Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,055 vulnerabilities match.

CVESeveritySummary
CVE-2026-1120305.3 Mediumdiem-project diem dmDataLoad.php default password
CVE-2026-1121122.3 LowAn IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure.…
CVE-2026-1120292.0 Lowdiem-project diem SHA1 PluginDmUser.class.php weak password hash
CVE-2026-1120286.9 Mediumlight0011 cms Vote VoteController.class.php logic error
CVE-2026-1121115.1 MediumThe Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an…
CVE-2026-1120276.9 Mediumlight0011 cms Uploadify check-exists.php file_exists file information disclosure
CVE-2026-1120266.3 Mediumlight0011 cms UserModel.class.php sha1 weak password hash
CVE-2026-1120256.9 Mediumlight0011 cms Captcha Validation UserController.class.php access control
CVE-2026-978596.5 MediumGitea API disclosure of private user social graph, keys and stars
CVE-2026-972043.1 LowGitea label deletion across repository and organization IDs
CVE-2026-1104946.3 MediumGitea release attachment re-linking of issue attachments
CVE-2026-1103246.5 MediumGitea private profile information disclosure through POST request
CVE-2026-1103114.3 MediumGitea draft release creation disclosing attachment metadata
CVE-2026-1098444.3 MediumGitea watched repositories API disclosure after access revocation
CVE-2026-1076864.3 MediumGitea reactions accepted on locked issues and comments
CVE-2026-1076188.1 HighGitea cross-site request forgery on repository topics
CVE-2026-1059646.5 MediumGitea Actions artifact v4 API unbounded request body
CVE-2026-1056615.3 MediumGitea panic on the repositories route of individual users
CVE-2026-1095537.5 HighGitea SSH certificate principal impersonation of other users
CVE-2026-1046275.4 MediumGitea OpenID account linking without session binding
CVE-2024-44579.1 CriticalRemote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
CVE-2026-1119934.8 MediumSoarkey StudentManagement AdminDao.java UserDao.login cleartext storage
CVE-2026-1119925.3 Mediumitsmeravitejak Online-Examination-System Exam exam.php startExam sql injection
CVE-2026-98868Not scoreddm-pcache: reject a kset that overruns its segment
CVE-2026-98867Not scoreddm-pcache: bound the logical key offset from persistent memory
CVE-2026-98866Not scoredsched/cache: Introduce task_struct->sched_cache_grp to fix UAF
CVE-2026-98865Not scoredsched_ext: Don't run ops.dequeue() with a DSQ lock held
CVE-2026-98864Not scoredsched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task
CVE-2026-98863Not scoredKVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
CVE-2026-98862Not scoredaudit: fix exe mark UAF in kill_rules()
CVE-2026-98861Not scoredfprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
CVE-2026-98860Not scoredHID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
CVE-2026-98859Not scoredHID: multitouch: stop the release timer from being rearmed on remove
CVE-2026-98858Not scoredio_uring: fix task_work add use-after-free with SQPOLL
CVE-2026-98857Not scoredipvs: bound LBLCR and LBLC cache growth
CVE-2026-98856Not scoredkprobes: Skip disarmed probes when checking optkprobe overlap
CVE-2026-98855Not scoredof/overlay: put property on deadprops only after changeset add succeeds
CVE-2026-98854Not scoredof/overlay: only treat a positive changeset id as registered
CVE-2026-98853Not scorednet: gso: limit recursive IP-in-IP segmentation
CVE-2026-98852Not scorednet: extend IPv6 exthdr detection of tunneled packets
CVE-2026-98851Not scorednetfilter: nft_flow_offload: drop flowtable reference on init error path
CVE-2026-98850Not scorednet/packet: prevent TX_RING byte count overflow
CVE-2026-98849Not scoredpfcp: fix socket lifetime on netdevice registration failure
CVE-2026-98848Not scoredrtc: ac100: Assign .num before accessing .hws
CVE-2026-98847Not scoredrtc: spear: initialize IRQ state before requesting alarm IRQ
CVE-2026-98846Not scoredsctp: check RCV_SHUTDOWN after the sendmsg connect wait
CVE-2026-98845Not scoredtpm: Disable TPM on null key name mismatch
CVE-2026-98844Not scorednetfs: clear post-EOF pagecache when extending a file via write
CVE-2026-98843Not scorednetfs: zero gaps in read-gaps folio to avoid writing back stale data
CVE-2026-98842Not scoredmodule: fix lost error code from codetag_load_module()

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.