Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,055 vulnerabilities match.

CVESeveritySummary
CVE-2026-1119352.1 LowNoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis
CVE-2026-1119256.9 MediumMopidy before 4.0.5 Path Traversal via File Backend library.lookup
CVE-2026-1119158.2 HighYank Note before 3.93.1 Path Traversal via /api/help Endpoint
CVE-2026-1118995.3 MediumKitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch
CVE-2026-1118835.3 MediumLocust through 2.46.7 CSRF via Web UI /stop and /stats/reset
CVE-2026-1121456.9 Mediumspeaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn externally-controlled input to select classes or code
CVE-2026-1121446.9 Mediumsatya-vinay Events-Management-System project.sql file access
CVE-2026-1118284.3 MediumWordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability
CVE-2026-1122225.4 MediumWordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability
CVE-2026-1118296.5 MediumWordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability
CVE-2026-1109024.3 MediumWordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability
CVE-2026-1100084.2 Medium@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback
CVE-2026-1121436.9 Mediumsatya-vinay Events-Management-System missing authentication
CVE-2026-81687.1 HighDenial-of-service vulnerability in the SVG parser and renderer impacts Qt
CVE-2026-1121426.9 Mediumsatya-vinay Events-Management-System Registration-Delete dodelete.php sql injection
CVE-2026-1118455.3 MediumWordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability
CVE-2026-1121416.9 Mediumsatya-vinay Events-Management-System Registration-Edit doedit.php mysqli_query sql injection
CVE-2026-1118315.3 MediumWordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability
CVE-2026-1103635.4 MediumWordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability
CVE-2026-1118364.3 MediumWordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerability
CVE-2026-1114146.5 MediumWordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1114106.5 MediumWordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1122146.5 MediumGstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser
CVE-2026-1033147.4 HighStackrox: stackrox: saml response replay allows multiple central authentication tokens
CVE-2026-1118395.3 MediumWordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerability
CVE-2026-1121996.5 MediumWordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1121405.3 MediumllSourcell Doctor-Dignity chat_module.py _get_lib_module code injection
CVE-2026-1121396.9 Mediumsubhajitkhan online-clinic-management-system Administrative Mutation admindocview.php sql injection
CVE-2026-1122106.0 MediumRhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service
CVE-2026-1121385.1 Mediumdiem-project diem dmCodeEditor actions.class.php join path traversal
CVE-2026-1121085.3 Mediumztxz16 fastllm String Parsing gguf.cpp ReadString buffer overflow
CVE-2026-889008.8 HighApache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution
CVE-2026-1121075.3 Mediumztxz16 fastllm Safetensors Weight Loading model.cpp CreateBuffer buffer overflow
CVE-2026-918586.5 MediumApache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present
CVE-2026-1121066.3 MediumTufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validation
CVE-2026-889018.2 HighApache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default
CVE-2026-853174.8 MediumApache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache
CVE-2026-853164.8 MediumApache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching
CVE-2026-853155.3 MediumApache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions
CVE-2026-853146.5 MediumApache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)
CVE-2026-853134.3 MediumApache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set
CVE-2026-853124.8 MediumApache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header
CVE-2026-853005.5 MediumApache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions
CVE-2026-853014.8 MediumApache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim
CVE-2026-852966.5 MediumApache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State
CVE-2026-852605.5 MediumApache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default
CVE-2026-852575.3 MediumApache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions
CVE-2026-852546.5 MediumApache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing
CVE-2026-712539.8 CriticalApache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON
CVE-2026-852517.5 HighApache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.