Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,055 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-109433 | 6.0 Medium | Camunda Broken Access Control via Cockpit | Oct 19, 2026 |
| CVE-2026-109432 | 9.3 Critical | Camunda Expression Injection via orQueries RCE | Oct 19, 2026 |
| CVE-2026-109431 | 8.6 High | Camunda Missing Authorization in Task Sub-Resources | Oct 19, 2026 |
| CVE-2026-112151 | 6.9 Medium | vraj404 Criminal Management System Submission Form home.php sql injection | Oct 19, 2026 |
| CVE-2026-86375 | 6.2 Medium | Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized… | Oct 19, 2026 |
| CVE-2026-112329 | 5.3 Medium | Sensei LMS 4.26.4 Broken Access Control via save_new_message | Oct 19, 2026 |
| CVE-2026-112150 | 6.9 Medium | vraj404 Criminal-Management-System search.php sql injection | Oct 19, 2026 |
| CVE-2026-112328 | 5.3 Medium | Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX | Oct 19, 2026 |
| CVE-2026-112149 | 6.9 Medium | vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload | Oct 19, 2026 |
| CVE-2026-112147 | 6.9 Medium | ai-genius-automations octoally index.ts information disclosure | Oct 19, 2026 |
| CVE-2026-112146 | 5.3 Medium | D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials | Oct 19, 2026 |
| CVE-2026-112296 | 9.3 Critical | FlyCms through commit edfdf724 Default Super Administrator Credentials | Oct 19, 2026 |
| CVE-2026-112295 | 5.3 Medium | FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update | Oct 19, 2026 |
| CVE-2026-112294 | 5.3 Medium | FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint | Oct 19, 2026 |
| CVE-2026-112293 | 5.3 Medium | BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API | Oct 19, 2026 |
| CVE-2026-112292 | 9.3 Critical | CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules | Oct 19, 2026 |
| CVE-2026-112291 | 6.9 Medium | Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API | Oct 19, 2026 |
| CVE-2026-112290 | 2.3 Low | MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item | Oct 19, 2026 |
| CVE-2026-112289 | 5.1 Medium | Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin | Oct 19, 2026 |
| CVE-2026-112288 | 2.1 Low | Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding | Oct 19, 2026 |
| CVE-2026-112287 | 7.1 High | Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module | Oct 19, 2026 |
| CVE-2026-112286 | 7.1 High | Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints | Oct 19, 2026 |
| CVE-2026-112285 | 5.3 Medium | Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders | Oct 19, 2026 |
| CVE-2026-112284 | 4.8 Medium | libaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGR | Oct 19, 2026 |
| CVE-2026-112283 | 6.8 Medium | libbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_points | Oct 19, 2026 |
| CVE-2026-112282 | 6.8 Medium | VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_point | Oct 19, 2026 |
| CVE-2026-112281 | 6.9 Medium | libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi | Oct 19, 2026 |
| CVE-2026-112280 | 6.9 Medium | libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body | Oct 19, 2026 |
| CVE-2026-112279 | 7.1 High | rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_bmpcache2 | Oct 19, 2026 |
| CVE-2026-112278 | 7.1 High | rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_raw_bmpcache | Oct 19, 2026 |
| CVE-2026-112277 | 7.1 High | rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_plane | Oct 19, 2026 |
| CVE-2026-112276 | 6.9 Medium | Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap | Oct 19, 2026 |
| CVE-2026-112275 | 6.9 Medium | Netpbm through 11.16.00 Heap Out-of-Bounds Write via rasttopnm pr_load_image | Oct 19, 2026 |
| CVE-2026-112274 | 6.3 Medium | libtins through 4.6 Out-of-Bounds Read via DNS::soa_record::init | Oct 19, 2026 |
| CVE-2026-112273 | 6.9 Medium | libtins through 4.6 Heap Out-of-Bounds Read via DNS::compose_name | Oct 19, 2026 |
| CVE-2026-112272 | 6.8 Medium | libdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parser | Oct 19, 2026 |
| CVE-2026-112271 | 6.8 Medium | libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser | Oct 19, 2026 |
| CVE-2026-112270 | 7.1 High | SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx | Oct 19, 2026 |
| CVE-2026-112269 | 7.1 High | SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations | Oct 19, 2026 |
| CVE-2026-112268 | 5.3 Medium | sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes | Oct 19, 2026 |
| CVE-2026-112267 | 6.9 Medium | SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker | Oct 19, 2026 |
| CVE-2026-112266 | 8.2 High | SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching | Oct 19, 2026 |
| CVE-2026-112265 | 8.3 High | LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification | Oct 19, 2026 |
| CVE-2026-112264 | 8.5 High | BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys | Oct 19, 2026 |
| CVE-2026-112263 | 8.5 High | Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting | Oct 19, 2026 |
| CVE-2026-112262 | 7.1 High | RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors | Oct 19, 2026 |
| CVE-2026-111939 | 5.1 Medium | Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation | Oct 19, 2026 |
| CVE-2026-111938 | 5.3 Medium | Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log | Oct 19, 2026 |
| CVE-2026-111937 | 5.3 Medium | Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records | Oct 19, 2026 |
| CVE-2026-111936 | 5.3 Medium | Sigma File Manager through 2.2.0 SSRF via Extension Download Commands | Oct 19, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.