Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,127 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-101956 | 9.3 Critical | Junos OS: Unauthorized root command execution when J-Web is enabled | Oct 14, 2026 |
| CVE-2026-101980 | 9.3 Critical | Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Echo is enabled | Oct 14, 2026 |
| CVE-2026-102069 | 8.7 High | Junos OS: An ICCP peer causes dot1xd to crash when dot1x synchronization is enabled | Oct 14, 2026 |
| CVE-2026-102070 | 9.2 Critical | Junos OS: A remote TWAMP peer causes rmopd service disruption when TWAMP-Control is used | Oct 14, 2026 |
| CVE-2026-101973 | 8.7 High | Junos OS: Malformed packet causes pkid denial of service when certificate re-enrollment is used | Oct 14, 2026 |
| CVE-2026-102072 | 7.1 High | Junos OS: An authenticated attacker causes a denial of service when the gRPC extension-service is enabled | Oct 14, 2026 |
| CVE-2026-103994 | 8.7 High | Junos OS: A crafted OVSDB message crashes vgd and allows remote code execution | Oct 14, 2026 |
| CVE-2026-102063 | 7.1 High | Junos OS: MX Series: An unauthenticated network attacker causes an rpd crash when HFRR link protection is used | Oct 14, 2026 |
| CVE-2026-101965 | 8.7 High | Junos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry is enabled | Oct 14, 2026 |
| CVE-2026-77524 | 9.9 Critical | KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication | Oct 14, 2026 |
| CVE-2026-101967 | 9.3 Critical | Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used | Oct 14, 2026 |
| CVE-2026-102068 | 9.2 Critical | Junos OS Evolved: Malformed TCP key-chain traffic causes a kernel panic when BGP or LDP key-chain authentication is used | Oct 14, 2026 |
| CVE-2026-101960 | 7.1 High | Junos OS Evolved: QFX Series: A BGP peer causes an rpd crash when global load balancing is enabled | Oct 14, 2026 |
| CVE-2026-101978 | 8.7 High | Junos OS Evolved: PTX Series: An attacker controlled gRPC response causes root-level compromise when zero-touch provisioning is used | Oct 14, 2026 |
| CVE-2026-101985 | 7.1 High | Junos OS Evolved: PTX Series: An IS-IS peer causes an rpd crash when BIER over IS-IS is enabled | Oct 14, 2026 |
| CVE-2026-101966 | 8.8 High | Junos OS Evolved: A crafted analytics sensor resource causes telemetry dial-out daemon denial of service | Oct 14, 2026 |
| CVE-2026-77564 | 3.3 Low | Talos Linux: Support bundle does not redact registry credentials | Oct 14, 2026 |
| CVE-2026-86565 | 8.2 High | Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write | Oct 14, 2026 |
| CVE-2026-86563 | 7.8 High | Dpdk: dpdk: double offset bug in vhost log mapping calculation | Oct 14, 2026 |
| CVE-2026-86562 | 7.8 High | Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse) | Oct 14, 2026 |
| CVE-2026-76519 | 9.8 Critical | Cisco Secure Email Gateway Arbitrary File Write Vulnerability | Oct 14, 2026 |
| CVE-2026-67418 | 5.3 Medium | RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers | Oct 14, 2026 |
| CVE-2026-67414 | 6.0 Medium | RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation | Oct 14, 2026 |
| CVE-2026-100169 | 7.6 High | Account pre-hijacking in the Prowler API through email based social account linking without verification | Oct 14, 2026 |
| CVE-2026-67416 | 5.3 Medium | RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation | Oct 14, 2026 |
| CVE-2026-102695 | 8.2 High | OmniFaces: Forged combined-resource IDs and related output/push boundaries | Oct 14, 2026 |
| CVE-2026-53615 | 8.0 High | util-linux libblkid DOS extended-partition overflow produces invalid partition metadata | Oct 14, 2026 |
| CVE-2026-86002 | 9.0 Critical | Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS | Oct 14, 2026 |
| CVE-2026-109438 | 6.3 Medium | 3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4 | Oct 14, 2026 |
| CVE-2026-110736 | 3.6 Low | Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized_translation.cpp, OptimizedTranslation::get_message). Offsets read from the hash table of a crafted .translation resource are… | Oct 14, 2026 |
| CVE-2026-100404 | 6.5 Medium | Zulip: Guests can read new messages in non-subscribed public channels | Oct 14, 2026 |
| CVE-2026-102893 | 9.1 Critical | Zulip: OpenID Connect authentication ignores the email_verified claim | Oct 14, 2026 |
| CVE-2026-49206 | 2.9 Low | rapidcsv: Integer overflow in iterator arithmetic causes out-of-bounds access | Oct 14, 2026 |
| CVE-2026-62858 | 5.3 Medium | YOURLS: Unauthenticated File Inclusion | Oct 14, 2026 |
| CVE-2026-86561 | 6.5 Medium | Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup | Oct 14, 2026 |
| CVE-2026-93683 | 6.4 Medium | Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou | Oct 14, 2026 |
| CVE-2026-110735 | 2.5 Low | Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit… | Oct 14, 2026 |
| CVE-2026-53614 | 7.0 High | util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass | Oct 14, 2026 |
| CVE-2026-100394 | 6.5 Medium | Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant | Oct 14, 2026 |
| CVE-2026-91157 | 7.5 High | Discourse: Media uploads remain publicly accessible after category permissions are restricted | Oct 14, 2026 |
| CVE-2026-110734 | 2.5 Low | Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the… | Oct 14, 2026 |
| CVE-2026-91156 | 7.5 High | Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users | Oct 14, 2026 |
| CVE-2026-91159 | 7.7 High | Discourse: Stored oEmbed HTML injection via allowed iframe | Oct 14, 2026 |
| CVE-2026-77572 | 3.3 Low | VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topology, symlink targets, and DeviceObject reference count to any client of \\.\VeraCrypt | Oct 14, 2026 |
| CVE-2026-91883 | 4.3 Medium | Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Log File vulnerability in the provider configuration component. A low privileged attacker with remote access could… | Oct 14, 2026 |
| CVE-2026-89077 | 7.5 High | MOVEit Transfer Identity validation flaw in SFTP authentication | Oct 14, 2026 |
| CVE-2026-91882 | 8.6 High | Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API client error handling component. An unauthenticated… | Oct 14, 2026 |
| CVE-2026-89076 | 7.2 High | MOVEit Transfer SQL injection in custom reporting | Oct 14, 2026 |
| CVE-2026-89075 | 7.3 High | MOVEit Transfer Local Disclosure of Session Information Vulnerability | Oct 14, 2026 |
| CVE-2026-89074 | 7.5 High | MOVEit Transfer Email MFA Bypass | Oct 14, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.