Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,123 vulnerabilities match.

CVESeveritySummary
CVE-2026-1108507.2 Highn8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters
CVE-2026-1108497.2 Highn8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview
CVE-2026-1108486.0 Mediumn8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge
CVE-2026-1108477.0 Highn8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter
CVE-2026-1108467.0 Highn8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook
CVE-2026-1108457.7 Highn8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation
CVE-2026-1108447.2 Highn8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows
CVE-2026-1108438.2 Highn8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint
CVE-2026-1108427.7 Highn8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter
CVE-2026-1108416.1 Mediumn8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval
CVE-2026-1108407.0 Highn8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field
CVE-2026-1108397.1 HighFreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipboard Data
CVE-2026-1108388.7 HighFreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass
CVE-2026-1108376.1 MediumFreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding
CVE-2026-1108367.1 HighFreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Content-Type
CVE-2026-1108356.3 MediumFreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token
CVE-2026-1108347.1 HighFreeRDP 2.0.0 before 3.32.0 Denial of Service via Serial IRP Null Handle
CVE-2026-1108338.2 HighFreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy
CVE-2026-1108327.1 HighFreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via DRDYNVC DATA_FIRST
CVE-2026-1108315.3 MediumFreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP_MJ_CREATE
CVE-2026-1108308.2 HighFreeRDP before 3.32.0 Denial of Service via Serial IRP_MJ_CREATE
CVE-2026-1108297.1 HighFreeRDP 3.0.0 before 3.32.0 Null Pointer Dereference via rdpsnd Fragment
CVE-2026-1077957.5 HighImproper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API
CVE-2026-1108166.3 Mediumqs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string
CVE-2026-1022987.5 HighInsufficient Authorization and User Boundary Validation in Omada Controller MSP
CVE-2026-1106985.3 MediumPraat Model Loader whisper.cpp whisper_model_load out-of-bounds write
CVE-2026-1083377.4 HighPassword Reset Code Accessible in User Listing API
CVE-2026-1083369.1 CriticalToken Signing Key Allows Unauthenticated Administrative Access
CVE-2026-1083359.1 CriticalPassword Reset Functionality Missing Brute-Force Protection
CVE-2026-1106966.9 Mediumitsmeravitejak Online-Examination-System dbtables.sql information disclosure
CVE-2026-1106955.3 Mediumturboderp ExLlamaV2 Safetensors Tensor Loader stloader.py STFile.get_tensor buffer overflow
CVE-2026-1106945.3 MediumOAID Tengine tmfile Model Loader tm2_serializer.c get_tm_file_model out-of-bounds
CVE-2026-1106894.8 MediumOpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism
CVE-2026-1041096.8 MediumFileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root
CVE-2026-1041076.5 MediumFileRise: Authenticated path traversal escapes configured storage root through inherited ACLs
CVE-2026-1041105.3 MediumFileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php
CVE-2026-1041088.1 HighFileRise OIDC login can bind an attacker identity to an existing local account
CVE-2026-1039778.1 HighFileRise: Session-scoped TOTP rate limiting permits repeated verification attempts
CVE-2026-1041056.4 MediumFileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)
CVE-2026-1041066.5 MediumFileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification
CVE-2026-1039885.4 MediumFileRise renameFolder omits destination-parent authorization
CVE-2026-691936.5 MediumFileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying
CVE-2026-691915.4 MediumFileRise: Login Method Restriction Bypass via Direct API Access
CVE-2026-774275.9 MediumFileRise: Insecure default cryptographic key fallback in manual installs
CVE-2026-691944.8 MediumFileRise: Unsanitized footerHtml in Public Site Config
CVE-2026-1106796.9 MediumOpenSIPS rtpproxy rtpproxy_answer out-of-bounds
CVE-2026-03111.1 LowCheckov by Prisma Cloud: Server-Side Request Forgery Vulnerability
CVE-2026-03124.3 MediumCheckov by Prisma Cloud: Path Traversal Vulnerabilities
CVE-2026-03136.1 MediumCortex XSOAR: OS Command Injection Vulnerability
CVE-2026-648563.7 LowFileRise: Missing Authentication Guard on File Snippet Preview Endpoint

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.