Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,055 vulnerabilities match.

CVESeveritySummary
CVE-2026-1121844.8 MediumMISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels
CVE-2026-1087646.5 MediumApache Kylin: job-driver UI proxy SSRF
CVE-2026-1087627.3 HighApache Kylin: delete metadata backup path-confinement bypass
CVE-2026-1121834.8 MediumMISP CSS Injection via Remote Tag Colour in Event Preview
CVE-2026-1121005.1 MediumDeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.__init__ code injection
CVE-2026-1108879.9 CriticalWordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability
CVE-2026-1113987.7 HighWordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability
CVE-2026-1108986.4 MediumWordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability
CVE-2026-1114076.5 MediumWordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1114088.8 HighWordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability
CVE-2026-1103797.1 HighWordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1114069.9 CriticalWordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability
CVE-2026-1120985.3 MediumDeepPavlov Config Reference Resolver params.py resolve code injection
CVE-2026-1121805.1 MediumMISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
CVE-2026-1121795.3 MediumMISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
CVE-2026-1121787.1 HighMISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control
CVE-2026-1120975.1 MediumSourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting
CVE-2026-136958.8 HighSQL Injection in the Integratec Application
CVE-2026-1046796.9 MediumVOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of…
CVE-2026-1120965.1 MediumSourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting
CVE-2026-1121618.5 HighLack of integrity checks in Mobatek’s MobaXterm
CVE-2026-1120955.1 MediumSourceCodester Inventory System Product Management products_handler.php save cross site scripting
CVE-2026-1114386.5 Mediumcheck_hba_replication 认证与访问控制绕过
CVE-2026-1120945.1 Mediummichaelrsweet mxml mxml-file.c mxml_load_data use after free
CVE-2026-1114394.3 Mediumpg_read_binary_file_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块
CVE-2026-1120935.3 Mediumsubhajitkhan online-clinic-management-system feedback.php cross site scripting
CVE-2026-1120925.3 Mediumsubhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting
CVE-2026-1120916.9 MediumDav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure
CVE-2026-1120905.3 MediumDav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection
CVE-2026-942945.3 MediumApp Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php
CVE-2026-942725.3 MediumSnap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions
CVE-2026-942315.3 MediumTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification
CVE-2026-942305.3 MediumTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions
CVE-2026-942295.3 MediumTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter
CVE-2026-942285.3 MediumTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data
CVE-2026-918313.8 LowSubscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting
CVE-2026-867915.3 MediumiPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Forgery
CVE-2026-749225.3 MediumDocument Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass
CVE-2026-749216.8 MediumDocument Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes
CVE-2026-1100343.7 LowSalon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code
CVE-2026-1060105.3 MediumBDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery
CVE-2026-1033115.3 MediumCoinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared Secret
CVE-2026-1120895.1 MediumDav-ee dairy-management-system delete.php mysqli_query sql injection
CVE-2026-164607.4 HighBootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization
CVE-2026-1120885.3 MediumDav-ee dairy-management-system add.php mysqli_query sql injection
CVE-2026-767407.2 HighHPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers, Remote Command Execution vulnerability
CVE-2026-1120875.3 Mediumitsourcecode Online Cake Ordering System confirm.php sql injection
CVE-2026-1120865.3 MediumESPnet Inference Model inference_model.py build_model deserialization
CVE-2026-942735.3 MediumSnap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment
CVE-2026-1060145.3 MediumGateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.