Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,123 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-111697 | 7.1 High | HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs | Oct 16, 2026 |
| CVE-2026-111696 | 7.1 High | data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords | Oct 16, 2026 |
| CVE-2026-111695 | 7.1 High | Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API | Oct 16, 2026 |
| CVE-2026-111694 | 6.9 Medium | qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints | Oct 16, 2026 |
| CVE-2026-111693 | 9.3 Critical | DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials | Oct 16, 2026 |
| CVE-2026-111692 | 9.3 Critical | DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret | Oct 16, 2026 |
| CVE-2026-111691 | 9.1 Critical | WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header | Oct 16, 2026 |
| CVE-2026-111690 | 9.3 Critical | Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass | Oct 16, 2026 |
| CVE-2026-111689 | 5.3 Medium | XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint | Oct 16, 2026 |
| CVE-2026-111688 | 5.3 Medium | Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter | Oct 16, 2026 |
| CVE-2026-111687 | 9.3 Critical | WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint | Oct 16, 2026 |
| CVE-2026-111686 | 8.7 High | IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum | Oct 16, 2026 |
| CVE-2026-111685 | 8.7 High | IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum | Oct 16, 2026 |
| CVE-2026-111684 | 7.2 High | Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service | Oct 16, 2026 |
| CVE-2026-111683 | 5.3 Medium | Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API | Oct 16, 2026 |
| CVE-2026-111682 | 7.1 High | EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys | Oct 16, 2026 |
| CVE-2026-111681 | 8.7 High | EFAK through 5.1.0 Privilege Escalation via /api/users REST API | Oct 16, 2026 |
| CVE-2026-111680 | 7.2 High | APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter | Oct 16, 2026 |
| CVE-2026-111679 | 5.3 Medium | Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips | Oct 16, 2026 |
| CVE-2026-111678 | 4.8 Medium | Antiword through 0.37 Stack Out-of-Bounds Read via prop8.c FKP Parsing | Oct 16, 2026 |
| CVE-2026-111677 | 6.8 Medium | Antiword through 0.37 Heap Out-of-Bounds Read via vGet8LstInfo in prop8.c | Oct 16, 2026 |
| CVE-2026-111676 | 5.3 Medium | Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint | Oct 16, 2026 |
| CVE-2026-111675 | 9.1 Critical | Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover | Oct 16, 2026 |
| CVE-2026-111674 | 5.3 Medium | Tbed through 20240319 Missing Authorization via setImgFileName Endpoint | Oct 16, 2026 |
| CVE-2026-111673 | 9.3 Critical | IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints | Oct 16, 2026 |
| CVE-2026-111672 | 5.3 Medium | Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints | Oct 16, 2026 |
| CVE-2026-111671 | 7.1 High | Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints | Oct 16, 2026 |
| CVE-2026-111670 | 5.3 Medium | ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module | Oct 16, 2026 |
| CVE-2026-111669 | 7.1 High | ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY | Oct 16, 2026 |
| CVE-2026-111668 | 5.3 Medium | AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API | Oct 16, 2026 |
| CVE-2026-111667 | 5.3 Medium | REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint | Oct 16, 2026 |
| CVE-2026-111666 | 5.3 Medium | Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports API | Oct 16, 2026 |
| CVE-2026-111665 | 5.3 Medium | Piranha CMS through 12.2 Missing Authorization in Manager Language API | Oct 16, 2026 |
| CVE-2026-111664 | 4.8 Medium | Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url | Oct 16, 2026 |
| CVE-2026-111663 | 9.2 Critical | Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation | Oct 16, 2026 |
| CVE-2026-111662 | 6.9 Medium | Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint | Oct 16, 2026 |
| CVE-2026-111661 | 6.9 Medium | waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint | Oct 16, 2026 |
| CVE-2026-111660 | 6.9 Medium | waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid | Oct 16, 2026 |
| CVE-2026-111659 | 6.9 Medium | Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit | Oct 16, 2026 |
| CVE-2026-111658 | 5.1 Medium | SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API | Oct 16, 2026 |
| CVE-2026-111657 | 5.3 Medium | BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint | Oct 16, 2026 |
| CVE-2026-111656 | 5.3 Medium | ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints | Oct 16, 2026 |
| CVE-2026-111655 | 5.1 Medium | ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit | Oct 16, 2026 |
| CVE-2026-111654 | 5.3 Medium | FastBee through 2.1.0 IDOR via /iot/group By-ID Endpoints | Oct 16, 2026 |
| CVE-2026-111653 | 6.9 Medium | 53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id | Oct 16, 2026 |
| CVE-2026-111652 | 6.9 Medium | Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment | Oct 16, 2026 |
| CVE-2026-111651 | 7.1 High | Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController | Oct 16, 2026 |
| CVE-2026-111650 | 8.8 High | ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API | Oct 16, 2026 |
| CVE-2026-111649 | 7.1 High | Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint | Oct 16, 2026 |
| CVE-2026-111648 | 5.1 Medium | BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter | Oct 16, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.