Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,123 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-79834 | 7.4 High | HPE NonStop SQL/MX SQLCAT - Unauthorized command execution vulnerability | Oct 15, 2026 |
| CVE-2026-79833 | 7.5 High | HPE NonStop ANSI SQLUTIL - Denial of Service vulnerability | Oct 15, 2026 |
| CVE-2026-109695 | 7.5 High | WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability | Oct 15, 2026 |
| CVE-2026-109694 | 9.8 Critical | WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability | Oct 15, 2026 |
| CVE-2026-108491 | 7.1 High | WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability | Oct 15, 2026 |
| CVE-2026-108497 | 9.3 Critical | WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability | Oct 15, 2026 |
| CVE-2026-108498 | 7.1 High | WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability | Oct 15, 2026 |
| CVE-2026-79832 | 7.6 High | HPE NonStop SQL/MX Executor - Buffer overflow vulnerability | Oct 15, 2026 |
| CVE-2026-79831 | 6.6 Medium | HPE NonStop Posix User Threads - Heap buffer overflow vulnerability | Oct 15, 2026 |
| CVE-2026-79830 | 6.6 Medium | HPE NonStop Kernel Level Thread Model Lib - Stack buffer overflow vulnerability | Oct 15, 2026 |
| CVE-2026-17525 | 5.1 Medium | My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversion | Oct 15, 2026 |
| CVE-2026-79829 | 8.2 High | HPE NonStop HTTP WEBSERVER - Memory corruption vulnerability | Oct 15, 2026 |
| CVE-2026-79828 | 7.1 High | HPE NonStop Debug Utilities - Heap buffer overflow vulnerability | Oct 15, 2026 |
| CVE-2026-79827 | 7.1 High | HPE NonStop Inspect Subsystem - Heap buffer overflow vulnerability | Oct 15, 2026 |
| CVE-2026-18659 | 6.9 Medium | Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring | Oct 15, 2026 |
| CVE-2026-18662 | 6.9 Medium | In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet… | Oct 15, 2026 |
| CVE-2026-19864 | 5.6 Medium | Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may… | Oct 15, 2026 |
| CVE-2026-19863 | 9.3 Critical | An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when… | Oct 15, 2026 |
| CVE-2026-79826 | 7.1 High | HPE NonStop OCAX - Heap buffer overflow vulnerability | Oct 15, 2026 |
| CVE-2026-50619 | 9.3 Critical | Unauthenticated remote code execution vulnerability | Oct 15, 2026 |
| CVE-2026-47790 | 6.3 Medium | Privilege Escalation via QuFTP Log-based XSS | Oct 15, 2026 |
| CVE-2026-47786 | 9.3 Critical | Pre-Authentication Command Injection | Oct 15, 2026 |
| CVE-2026-39997 | 8.9 High | Unauthenticated Remote Input Injection in QNAP HD Station's remotepad | Oct 15, 2026 |
| CVE-2026-18660 | 8.8 High | Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames | Oct 15, 2026 |
| CVE-2026-39991 | 4.8 Medium | Stored Cross-Site Scripting (XSS) in Note Station file upload functionality | Oct 15, 2026 |
| CVE-2026-34009 | 8.4 High | **Container Escape** Host user home directory mounted with write access into application container | Oct 15, 2026 |
| CVE-2026-34008 | 8.5 High | **Privilege Escalation** World-writable crontab path monitored and executed by root-owned process | Oct 15, 2026 |
| CVE-2026-34007 | 6.9 Medium | **RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP validation fallback in `getClientIP()` | Oct 15, 2026 |
| CVE-2026-53882 | 8.7 High | Path Traversal in Virtualization Station VM Import | Oct 15, 2026 |
| CVE-2026-50612 | 9.4 Critical | Import Symlink Following Remote Code Execution Vulnerability in QuMagie | Oct 15, 2026 |
| CVE-2026-44084 | 8.7 High | Access Code Forgery in Video Station leading to unauthorized media access | Oct 15, 2026 |
| CVE-2026-41545 | 8.6 High | WebSocket timelapse path traversal and command injection | Oct 15, 2026 |
| CVE-2026-41541 | 5.3 Medium | Symlink creation in qsyncsrv.cgi | Oct 15, 2026 |
| CVE-2026-39989 | 5.3 Medium | SSRF in QNAP Download Station | Oct 15, 2026 |
| CVE-2026-34015 | 8.7 High | Remote Code Execution in upload.php of Video Station | Oct 15, 2026 |
| CVE-2026-34014 | 8.4 High | ds-move-files.sh is writable and executed as root | Oct 15, 2026 |
| CVE-2026-34006 | 9.3 Critical | Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer | Oct 15, 2026 |
| CVE-2026-26245 | 7.1 High | SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset | Oct 15, 2026 |
| CVE-2026-26244 | 7.1 High | SQLi#1 SQL Injection in class_videos.php _getFilters | Oct 15, 2026 |
| CVE-2026-26243 | 7.2 High | Arbitrary Folder Deletion in Qsync Central 5.0.0.5 | Oct 15, 2026 |
| CVE-2026-79825 | 7.1 High | HPE NonStop NDSREST - Heap buffer overflow vulnerability | Oct 15, 2026 |
| CVE-2026-79824 | 8.0 High | HPE NonStop Python 3.x - Directory traversal vulnerability | Oct 15, 2026 |
| CVE-2026-18661 | 8.8 High | In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the… | Oct 15, 2026 |
| CVE-2026-79823 | 4.0 Medium | HPE NonStop EMS Distributor - Buffer Overflow vulnerability | Oct 15, 2026 |
| CVE-2026-63315 | 8.2 High | Plaintext storage of a password in WebCTI | Oct 15, 2026 |
| CVE-2026-63314 | 8.7 High | SQL Injection in WebCTI | Oct 15, 2026 |
| CVE-2026-35088 | 8.2 High | Inadequate Encryption Strength in Slican telephone exchanges | Oct 15, 2026 |
| CVE-2026-101287 | 9.3 Critical | Authentication bypass in Stela by Diaple Networking | Oct 15, 2026 |
| CVE-2026-101290 | 7.5 High | CVE-2026-101290 | Oct 15, 2026 |
| CVE-2026-77711 | 8.2 High | When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request… | Oct 15, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.