Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,123 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-101021 | 8.7 High | J4Care dcm4che Inefficient Algorithmic Complexity | Oct 16, 2026 |
| CVE-2026-105273 | 8.7 High | J4Care dcm4che Loop with Unreachable Exit Condition | Oct 16, 2026 |
| CVE-2026-107621 | 8.7 High | J4Care dcm4che Loop with Unreachable Exit Condition | Oct 16, 2026 |
| CVE-2026-97851 | 8.8 High | J4Care dcm4che Missing Authorization | Oct 16, 2026 |
| CVE-2026-105664 | 6.9 Medium | Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy | Oct 16, 2026 |
| CVE-2026-97858 | 6.9 Medium | Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes | Oct 16, 2026 |
| CVE-2026-107617 | 9.3 Critical | Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials | Oct 16, 2026 |
| CVE-2026-110805 | 2.6 Low | Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne… | Oct 16, 2026 |
| CVE-2026-110804 | 4.3 Medium | Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated… | Oct 16, 2026 |
| CVE-2026-110806 | 6.5 Medium | Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data. | Oct 16, 2026 |
| CVE-2026-110287 | 4.3 Medium | Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct… | Oct 16, 2026 |
| CVE-2026-18516 | 9.6 Critical | Improper Encoding or Escaping of Output in Crafty Controller | Oct 16, 2026 |
| CVE-2026-90821 | 5.4 Medium | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller | Oct 16, 2026 |
| CVE-2026-97470 | 6.4 Medium | Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role | Oct 16, 2026 |
| CVE-2026-111413 | 8.8 High | WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability | Oct 16, 2026 |
| CVE-2026-110896 | 5.3 Medium | WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability | Oct 16, 2026 |
| CVE-2026-107564 | 8.7 High | gocsaf/csaf: csaf_provider prone to uncontrolled resource consumption | Oct 16, 2026 |
| CVE-2026-111400 | 6.5 Medium | WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability | Oct 16, 2026 |
| CVE-2026-111396 | 7.1 High | WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability | Oct 16, 2026 |
| CVE-2026-111409 | 5.3 Medium | WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability | Oct 16, 2026 |
| CVE-2026-110903 | 6.5 Medium | WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability | Oct 16, 2026 |
| CVE-2026-110900 | 5.3 Medium | WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability | Oct 16, 2026 |
| CVE-2026-110901 | 5.4 Medium | WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability | Oct 16, 2026 |
| CVE-2026-110380 | 5.3 Medium | WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability | Oct 16, 2026 |
| CVE-2026-111405 | 6.5 Medium | WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability | Oct 16, 2026 |
| CVE-2026-111399 | 8.5 High | WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability | Oct 16, 2026 |
| CVE-2026-111397 | 5.3 Medium | WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability | Oct 16, 2026 |
| CVE-2026-111555 | 6.0 Medium | Luksmeta: missing slot-range validation permits out-of-gap device i/o | Oct 16, 2026 |
| CVE-2026-105958 | 7.5 High | Spice-server: spice: heap oob read/write via unchecked migration data offsets | Oct 16, 2026 |
| CVE-2026-68571 | 8.8 High | Apache Kylin: JDBC URL Whitelist Verification Bypass | Oct 16, 2026 |
| CVE-2026-64959 | 9.8 Critical | Apache Kylin: Missing authentication on certain cache API endpoints | Oct 16, 2026 |
| CVE-2026-64610 | 9.8 Critical | Apache Kylin: Redis unsafe Java deserialization | Oct 16, 2026 |
| CVE-2026-63619 | 9.1 Critical | Apache Kylin: Missing authorization and path-confinement on system meta dump | Oct 16, 2026 |
| CVE-2026-63618 | 7.5 High | Apache Kylin: Low-Privilege Config Exposure | Oct 16, 2026 |
| CVE-2026-105959 | 7.5 High | Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation | Oct 16, 2026 |
| CVE-2026-111391 | 9.2 Critical | SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter | Oct 16, 2026 |
| CVE-2026-111390 | 6.0 Medium | Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API | Oct 16, 2026 |
| CVE-2026-107648 | 7.2 High | WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter | Oct 16, 2026 |
| CVE-2026-110029 | 5.4 Medium | Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment | Oct 16, 2026 |
| CVE-2026-109930 | 5.3 Medium | MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key | Oct 16, 2026 |
| CVE-2026-109119 | 8.8 High | Missing Authorization in rdiffweb | Oct 16, 2026 |
| CVE-2026-109118 | 4.6 Medium | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb | Oct 16, 2026 |
| CVE-2026-14452 | 8.6 High | Open redirect and XSS via reset_url parameter | Oct 16, 2026 |
| CVE-2026-106030 | 6.8 Medium | Missing Authorization in NordVPN for Windows | Oct 16, 2026 |
| CVE-2026-107649 | 5.4 Medium | Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter | Oct 16, 2026 |
| CVE-2026-110703 | 6.4 Medium | GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute | Oct 16, 2026 |
| CVE-2026-96768 | 7.2 High | GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body | Oct 16, 2026 |
| CVE-2026-101300 | 7.1 High | Server-Side Request Forgery in Wegow PDF export | Oct 16, 2026 |
| CVE-2026-15575 | 5.3 Medium | Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's Costifier | Oct 16, 2026 |
| CVE-2026-15219 | 6.5 Medium | IDOR in SFM Software's Costifier | Oct 16, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.