVE-2026-1060285.3 MediumActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation
CVE-2026-767394.3 MediumHPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server, Remote RMC file modification
CVE-2026-1120836.9 Mediumsgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service
CVE-2026-1120828.7 Highsgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service
CVE-2026-1120815.3 Mediumhankcs HanLP Model Config Loading reflection.py hanlp.load deserialization
CVE-2026-1081207.7 Highpath traversal inKoozali - SME Server
CVE-2026-1081216.9 MediumKoozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service
CVE-2026-1120805.3 MediumLlamaChinese Llama-Chinese Adapter Config chat_gradio_no_merge.py get_class_from_dynamic_module code injection
CVE-2026-1120795.3 Mediumhankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization
CVE-2026-1120785.3 MediumRVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection
CVE-2026-1120776.3 Mediumradareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechanism
CVE-2026-1120766.3 Mediumalexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgery

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.