Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,123 vulnerabilities match.

CVESeveritySummary
CVE-2026-03144.3 MediumGlobalProtect App: Local Denial of Service (DoS) on Windows
CVE-2026-626645.4 MediumFileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root
CVE-2026-03155.9 MediumGlobalProtect App: Local Privilege Escalation Vulnerability on macOS
CVE-2026-618447.1 HighFileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolation
CVE-2026-03161.1 LowPAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability
CVE-2026-618438.2 HighFileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares
CVE-2026-574936.8 MediumFileRise: Remember-me auto-login uses stale admin role from token instead of current role
CVE-2026-03171.2 LowPAN-OS: Denial of Service Vulnerability
CVE-2026-574927.4 HighFileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation
CVE-2026-574908.1 HighFileRise: WebDAV authentication bypasses TOTP/MFA entirely
CVE-2026-03184.6 MediumPAN-OS: Denial of Service (DoS) on Panorama
CVE-2026-574916.5 MediumFileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist
CVE-2026-574898.1 HighFileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass
CVE-2026-03194.9 MediumPAN-OS: Improper Input Handling Vulnerability
CVE-2026-1106706.9 Mediumcemtan sar2html Archive Processing sar2html.py updateDb sql injection
CVE-2026-03206.1 MediumPAN-OS: Authenticated Admin Command Injection Vulnerability
CVE-2026-1002327.2 HighPost-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could…
CVE-2026-965408.8 HighAn improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow…
CVE-2026-718548.2 HighOpenAEV has unauthenticated access and missing object-level authorization on player lessons API
CVE-2026-03216.6 MediumPAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services
CVE-2026-554984.8 MediumFileRise Shared Folder Symlink Escape
CVE-2026-556849.8 CriticalWeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php
CVE-2026-556828.1 HighWeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php
CVE-2026-1106696.9 Mediumcemtan sar2html sar2html.py deleteAll missing authentication
CVE-2026-556818.8 HighWeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter
CVE-2026-556796.5 MediumWeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection
CVE-2026-556809.8 CriticalWeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter
CVE-2026-556839.8 CriticalWeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php
CVE-2026-1103106.0 MediumRSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET
CVE-2026-1029806.5 MediumPlane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope
CVE-2026-1029856.5 MediumPlane: Any project member can modify (deactivate) other members' records
CVE-2026-1106686.9 Mediumcemtan sar2html sar2html.py index sql injection
CVE-2026-1029868.1 HighPlane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/
CVE-2026-553827.6 HighInvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)
CVE-2026-553856.8 MediumInvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration
CVE-2026-553817.1 HighInvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates
CVE-2026-553838.2 HighInvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure
CVE-2026-553877.2 HighInvoiceShelf bulk deletion lacks company scoping
CVE-2026-553867.1 HighInvoiceShelf ORDER BY SQL injection through orderByField
CVE-2026-553845.3 MediumInvoiceShelf trusts client-supplied document totals
CVE-2026-547027.3 HighMarkdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler
CVE-2026-547016.9 MediumMarkdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview
CVE-2026-547035.8 MediumMarkdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation
CVE-2026-545668.5 HighMarkdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`
CVE-2026-545258.8 HighMarkdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows
CVE-2026-1106676.9 Mediumcemtan sar2html sar2html.py hard-coded credentials
CVE-2026-1023546.8 MediumBentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker
CVE-2026-1028997.6 HighSentry: Improper authentication on SAML SSO process allows user identity linking
CVE-2026-1024716.9 MediumCRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages
CVE-2026-824025.3 MediumGogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite`

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.