Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,123 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-96660 | 7.2 High | User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value | Oct 17, 2026 |
| CVE-2026-104736 | 9.8 Critical | LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter | Oct 17, 2026 |
| CVE-2026-109368 | 6.5 Medium | WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action | Oct 17, 2026 |
| CVE-2026-92715 | 4.3 Medium | Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter | Oct 17, 2026 |
| CVE-2026-107752 | 4.9 Medium | Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie | Oct 17, 2026 |
| CVE-2026-109985 | 6.4 Medium | xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter | Oct 17, 2026 |
| CVE-2026-110268 | 4.9 Medium | Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter | Oct 17, 2026 |
| CVE-2026-111602 | 3.7 Low | Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter | Oct 17, 2026 |
| CVE-2026-110653 | 9.1 Critical | Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter | Oct 17, 2026 |
| CVE-2026-109208 | 7.2 High | LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters | Oct 17, 2026 |
| CVE-2026-111601 | 6.1 Medium | Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter | Oct 17, 2026 |
| CVE-2026-104734 | 7.2 High | Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import | Oct 17, 2026 |
| CVE-2026-107762 | 7.5 High | Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter | Oct 17, 2026 |
| CVE-2026-107763 | 4.3 Medium | Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook | Oct 17, 2026 |
| CVE-2026-111855 | 7.5 High | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to… | Oct 17, 2026 |
| CVE-2026-111854 | 8.1 High | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient… | Oct 17, 2026 |
| CVE-2026-111853 | 8.8 High | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote… | Oct 17, 2026 |
| CVE-2026-111823 | 9.8 Critical | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider. | Oct 16, 2026 |
| CVE-2026-89096 | 5.9 Medium | Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd | Oct 16, 2026 |
| CVE-2026-89088 | 5.5 Medium | Parted: parted: denial of service via heap buffer overflow during fat16 resize | Oct 16, 2026 |
| CVE-2026-89085 | 6.6 Medium | Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image | Oct 16, 2026 |
| CVE-2026-110759 | 9.8 Critical | Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse | Oct 16, 2026 |
| CVE-2026-110758 | 7.5 High | Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace | Oct 16, 2026 |
| CVE-2026-110757 | 9.8 Critical | Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine | Oct 16, 2026 |
| CVE-2026-110756 | 9.8 Critical | Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print | Oct 16, 2026 |
| CVE-2026-110755 | 7.5 High | Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline | Oct 16, 2026 |
| CVE-2026-110754 | 6.5 Medium | Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline | Oct 16, 2026 |
| CVE-2026-110753 | 9.8 Critical | Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline | Oct 16, 2026 |
| CVE-2026-110752 | 7.5 High | Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment | Oct 16, 2026 |
| CVE-2026-111802 | 6.6 Medium | Nautilus: nautilus: arbitrary file deletion via trash symlink | Oct 16, 2026 |
| CVE-2026-17591 | 3.6 Low | Libarchive: libarchive: use-after-free via aliased mac metadata copy | Oct 16, 2026 |
| CVE-2026-111044 | 7.6 High | Disabled Sunshine clients can bypass revocation with a derived client certificate | Oct 16, 2026 |
| CVE-2026-62438 | 6.1 Medium | Gimp: gimp: paa integer overflow out-of-bounds read | Oct 16, 2026 |
| CVE-2026-62439 | 7.0 High | Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability | Oct 16, 2026 |
| CVE-2026-108372 | 7.1 High | LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files | Oct 16, 2026 |
| CVE-2026-49410 | 8.1 High | OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation | Oct 16, 2026 |
| CVE-2026-96627 | 8.8 High | Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) | Oct 16, 2026 |
| CVE-2026-68498 | 7.5 High | jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service | Oct 16, 2026 |
| CVE-2026-96628 | 4.3 Medium | Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` | Oct 16, 2026 |
| CVE-2026-96626 | 8.5 High | Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host | Oct 16, 2026 |
| CVE-2026-96542 | 5.0 Medium | EA Javelin Anticheat Installer Local Privilege Escalation | Oct 16, 2026 |
| CVE-2026-64862 | 6.5 Medium | Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS | Oct 16, 2026 |
| CVE-2026-55796 | 6.5 Medium | Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report | Oct 16, 2026 |
| CVE-2026-108373 | 6.5 Medium | ERPNext: Unauthorised access to financial data due to missing validation | Oct 16, 2026 |
| CVE-2026-108374 | 7.7 High | ERPNext: Unauthorised status modification due to missing validation | Oct 16, 2026 |
| CVE-2026-102834 | 7.5 High | JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS | Oct 16, 2026 |
| CVE-2026-108743 | 8.8 High | Apache Kylin: spark job OS command injection | Oct 16, 2026 |
| CVE-2026-96620 | 9.2 Critical | Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution | Oct 16, 2026 |
| CVE-2026-30971 | 8.8 High | ZoneMinder: Authenticated RCE via command injection in monitor Device Path | Oct 16, 2026 |
| CVE-2026-108709 | 9.8 Critical | Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) | Oct 16, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.