Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,123 vulnerabilities match.

CVESeveritySummary
CVE-2026-1116475.3 MediumPickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id}
CVE-2026-1116468.2 HighSurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview
CVE-2026-1116455.3 MediumMrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint
CVE-2026-1116446.9 MediumMisaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes
CVE-2026-1116439.3 CriticalMisaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback
CVE-2026-1116428.7 HighFastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation
CVE-2026-1116419.3 CriticalFastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints
CVE-2026-1116405.3 MediumDooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs
CVE-2026-1116398.6 Highbbs-go through 4.4.6 Account Takeover via Google One Tap Login
CVE-2026-1116388.3 Highsshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keys
CVE-2026-1116376.9 MediumNexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint
CVE-2026-1116369.2 CriticalOpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret
CVE-2026-1116355.3 MediumHelical Insight through 7.0.0 Path Traversal via /getExternalResource
CVE-2026-1116348.6 HighHelical Insight through 7.0.0 SQL Injection via /executeDatasource
CVE-2026-1116338.8 HighZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key
CVE-2026-1116325.3 MediumAureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id
CVE-2026-1116315.3 MediumDistributor before 2.3.2 Missing Authorization in External Connection AJAX Actions
CVE-2026-1116305.3 Mediumabp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations
CVE-2026-1116295.3 MediumIoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs
CVE-2026-1116282.3 Low10up Distributor before 2.3.2 PHP Object Injection via set_meta()
CVE-2026-1116278.6 HighHestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation
CVE-2026-1116269.3 CriticalWebreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers
CVE-2026-1116255.3 Medium10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action
CVE-2026-1116246.3 MediumUmbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs
CVE-2026-1116236.3 MediumXiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance
CVE-2026-1116227.6 Highsmart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri
CVE-2026-1116215.3 MediumTDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}
CVE-2026-1116206.0 MediumO2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint
CVE-2026-1116197.1 HighFilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php
CVE-2026-1116186.9 MediumCoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints
CVE-2026-1116176.9 MediumWHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints
CVE-2026-1116166.9 MediumOqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API
CVE-2026-1116157.1 HighMall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint
CVE-2026-1116147.1 HighDataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials
CVE-2026-1116138.7 HighAllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test
CVE-2026-1116128.7 Highnetdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth
CVE-2026-1116115.3 Mediumroncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints
CVE-2026-1116105.3 MediumB3log Solo through 4.4.0 Missing Authorization in ArticleConsole
CVE-2026-1116095.1 MediumPKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription
CVE-2026-1116082.3 LowJeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}
CVE-2026-1116077.1 HighJeepay through 3.2.9 IDOR via POST /api/mch/payConfigs
CVE-2026-1116068.6 HighHuly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC
CVE-2026-1116058.6 HighJpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController
CVE-2026-1116045.1 Mediumeladmin through 2.7 Broken Access Control via /api/users Update and Delete
CVE-2026-1116035.3 MediumPlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints
CVE-2026-1113926.3 MediumSGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate
CVE-2026-1098393.1 LowIBM Db2 Genius Hub Missing Cryptographic Step
CVE-2026-1025528.2 HighImproper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver
CVE-2026-1025519.2 CriticalImproper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling
CVE-2026-800925.3 MediumMicrosoft Identity Web Elevation of Privilege Vulnerability

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.