Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,123 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-76661 | 7.6 High | HPE NonStop QIOMON - Memory corruption vulnerability | Oct 15, 2026 |
| CVE-2026-76660 | 8.7 High | HPE NonStop CIPSAM - Memory corruption vulnerability | Oct 15, 2026 |
| CVE-2026-76066 | 8.7 High | IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode | Oct 15, 2026 |
| CVE-2026-76659 | 7.5 High | HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability | Oct 15, 2026 |
| CVE-2026-109430 | 8.7 High | Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection | Oct 15, 2026 |
| CVE-2026-76656 | 5.3 Medium | HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability | Oct 15, 2026 |
| CVE-2026-77931 | 8.7 High | MoviePilot 3.1.5 Command Injection via ExecuteCommandTool | Oct 15, 2026 |
| CVE-2026-73799 | 7.5 High | HPE NonStop SNMP Trap Multiplexer - Memory Corruption vulnerability | Oct 15, 2026 |
| CVE-2026-110904 | 5.3 Medium | ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call. | Oct 15, 2026 |
| CVE-2026-0993 | 8.7 High | SODOLA SL902-SWTGW124AS Buffer Overflow DoS via Multipart Boundary Parser | Oct 15, 2026 |
| CVE-2026-110810 | 2.4 Low | ggml-org whisper.cpp Model Loader whisper_model_load out-of-bounds | Oct 15, 2026 |
| CVE-2026-95180 | 5.5 Medium | An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in… | Oct 15, 2026 |
| CVE-2026-95179 | 7.5 High | An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in… | Oct 15, 2026 |
| CVE-2026-95155 | 7.5 High | FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted… | Oct 15, 2026 |
| CVE-2026-88753 | 7.5 High | A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document. | Oct 15, 2026 |
| CVE-2026-78851 | 6.5 Medium | Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method. | Oct 15, 2026 |
| CVE-2026-78850 | 5.0 Medium | An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted… | Oct 15, 2026 |
| CVE-2026-52167 | 6.2 Medium | A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service (DoS) via supplying a crafted .PSB subtitle file. | Oct 15, 2026 |
| CVE-2026-36436 | 7.5 High | An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. An authenticated administrator can inspect the client-side code to retrieve the credential. | Oct 15, 2026 |
| CVE-2026-106708 | 8.8 High | XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not… | Oct 15, 2026 |
| CVE-2026-106707 | 5.4 Medium | XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the… | Oct 15, 2026 |
| CVE-2026-106706 | 5.4 Medium | XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeController.save() stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template… | Oct 15, 2026 |
| CVE-2026-106701 | 6.1 Medium | ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue. | Oct 15, 2026 |
| CVE-2026-106700 | 8.8 High | ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check… | Oct 15, 2026 |
| CVE-2026-104586 | 9.8 Critical | AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi. | Oct 15, 2026 |
| CVE-2026-110809 | 5.3 Medium | sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service | Oct 14, 2026 |
| CVE-2026-110807 | 5.3 Medium | sgl-project SGLang generate Endpoint io_struct.py denial of service | Oct 14, 2026 |
| CVE-2026-110873 | 7.1 High | Heym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id Field | Oct 14, 2026 |
| CVE-2026-110872 | 8.2 High | Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing | Oct 14, 2026 |
| CVE-2026-110871 | 7.1 High | Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service | Oct 14, 2026 |
| CVE-2026-110870 | 6.9 Medium | Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments | Oct 14, 2026 |
| CVE-2026-110869 | 8.7 High | Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes | Oct 14, 2026 |
| CVE-2026-110868 | 8.4 High | Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources | Oct 14, 2026 |
| CVE-2026-110867 | 9.0 Critical | Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset | Oct 14, 2026 |
| CVE-2026-110866 | 5.3 Medium | Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request | Oct 14, 2026 |
| CVE-2026-110865 | 7.1 High | Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets | Oct 14, 2026 |
| CVE-2026-110864 | 9.1 Critical | Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy | Oct 14, 2026 |
| CVE-2026-110863 | 8.6 High | Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers | Oct 14, 2026 |
| CVE-2026-110862 | 9.3 Critical | Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link | Oct 14, 2026 |
| CVE-2026-110861 | 6.3 Medium | Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition | Oct 14, 2026 |
| CVE-2026-110860 | 6.9 Medium | GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move() | Oct 14, 2026 |
| CVE-2026-110859 | 8.7 High | GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name | Oct 14, 2026 |
| CVE-2026-110858 | 9.2 Critical | GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec | Oct 14, 2026 |
| CVE-2026-110857 | 7.7 High | GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs | Oct 14, 2026 |
| CVE-2026-110856 | 8.7 High | GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date | Oct 14, 2026 |
| CVE-2026-110855 | 7.1 High | GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name | Oct 14, 2026 |
| CVE-2026-110854 | 8.2 High | Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error | Oct 14, 2026 |
| CVE-2026-110853 | 7.1 High | n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON | Oct 14, 2026 |
| CVE-2026-110852 | 6.3 Medium | n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution | Oct 14, 2026 |
| CVE-2026-110851 | 6.1 Medium | n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint | Oct 14, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.