Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,116 vulnerabilities match.

CVESeveritySummary
CVE-2026-984518.8 Highsmb: client: use finish_no_open() for non-regular inodes
CVE-2026-98450Not scoredsmb: client: close completed creates on compound wait errors
CVE-2026-98449Not scoredsmb: client: delete compound mids on send failure before unlock
CVE-2026-98448Not scoredxfs: release orphanage dir inode if chown fails
CVE-2026-98447Not scoredxfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots
CVE-2026-98446Not scoredxfs: don't let hidden_space go negative in xfs_metafile_resv_init
CVE-2026-98445Not scoredxfs: don't let memory failures leak blocks and kill repairs
CVE-2026-98444Not scoredxfs: drop dquot flush lock when we can't find a buffer to flush
CVE-2026-984437.8 Highxfs: fix cursor and pointer handling when recovering iunlink buckets
CVE-2026-984427.8 Highnet/sched: act_ct: fix helper UAF due to extensions realloc
CVE-2026-984417.8 Highnet/sched: act_ct: avoid modifying shared unconfirmed ct entry
CVE-2026-984407.0 HighKVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction
CVE-2026-1119915.3 MediumWongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.__init__ code injection
CVE-2026-98439Not scoredsmb/server: cancel async requests when closing connection
CVE-2026-98438Not scoredmptcp: options: fix uninit-value in mptcp_write_data_fin
CVE-2026-98437Not scoredmedia: qcom: iris: fix runtime PM reference leaks
CVE-2026-984367.8 Highaccel/amdxdna: Disable device buffer exporting
CVE-2026-98435Not scoredEDAC/altera: Use parent device for devres in altr_portb_setup()
CVE-2026-1119906.9 Mediumkishan0725 Hospital Management System Appointment Cancellation admin-panel.php mysqli_query sql injection
CVE-2026-98434Not scoredsysctl: Check range in proc_dointvec_ms_jiffies_minmax
CVE-2026-98433Not scoredKVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
CVE-2026-1100246.8 Medium@fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults
CVE-2026-1119885.3 Mediumdyad-sh dyad OAuth Callback cross-site request forgery
CVE-2026-1119875.3 MediumAUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting
CVE-2026-1119865.3 MediumAUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection
CVE-2026-1120636.0 Mediumlibstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hi
CVE-2026-1120626.0 MediumlwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
CVE-2026-1120615.3 Mediumlibrtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Read via AMFProp_Decode
CVE-2026-1120606.1 Mediumlibrtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3_Decode
CVE-2026-1120596.9 MediumlibLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR
CVE-2026-1120586.8 Mediumlibdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT
CVE-2026-1120576.8 Mediumlibdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters
CVE-2026-1120566.8 MediumwvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH
CVE-2026-1120556.8 MediumwvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP
CVE-2026-1120546.8 MediumSchroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsing
CVE-2026-1120536.8 MediumSchroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_default_quant_matrix
CVE-2026-1120526.9 Mediumlibspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing
CVE-2026-1120518.3 HighXinference through 4.0.1 Path Traversal via model_name in Custom Model Registration
CVE-2026-1120502.3 LowGitify before 7.10.0 Login CSRF via Missing OAuth State Validation
CVE-2026-1120496.7 MediumVita3K before build 4187 Path Traversal via VPK Package Installation
CVE-2026-1120486.9 Mediumlibspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count
CVE-2026-1120475.3 MediumOneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
CVE-2026-1120466.8 MediumOW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()
CVE-2026-1119855.3 MediumAUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resources
CVE-2026-1119845.3 MediumAUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting
CVE-2026-1120218.7 Highsnac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()
CVE-2026-1120206.9 MediumLodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()
CVE-2026-1120196.9 Mediumcgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()
CVE-2026-1120187.3 Highcgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()
CVE-2026-1120177.1 HighJeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.