Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,116 vulnerabilities match.

CVESeveritySummary
CVE-2026-1118764.8 Mediumalexpasmantier television entry.rs output command injection
CVE-2026-1118755.1 MediumDavid-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization
CVE-2026-1118746.3 MediumOpenCATS Career Portal CareersUI.php processLogin excessive authentication
CVE-2026-1118736.9 Mediumitsmeravitejak Online-Examination-System AJAX Endpoint exammanger.php topicslist sql injection
CVE-2026-1118726.9 Mediumitsmeravitejak Online-Examination-System database.php getreport sql injection
CVE-2026-1118716.9 Mediumitsmeravitejak Online-Examination-System subjectsdb.php sql injection
CVE-2026-1118706.9 Mediumitsmeravitejak Online-Examination-System admin.php isAdmin missing authentication
CVE-2026-1118696.9 Mediummakeplane API Endpoint reliance on untrusted inputs in a security decision
CVE-2026-1118685.3 Mediumdatastax pulsar-jms PulsarObjectMessage.java decode deserialization
CVE-2026-1119976.3 Mediumip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.
CVE-2026-1118666.9 MediumnemoTyrant manong func.php arr2sql sql injection
CVE-2026-1118654.8 MediumTHU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection
CVE-2026-1108824.3 MediumWordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerability
CVE-2026-1119346.3 MediumCoder before 2.34.7 IP Spoofing via X-Forwarded-For Header
CVE-2026-1119336.3 MediumCoder before 2.34.2 User Enumeration via Login Placeholder Hash
CVE-2026-1119324.8 MediumCoder before 2.34.2 Stored HTML Injection via Appearance Settings
CVE-2026-1119315.3 MediumCoder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy
CVE-2026-1119305.3 MediumCoder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
CVE-2026-1119296.0 MediumCoder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC
CVE-2026-1119285.3 MediumCoder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy
CVE-2026-1119278.7 HighCoder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match
CVE-2026-1119264.8 MediumCoder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest
CVE-2026-1119248.7 HighFleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression
CVE-2026-1119238.7 HighFleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
CVE-2026-1119227.2 HighVikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins
CVE-2026-1119215.3 MediumVikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion
CVE-2026-1119205.3 MediumVikunja 2.6.0 Broken Access Control via Inherited Project Permissions
CVE-2026-1119197.1 HighVikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
CVE-2026-1119185.3 MediumVikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation
CVE-2026-1119177.1 HighVikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation
CVE-2026-1119166.9 MediumAdmidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed
CVE-2026-1119147.1 HighAdmidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php
CVE-2026-1119135.3 MediumAdmidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php
CVE-2026-1119127.1 HighAdmidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update
CVE-2026-1119119.3 CriticalphpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
CVE-2026-1119107.1 HighphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads
CVE-2026-1119097.2 HighphpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API
CVE-2026-1119088.7 HighphpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API
CVE-2026-1119077.1 HighphpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database
CVE-2026-1119067.1 HighphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations
CVE-2026-1119057.0 HighphpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data
CVE-2026-1119046.9 MediumphpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API
CVE-2026-1119035.1 MediumphpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass
CVE-2026-1119026.9 MediumphpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API
CVE-2026-1119018.7 HighphpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination
CVE-2026-1119005.3 MediumphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php
CVE-2026-1118987.7 HighphpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking
CVE-2026-1118977.1 HighphpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints
CVE-2026-1118965.1 MediumphpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass
CVE-2026-1118957.6 HighphpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.