Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,127 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-89073 | 7.5 High | MOVEit Transfer Access restriction bypass in OAuth authentication | Oct 14, 2026 |
| CVE-2026-103929 | 7.8 High | mise permits untrusted local configuration to override default shell arguments | Oct 14, 2026 |
| CVE-2026-89072 | 7.5 High | MOVEit Transfer Authorization Flaw in Certificate Management | Oct 14, 2026 |
| CVE-2026-91881 | 9.0 Critical | Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this… | Oct 14, 2026 |
| CVE-2026-89071 | 7.5 High | MOVEit Transfer LDAP injection in certificate-based authentication | Oct 14, 2026 |
| CVE-2026-89070 | 7.5 High | MOVEit Transfer OIDC Authentication Replay Vulnerability | Oct 14, 2026 |
| CVE-2026-89069 | 8.0 High | MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages | Oct 14, 2026 |
| CVE-2026-89068 | 8.1 High | MOVEit Transfer Authentication bypass in LDAP sign-on | Oct 14, 2026 |
| CVE-2026-101896 | 8.2 High | Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR) | Oct 14, 2026 |
| CVE-2026-89067 | 8.8 High | MOVEit Transfer Secure Messaging Authentication Bypass | Oct 14, 2026 |
| CVE-2026-76113 | 4.3 Medium | Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the redfish_certificate resource component. A high privileged attacker with remote… | Oct 14, 2026 |
| CVE-2026-87093 | 8.8 High | MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation | Oct 14, 2026 |
| CVE-2026-101897 | 5.1 Medium | Angular DevTools (Local DoS) | Oct 14, 2026 |
| CVE-2026-110719 | 6.9 Medium | Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header | Oct 14, 2026 |
| CVE-2026-110718 | 8.2 High | TurboDocx html-to-docx through 1.23.1 SSRF via img src Remote Image Download | Oct 14, 2026 |
| CVE-2026-110717 | 6.9 Medium | Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename | Oct 14, 2026 |
| CVE-2026-110716 | 6.8 Medium | unshield through 1.6.2 Heap Out-of-Bounds Read via unshield_get_file_table | Oct 14, 2026 |
| CVE-2026-110715 | 6.9 Medium | MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort | Oct 14, 2026 |
| CVE-2026-110714 | 7.1 High | libsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl Integer Underflow | Oct 14, 2026 |
| CVE-2026-110713 | 7.1 High | libsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders | Oct 14, 2026 |
| CVE-2026-110712 | 7.1 High | libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info | Oct 14, 2026 |
| CVE-2026-110661 | 4.8 Medium | CGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI_read_node_header | Oct 14, 2026 |
| CVE-2026-110660 | 4.8 Medium | vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder | Oct 14, 2026 |
| CVE-2026-110659 | 6.8 Medium | ELFIO through 3.12 NULL Pointer Dereference via relocation_section_accessor get_entry | Oct 14, 2026 |
| CVE-2026-110658 | 6.9 Medium | Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse | Oct 14, 2026 |
| CVE-2026-110657 | 4.8 Medium | Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label | Oct 14, 2026 |
| CVE-2026-110656 | 2.3 Low | miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt | Oct 14, 2026 |
| CVE-2026-110655 | 2.3 Low | miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt | Oct 14, 2026 |
| CVE-2026-110654 | 6.9 Medium | libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs | Oct 14, 2026 |
| CVE-2026-101895 | 8.7 High | Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE | Oct 14, 2026 |
| CVE-2026-107381 | 6.5 Medium | svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences | Oct 14, 2026 |
| CVE-2026-53613 | 7.0 High | util-linux mount target TOCTOU allows local privilege escalation | Oct 14, 2026 |
| CVE-2026-53612 | 7.0 High | util-linux mount hook_owner TOCTOU allows local privilege escalation | Oct 14, 2026 |
| CVE-2026-104939 | 8.7 High | NGINX Ingress Controller vulnerability | Oct 14, 2026 |
| CVE-2026-101019 | 8.3 High | NGINX ngx_http_js_module vulnerability | Oct 14, 2026 |
| CVE-2026-101025 | 6.9 Medium | NGINX ngx_http_js_module vulnerability | Oct 14, 2026 |
| CVE-2026-95101 | 6.9 Medium | NGINX ngx_http_v3_module vulnerability | Oct 14, 2026 |
| CVE-2026-94197 | 8.7 High | NGINX Ingress Controller vulnerability | Oct 14, 2026 |
| CVE-2026-96615 | 7.1 High | NGINX Gateway Fabric vulnerability | Oct 14, 2026 |
| CVE-2026-91184 | 8.7 High | NGINX Gateway Fabric vulnerability | Oct 14, 2026 |
| CVE-2026-97205 | 9.2 Critical | NGINX ngx_http_core_module vulnerability | Oct 14, 2026 |
| CVE-2026-93479 | 9.2 Critical | NGINX map directive and regex matching vulnerability | Oct 14, 2026 |
| CVE-2026-97629 | 8.3 High | NGINX ngx_http_ssl_module vulnerability | Oct 14, 2026 |
| CVE-2026-15176 | 9.2 Critical | NGINX ngx_http_core_module vulnerability | Oct 14, 2026 |
| CVE-2026-78433 | 5.9 Medium | Gitea private attachment disclosure through repository mismatch | Oct 14, 2026 |
| CVE-2026-78231 | 5.3 Medium | Gitea blind SSRF through OpenID assertion verification | Oct 14, 2026 |
| CVE-2026-73814 | 6.5 Medium | Gitea repository ownership escalation by administrators | Oct 14, 2026 |
| CVE-2026-73804 | 8.1 High | Gitea API token scope escalation through HTTP signatures | Oct 14, 2026 |
| CVE-2026-73802 | 8.8 High | Gitea Runner host isolation bypass through container options | Oct 14, 2026 |
| CVE-2026-73800 | 8.8 High | Gitea reusable workflow secret exposure in pull_request_target | Oct 14, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.