Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,131 vulnerabilities match.

CVESeveritySummary
CVE-2026-1106359.3 Criticalwebp-converter before 3.0.0 OS Command Injection via File Names and Options
CVE-2026-1106349.3 Criticalgit-diff before 2.0.7 OS Command Injection via gitDiff Input Strings
CVE-2026-1106338.5 HighMyReport Updater through 2.1.1 Local Privilege Escalation via Updater Service
CVE-2026-1106329.2 CriticalReport One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE
CVE-2026-1106319.3 CriticalKomodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration
CVE-2026-1106307.0 HighVentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment
CVE-2026-1106297.1 HighVentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions
CVE-2026-1106289.2 CriticalKan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment
CVE-2026-1106272.1 LowClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter
CVE-2026-1106265.1 MediumClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php
CVE-2026-1106255.1 MediumClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php
CVE-2026-1106242.3 LowPapermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all
CVE-2026-1106237.7 HighPapermerge Core through 3.5.3 Missing Authorization in Shared Nodes API
CVE-2026-1106227.7 HighPapermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints
CVE-2026-1106218.7 HighSwetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId
CVE-2026-1106206.1 MediumFormbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId
CVE-2026-1106196.3 Mediumfrp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints
CVE-2026-1106188.6 HighSmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API
CVE-2026-1106176.3 Mediumwe-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint
CVE-2026-1106169.2 CriticalNullHub through 2026.5.29 Missing Authentication for /api Management API
CVE-2026-1106157.1 HighjshERP through 3.6 Missing Authorization via /user/batchSetStatus
CVE-2026-1106147.1 HighYiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter
CVE-2026-1106137.1 Highyoulai-mall through commit 9f62de8 Order Information Disclosure via App Order List
CVE-2026-1106129.3 Criticalvlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil
CVE-2026-1106116.0 MediumREBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid
CVE-2026-1106105.3 Mediumruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl
CVE-2026-1106097.1 HighDromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter
CVE-2026-1106085.3 MediumBizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive
CVE-2026-1106077.1 HighBizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint
CVE-2026-1106064.8 MediumLibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader
CVE-2026-1106056.8 Mediumlibschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line
CVE-2026-1106042.0 LowMini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod()
CVE-2026-1106035.8 MediumLASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header
CVE-2026-1106025.8 Mediumlibmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path
CVE-2026-1106015.8 Mediumlibsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF
CVE-2026-1106006.8 Mediumxlsxio through 0.2.37 NULL Pointer Dereference via Worksheet Relationship Without Id
CVE-2026-1105996.9 MediumL-SMASH through 2.14.5 Double Free in HEVC and H.264 Importer Probe
CVE-2026-1105986.9 MediumLibyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value
CVE-2026-1105976.9 MediumTinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory
CVE-2026-1105966.8 Mediumquirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search
CVE-2026-1105955.3 MediumBottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import
CVE-2026-1105946.9 MediumBottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex
CVE-2026-1105935.3 MediumBottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail
CVE-2026-1105925.1 MediumBottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template
CVE-2026-1105916.8 MediumOW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer
CVE-2026-1102706.8 MediumOW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter
CVE-2026-1102636.8 MediumOW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader
CVE-2026-1102624.8 MediumOW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter
CVE-2026-1102616.8 MediumOW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES
CVE-2026-1102606.8 MediumOW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.