Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,131 vulnerabilities match.

CVESeveritySummary
CVE-2026-98399Not scoreds390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
CVE-2026-98398Not scoredlocking/lockdep: Invalidate stale class_cache entries for zapped classes
CVE-2026-98397Not scoredplatform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown
CVE-2026-98396Not scoredpowerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()
CVE-2026-98395Not scoredpowerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit
CVE-2026-98394Not scoredaf_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.
CVE-2026-98393Not scorednet: ipv4: Fix UDP length overflow with PMTU discover and big MTU
CVE-2026-98392Not scoredBluetooth: btintel_pcie: fix tx_handle bounds off-by-one
CVE-2026-98391Not scoreddrm/xe: Guard page-fault worker with runtime PM check
CVE-2026-98390Not scoredx86/amd_node: Avoid divide by zero on virtualized systems
CVE-2026-98389Not scoreddrm/amdgpu: skip gfx switch_power_profile during GPU reset
CVE-2026-98388Not scoredexec: do_close_on_exec() before taking exec_update_lock
CVE-2026-98387Not scoreds390/crypto: Fix skcipher_walk return code handling in aes_s390
CVE-2026-98386Not scoredscsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
CVE-2026-1106526.3 MediumONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass
CVE-2026-1074176.5 MediumWordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability
CVE-2026-1074267.3 HighWordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability
CVE-2026-1099685.5 MediumClevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file
CVE-2026-167409.8 CriticalMissing Authentication for Critical Function in TR7 Cyber ​​Defense's TR7 ASP
CVE-2026-167419.8 CriticalOS Command in TR7 Cyber ​​Defense's TR7 ASP
CVE-2026-820268.7 HighRadar < 1.12.2 Missing Authorization via /api/local-terminal
CVE-2026-1082919.8 CriticalWordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability
CVE-2026-1074256.5 MediumWordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability
CVE-2026-1078677.1 HighWordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1074217.3 HighWordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability
CVE-2026-1074249.8 CriticalWordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability
CVE-2026-1074226.5 MediumWordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1058747.1 HighWordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1065998.8 HighWordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability
CVE-2026-972787.2 HighWordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability
CVE-2026-1074336.5 MediumWordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability
CVE-2026-766557.5 HighHPE NonStop SNMP Trap Multiplexer - Buffer Overflow vulnerability
CVE-2026-737988.2 HighHPE NonStop DNS 9.2.3 Non Secure Version
CVE-2026-737975.3 MediumHPE NonStop TSQLFIL - Memory corruption vulnerability
CVE-2026-852987.3 HighImproper Authorization in Google Cloud Application Integration Leads to Privilege Escalation
CVE-2026-737964.4 MediumHPE NonStop TSQLEXE - Memory Corruption vulnerability
CVE-2026-1080725.4 MediumInsecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation
CVE-2026-1080718.7 HighImproper Multi-Factor Authentication Validation Allows Authentication Bypass
CVE-2026-1050678.5 HighWordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability
CVE-2026-1033587.5 HighWordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability
CVE-2026-1074317.5 HighWordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability
CVE-2026-1013418.7 HighStack overwrite from specially formatted TXT-DATA RDATA field
CVE-2026-1013398.7 HighStack overwrite from a specially crafted and formatted HIP RR
CVE-2026-1013388.7 HighStack overwrite from a specially crafted and formatted SVCB or HTTPS RR
CVE-2026-1013378.7 HighStack overwrite from specially formatted base64 RDATA field
CVE-2026-1047958.8 HighInsights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution
CVE-2026-1080708.7 HighImproper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access
CVE-2026-1039058.7 HighUnauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop
CVE-2026-973155.4 MediumResponsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email
CVE-2026-889985.3 MediumTickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.