Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,123 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-110775 | 7.1 High | Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access | Oct 14, 2026 |
| CVE-2026-110774 | 6.0 Medium | Blinko through 1.8.8 Private Attachment Read via /api/file Route | Oct 14, 2026 |
| CVE-2026-110773 | 5.3 Medium | GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint | Oct 14, 2026 |
| CVE-2026-110772 | 5.3 Medium | Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update | Oct 14, 2026 |
| CVE-2026-110771 | 5.3 Medium | Shopizer through 3.2.5 Authorization Bypass via Product Review customerId | Oct 14, 2026 |
| CVE-2026-110770 | 9.2 Critical | Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force | Oct 14, 2026 |
| CVE-2026-110769 | 8.3 High | holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors | Oct 14, 2026 |
| CVE-2026-110768 | 6.3 Medium | holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist | Oct 14, 2026 |
| CVE-2026-110767 | 8.7 High | Gitingest through 0.3.1 Arbitrary File Read via Symlink in Blob Ingestion | Oct 14, 2026 |
| CVE-2026-110766 | 5.3 Medium | Colanode Server through 0.4.7 Path Traversal via Avatar Download Route | Oct 14, 2026 |
| CVE-2026-110765 | 8.2 High | FlexPrice through 2.1.38 QuickBooks Webhook Signature Verification Bypass | Oct 14, 2026 |
| CVE-2026-110764 | 6.0 Medium | AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download | Oct 14, 2026 |
| CVE-2026-110763 | 5.3 Medium | lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany | Oct 14, 2026 |
| CVE-2026-110762 | 6.3 Medium | bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream | Oct 14, 2026 |
| CVE-2026-110761 | 8.7 High | ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import | Oct 14, 2026 |
| CVE-2026-102755 | 5.1 Medium | DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting | Oct 14, 2026 |
| CVE-2026-110666 | 6.9 Medium | cemtan sar2html File Upload sar2html.py updateDb path traversal | Oct 14, 2026 |
| CVE-2026-102756 | 5.1 Medium | DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting | Oct 14, 2026 |
| CVE-2026-102479 | 8.7 High | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this… | Oct 14, 2026 |
| CVE-2026-104143 | 8.7 High | DataEase: Stored SQL Injection via dateFormat field templates | Oct 14, 2026 |
| CVE-2026-104142 | 8.7 High | DataEase: Stored SQL Injection in group-field binning bounds | Oct 14, 2026 |
| CVE-2026-104141 | 8.7 High | DataEase: SQL Injection in datasource metadata identifiers | Oct 14, 2026 |
| CVE-2026-82153 | 2.2 Low | Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Information… | Oct 14, 2026 |
| CVE-2026-53999 | 7.7 High | Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs) | Oct 14, 2026 |
| CVE-2026-102460 | 8.6 High | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as… | Oct 14, 2026 |
| CVE-2026-110248 | 6.0 Medium | Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py | Oct 14, 2026 |
| CVE-2026-102748 | 9.2 Critical | Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service | Oct 14, 2026 |
| CVE-2026-109506 | 5.9 Medium | Improper Authentication in Multiple TP-Link WiFi Repeaters | Oct 14, 2026 |
| CVE-2026-102682 | 5.6 Medium | Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation | Oct 14, 2026 |
| CVE-2026-100406 | 8.2 High | dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve` | Oct 14, 2026 |
| CVE-2026-63626 | 8.8 High | Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6) | Oct 14, 2026 |
| CVE-2026-73261 | 7.5 High | Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection | Oct 14, 2026 |
| CVE-2026-73260 | 7.5 High | Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser | Oct 14, 2026 |
| CVE-2026-73252 | 7.5 High | Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX | Oct 14, 2026 |
| CVE-2026-55167 | 4.2 Medium | LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session | Oct 14, 2026 |
| CVE-2026-85714 | 9.1 Critical | Stirling-PDF: Remote Code Execution via H2 | Oct 14, 2026 |
| CVE-2026-103930 | 3.7 Low | cpp-httplib open_stream serializes CRLF in request target into HTTP request line | Oct 14, 2026 |
| CVE-2026-102944 | 7.5 High | cpp-httplib: Cookie header leaked on cross-origin redirect | Oct 14, 2026 |
| CVE-2026-103974 | 5.4 Medium | lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies | Oct 14, 2026 |
| CVE-2026-110536 | 10.0 Critical | D-Link DIR-868L HNAP CGI cgibin system os command injection | Oct 14, 2026 |
| CVE-2026-55786 | 8.4 High | Flyto2 Core: Unauthenticated Command Execution via HTTP MCP `execute_module` | Oct 14, 2026 |
| CVE-2026-55787 | 7.1 High | Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf | Oct 14, 2026 |
| CVE-2026-55573 | 9.8 Critical | e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain | Oct 14, 2026 |
| CVE-2026-55572 | 10.0 Critical | e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username | Oct 14, 2026 |
| CVE-2026-102476 | 9.1 Critical | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL… | Oct 14, 2026 |
| CVE-2026-103975 | 6.5 Medium | Appium: Symlink based Zip Slip in @appium/support ZIP extraction | Oct 14, 2026 |
| CVE-2026-108480 | 8.2 High | WordPress Skydropx plugin <= 2.1.4 - Broken Access Control vulnerability | Oct 14, 2026 |
| CVE-2026-108484 | 7.1 High | WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability | Oct 14, 2026 |
| CVE-2026-108483 | 7.1 High | WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability | Oct 14, 2026 |
| CVE-2026-105066 | 7.1 High | WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability | Oct 14, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.