Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,055 vulnerabilities match.

CVESeveritySummary
CVE-2026-892865.3 MediumFormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
CVE-2026-910475.3 MediumElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter
CVE-2026-910464.3 MediumElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing Authorization
CVE-2026-1069336.8 MediumBlaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload
CVE-2026-1060285.3 MediumActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation
CVE-2026-767394.3 MediumHPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server, Remote RMC file modification
CVE-2026-1120836.9 Mediumsgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service
CVE-2026-1120828.7 Highsgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service
CVE-2026-1120815.3 Mediumhankcs HanLP Model Config Loading reflection.py hanlp.load deserialization
CVE-2026-1081207.7 Highpath traversal inKoozali - SME Server
CVE-2026-1081216.9 MediumKoozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service
CVE-2026-1120805.3 MediumLlamaChinese Llama-Chinese Adapter Config chat_gradio_no_merge.py get_class_from_dynamic_module code injection
CVE-2026-1120795.3 Mediumhankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization
CVE-2026-1120785.3 MediumRVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection
CVE-2026-1120776.3 Mediumradareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechanism
CVE-2026-1120766.3 Mediumalexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgery
CVE-2026-1114407.0 HighJDBC LogFactory 任意类加载/构造导致潜在 RCE
CVE-2026-1120755.3 Mediumunslothai unsloth sentence_transformer.py externally-controlled input to select classes or code
CVE-2026-1120745.3 MediumTencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflow
CVE-2026-1120735.3 MediumTencent ncnn MatMul matmul.cpp matmul_transb out-of-bounds
CVE-2026-1120455.3 Mediumdonetick History Deletion model.go CanDeleteHistory improper authorization
CVE-2026-1120446.9 Mediumdotnet eShop Catalog API Extensions.cs AddApplicationServices improper authentication
CVE-2026-1114418.1 HighHLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写
CVE-2026-1120435.3 Mediumcalcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization
CVE-2026-1030919.3 CriticalInsecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)
CVE-2026-1025039.3 CriticalMissing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)
CVE-2026-1120425.1 Mediumdiem-project diem dmWidget dmBaseLinkTag.php text cross site scripting
CVE-2026-1120416.3 Mediumdiem-project diem dmString.php random weak prng
CVE-2026-1120405.3 Mediumdiem-project diem Sign-In BasedmUserActions.class.php redirect
CVE-2026-1120394.8 Mediumdiem-project diem Administrative Console actions.class.php append cross site scripting
CVE-2026-1120384.8 Mediumdiem-project diem Version Check Service dmAdminCtrl.js html cross site scripting
CVE-2026-1120376.3 Mediumdiem-project diem Google Analytics Client gapi.class.php certificate validation
CVE-2026-1089847.5 HighGV-ASManager Web Server Buffer Overflow Vulnerability
CVE-2026-1089839.8 CriticalGV-ASManager Web Server Command Injection Vulnerability
CVE-2026-1120365.3 MediumArtifex MuPDF Signature Locking pdf-xref.c free_char_list double free
CVE-2026-1120355.3 Mediumaircheng-org iWebShop-5 simple.php send_message_mobile password recovery
CVE-2026-1120345.3 Mediumaircheng-org iWebShop-5 Login Redirect _userInfo.php redirect
CVE-2026-1120335.3 Mediumaircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgery
CVE-2026-386716.1 MediumCross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of…
CVE-2026-1070848.8 HighSlims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_history_maintenance.php because the action=run GET parameter performs privileged, destructive…
CVE-2026-1070839.8 CriticalSENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.
CVE-2026-1070828.8 HighSlims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied…
CVE-2026-1070819.8 CriticalSQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management…
CVE-2025-604825.5 MediumA heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
CVE-2025-604805.5 MediumA heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
CVE-2025-556675.5 MediumA segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
CVE-2025-556545.5 MediumA use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
CVE-2025-522907.5 HighA NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file.
CVE-2026-1120325.1 Mediumaircheng-org iWebShop-5 util.php search sql injection
CVE-2026-1120315.1 MediumChamilo LMS Ticket TicketManager.php addProject cross site scripting

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.