Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,123 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-111383 | 7.1 High | Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket | Oct 16, 2026 |
| CVE-2026-111382 | 8.7 High | FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine | Oct 16, 2026 |
| CVE-2026-111381 | 7.0 High | FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser | Oct 16, 2026 |
| CVE-2026-111380 | 8.7 High | FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends | Oct 16, 2026 |
| CVE-2026-111379 | 7.0 High | FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3 | Oct 16, 2026 |
| CVE-2026-111378 | 8.7 High | FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser | Oct 16, 2026 |
| CVE-2026-111377 | 7.1 High | FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly | Oct 16, 2026 |
| CVE-2026-111376 | 2.3 Low | FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZE | Oct 16, 2026 |
| CVE-2026-111375 | 6.3 Medium | FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title | Oct 16, 2026 |
| CVE-2026-111374 | 6.0 Medium | FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest | Oct 16, 2026 |
| CVE-2026-111373 | 6.9 Medium | FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping | Oct 16, 2026 |
| CVE-2026-111237 | 4.8 Medium | Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection | Oct 16, 2026 |
| CVE-2026-111212 | 2.4 Low | ImprintLab Medical-SAM-Adapter AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection | Oct 16, 2026 |
| CVE-2026-111210 | 6.9 Medium | bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forgery | Oct 16, 2026 |
| CVE-2026-95183 | 8.8 High | An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content. | Oct 16, 2026 |
| CVE-2026-95182 | 10.0 Critical | An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content. | Oct 16, 2026 |
| CVE-2026-88755 | 7.8 High | Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository. | Oct 16, 2026 |
| CVE-2026-46472 | 7.5 High | An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure. | Oct 16, 2026 |
| CVE-2026-46471 | 5.5 Medium | An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory… | Oct 16, 2026 |
| CVE-2026-26846 | 9.8 Critical | Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component | Oct 16, 2026 |
| CVE-2026-106705 | 8.8 High | ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's… | Oct 16, 2026 |
| CVE-2025-66969 | 7.5 High | Integer overflow in OpenModSim (<=1.11.0), leading to denial of service | Oct 16, 2026 |
| CVE-2025-55653 | 5.5 Medium | GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero,… | Oct 16, 2026 |
| CVE-2025-55640 | 5.5 Medium | A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Oct 16, 2026 |
| CVE-2025-52097 | 5.4 Medium | Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper… | Oct 16, 2026 |
| CVE-2026-84823 | 7.1 High | Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role | Oct 15, 2026 |
| CVE-2026-92777 | 5.4 Medium | A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code. | Oct 15, 2026 |
| CVE-2026-92629 | 7.0 High | A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges. | Oct 15, 2026 |
| CVE-2026-89062 | 6.8 Medium | A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error. | Oct 15, 2026 |
| CVE-2026-89057 | 7.0 High | A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access. | Oct 15, 2026 |
| CVE-2026-75941 | 8.6 High | A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code. | Oct 15, 2026 |
| CVE-2026-16755 | 6.0 Medium | A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information. | Oct 15, 2026 |
| CVE-2026-16754 | 5.9 Medium | A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications. | Oct 15, 2026 |
| CVE-2026-110914 | 8.8 High | Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Oct 15, 2026 |
| CVE-2026-110915 | 8.8 High | Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Oct 15, 2026 |
| CVE-2026-110916 | 9.6 Critical | Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Oct 15, 2026 |
| CVE-2026-110920 | 8.8 High | Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 15, 2026 |
| CVE-2026-110921 | 8.8 High | Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 15, 2026 |
| CVE-2026-110917 | 4.3 Medium | Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High) | Oct 15, 2026 |
| CVE-2026-110918 | 4.3 Medium | Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High) | Oct 15, 2026 |
| CVE-2026-110919 | 8.8 High | Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 15, 2026 |
| CVE-2026-110913 | 8.8 High | Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 15, 2026 |
| CVE-2026-110922 | 8.8 High | Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 15, 2026 |
| CVE-2026-111369 | 7.1 High | ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes | Oct 15, 2026 |
| CVE-2026-111368 | 6.1 Medium | ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes | Oct 15, 2026 |
| CVE-2026-111367 | 6.9 Medium | BillionMail through 4.9 Forgeable JWTs via Default Signing Key | Oct 15, 2026 |
| CVE-2026-111366 | 8.6 High | cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints | Oct 15, 2026 |
| CVE-2026-111365 | 7.0 High | cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints | Oct 15, 2026 |
| CVE-2026-111364 | 7.1 High | MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch | Oct 15, 2026 |
| CVE-2026-111363 | 7.1 High | BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox | Oct 15, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.