Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,123 vulnerabilities match.

CVESeveritySummary
CVE-2026-1113597.1 HighCRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift
CVE-2026-1113585.3 MediumSendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form
CVE-2026-1113569.1 CriticalMacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force
CVE-2026-1113555.3 Mediumzhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints
CVE-2026-1113542.3 Lowcrmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints
CVE-2026-1113535.3 MediumPeppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints
CVE-2026-1113528.7 HighThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API
CVE-2026-1113512.3 Lowmetasfresh through 5.175 Authorization Bypass via /rest/api/board REST API
CVE-2026-1113502.3 LowPapermark through 0.22.0 Missing Authorization in Data Room Viewer Group API
CVE-2026-1113496.9 MediumCraftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL
CVE-2026-1113485.3 MediumLikeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints
CVE-2026-1113478.2 Highgo-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd
CVE-2026-1113465.3 MediumZenTao PMS through 22.6 Authorization Bypass via action::editComment
CVE-2026-1113455.3 MediumTrudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id
CVE-2026-1113445.3 MediumAPITable through 1.14.0-beta Authorization Bypass via GET /node/{nodeId}/description
CVE-2026-1113435.3 Mediumpig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}
CVE-2026-1113326.3 MediumOxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie
CVE-2026-1113315.3 MediumDokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router
CVE-2026-1113308.2 HighJuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1
CVE-2026-1113299.3 CriticalJuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console
CVE-2026-1113246.9 Mediumrustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo
CVE-2026-1113236.9 MediumRedAmon through 7.0.1 Unauthenticated SSRF via /tradecraft/verify Endpoint
CVE-2026-1113229.3 CriticalArchon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API
CVE-2026-1113215.3 MediumTaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions
CVE-2026-1113206.9 MediumValueCell through 0.1.20 Unauthenticated SSRF via /api/v1/models/check
CVE-2026-1113137.1 HighJobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch
CVE-2026-1113129.2 CriticalOpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route
CVE-2026-1112845.1 MediumAureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
CVE-2026-1112839.5 CriticalBMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration
CVE-2026-1112828.8 Highiso14229 before 0.10.1 Out-of-Bounds Read via Handle_0x38_RequestFileTransfer
CVE-2026-1112819.3 CriticalJooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials
CVE-2026-1112808.3 Highsnap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea
CVE-2026-1112798.7 HighDragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER
CVE-2026-1112786.9 MediumNivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML
CVE-2026-1112778.7 HighNivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download
CVE-2026-1112756.9 Mediumnifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim
CVE-2026-1112746.8 Mediumunarr through 1.1.1 Heap Out-of-Bounds Read via zip_parse_extra_fields
CVE-2026-1112736.9 Mediumunarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name
CVE-2026-1112726.8 MediumLibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo
CVE-2026-1112716.8 Mediumlibmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2
CVE-2026-1112706.9 Mediumlibmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM
CVE-2026-1112696.9 Mediumlibical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string
CVE-2024-583976.9 MediumMP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters
CVE-2026-941354.3 MediumApache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
CVE-2026-968065.8 MediumApache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
CVE-2026-941349.1 CriticalApache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
CVE-2026-922286.5 MediumApache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
CVE-2026-1094687.5 HighASP.NET Core Denial of Service Vulnerability
CVE-2026-1084556.5 MediumMicrosoft Office PowerPoint Information Disclosure Vulnerability
CVE-2026-1084546.5 MediumMicrosoft Office PowerPoint Information Disclosure Vulnerability

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.