Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,123 vulnerabilities match.

CVESeveritySummary
CVE-2026-690807.5 HighApache Kylin: Broken Access Control in QuerySQLBlacklistController
CVE-2026-1026089.0 CriticalZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)
CVE-2026-690777.5 HighApache Kylin: JobController allows unauthorized cross-project manipulation
CVE-2026-690767.5 HighApache Kylin: Unauthorized cross-project job discard
CVE-2026-685739.8 CriticalApache Kylin: Unauthenticated Metastore Cleanup
CVE-2026-685727.5 HighApache Kylin: Unauthorized SQL execution to Spark SQL env
CVE-2026-1026078.8 HighZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
CVE-2026-599707.7 HighTandoor Recipes: Blind SSRF via AI provider URL (api_base)
CVE-2026-617268.1 HighTandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content
CVE-2026-599665.7 MediumTandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns
CVE-2026-599637.1 HighTandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints
CVE-2026-170685.4 MediumIBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System
CVE-2026-170735.4 MediumIBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System
CVE-2026-172753.7 LowIBM i is Affected by an Improper Validation Vulnerability
CVE-2026-174884.3 MediumIBM i is Affected By An Improper Authentication Vulnerability in SST / DST
CVE-2026-174915.4 MediumIBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSH
CVE-2026-1029177.8 HighIBM i is Affected By An Improper Privilege Management Vulnerability
CVE-2026-1117934.3 MediumOpenwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing…
CVE-2026-859775.3 MediumLibtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding
CVE-2026-852316.5 MediumLibtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding
CVE-2026-1076745.1 MediumIBM i is Affected by a Denial of Service in Digital Certificate Manager
CVE-2026-1098385.1 MediumIBM Db2 Genius Hub Improper verification of cryptographic signature
CVE-2026-890985.5 MediumNfs-utils: nfs-utils: denial of service via assertion failure in fsidd
CVE-2026-1117238.7 HighLingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API
CVE-2026-1117228.6 HighLingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API
CVE-2026-1117215.3 MediumOpen WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scoping
CVE-2026-1117206.9 Mediumfish-island-backend through commit 7c61b78 SSRF via /api/web/parse
CVE-2026-1117198.2 HighRoncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/query
CVE-2026-1117187.1 HighAipexBase through commit 690adb9 SQL Injection via /api/data/invoke
CVE-2026-1117175.3 MediumArkon through 0.9.2 Missing Authorization via Skills Versions API
CVE-2026-1117165.3 MediumArkon through 0.9.2 Broken Access Control via Sources By-ID Routes
CVE-2026-1117155.3 MediumArkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API
CVE-2026-1117142.3 Lowtarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge
CVE-2026-1117135.1 Mediumtarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch
CVE-2026-1117126.9 MediumNetcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix
CVE-2026-1117119.3 CriticalNetcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()
CVE-2026-1117108.7 HighNetcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS
CVE-2026-1117095.3 MediumWhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId
CVE-2026-1117089.3 CriticalWhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup
CVE-2026-1117076.9 Medium99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure
CVE-2026-1117068.7 High99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel
CVE-2026-1117055.3 MediumFuint through commit 57ec018 IDOR via bookId in myBookDetail
CVE-2026-1117049.3 CriticalLangChat through commit 2a6285a Missing Authentication on REST API Controllers
CVE-2026-1117035.3 Mediumyshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints
CVE-2026-1117028.7 HighChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases
CVE-2026-814527.0 HighDell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of…
CVE-2026-1117018.3 HighOtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API
CVE-2026-1117007.1 HighWebVella ERP through 1.8.8 SQL Injection via EQL Query API
CVE-2026-1116996.3 MediumNiefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie
CVE-2026-1116987.1 HighHUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.