Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,135 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-78632 | 5.3 Medium | Insecure Default File Permissions in Okta RADIUS Agent Windows Installer | Oct 13, 2026 |
| CVE-2026-107371 | 5.4 Medium | Missing Verification of auth_time Claim in auth0.js | Oct 13, 2026 |
| CVE-2026-107370 | 5.3 Medium | Improper Request Handling for Active Directory Logins in auth0-lock | Oct 13, 2026 |
| CVE-2026-107369 | 6.1 Medium | Improper Validation of Post-Login Redirect URL in nextjs-auth0 | Oct 13, 2026 |
| CVE-2026-78628 | 6.0 Medium | Improper Input Validation in the Okta Credential Provider for Windows | Oct 13, 2026 |
| CVE-2026-63171 | 5.1 Medium | Omnispace Agora Project < 26.10.0 Stored XSS via Category Description | Oct 13, 2026 |
| CVE-2026-63169 | 5.3 Medium | Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe | Oct 13, 2026 |
| CVE-2026-19810 | 5.4 Medium | Cross-Site Scripting (XSS) in Symantec Endpoint Detection and Response Console | Oct 13, 2026 |
| CVE-2026-63168 | 5.1 Medium | Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass | Oct 13, 2026 |
| CVE-2026-63157 | 5.1 Medium | Omnispace Agora Project < 26.10.0 Stored XSS via Links Module | Oct 13, 2026 |
| CVE-2026-63156 | 5.1 Medium | Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter | Oct 13, 2026 |
| CVE-2026-63148 | 5.1 Medium | Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename | Oct 13, 2026 |
| CVE-2026-103852 | 5.5 Medium | Substance3D - Stager | NULL Pointer Dereference (CWE-476) | Oct 13, 2026 |
| CVE-2026-103832 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103842 | 7.8 High | Substance3D - Stager | Out-of-bounds Read (CWE-125) | Oct 13, 2026 |
| CVE-2026-103836 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103835 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103837 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103833 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103834 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103841 | 7.8 High | Substance3D - Stager | Out-of-bounds Read (CWE-125) | Oct 13, 2026 |
| CVE-2026-103839 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103850 | 5.5 Medium | Substance3D - Stager | Out-of-bounds Read (CWE-125) | Oct 13, 2026 |
| CVE-2026-103838 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103851 | 7.8 High | Substance3D - Stager | Stack-based Buffer Overflow (CWE-121) | Oct 13, 2026 |
| CVE-2026-103840 | 7.8 High | Substance3D - Stager | Out-of-bounds Read (CWE-125) | Oct 13, 2026 |
| CVE-2026-103830 | 7.8 High | Substance3D - Stager | Stack-based Buffer Overflow (CWE-121) | Oct 13, 2026 |
| CVE-2026-103843 | 7.8 High | Substance3D - Stager | Use After Free (CWE-416) | Oct 13, 2026 |
| CVE-2026-63147 | 5.1 Medium | Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name | Oct 13, 2026 |
| CVE-2026-63172 | 7.1 High | Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit | Oct 13, 2026 |
| CVE-2026-63161 | 8.6 High | Omnispace Agora Project < 26.10.0 Session Fixation via Authentication | Oct 13, 2026 |
| CVE-2026-63174 | 8.6 High | Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList | Oct 13, 2026 |
| CVE-2026-63153 | 8.6 High | Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations() | Oct 13, 2026 |
| CVE-2026-63165 | 8.6 High | Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter | Oct 13, 2026 |
| CVE-2026-63152 | 8.6 High | Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter | Oct 13, 2026 |
| CVE-2026-63163 | 8.7 High | Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload | Oct 13, 2026 |
| CVE-2026-63162 | 8.7 High | Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter | Oct 13, 2026 |
| CVE-2026-103846 | 8.6 High | Dimension | Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) (CWE-79) | Oct 13, 2026 |
| CVE-2026-103845 | 8.6 High | Dimension | Uncontrolled Search Path Element (CWE-427) | Oct 13, 2026 |
| CVE-2026-103855 | 5.5 Medium | Dimension | NULL Pointer Dereference (CWE-476) | Oct 13, 2026 |
| CVE-2026-103844 | 7.8 High | Dimension | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103854 | 7.8 High | Dimension | Stack-based Buffer Overflow (CWE-121) | Oct 13, 2026 |
| CVE-2026-103853 | 5.5 Medium | Dimension | Out-of-bounds Read (CWE-125) | Oct 13, 2026 |
| CVE-2026-103847 | 8.6 High | Dimension | Untrusted Search Path (CWE-426) | Oct 13, 2026 |
| CVE-2026-63154 | 8.7 High | Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[] | Oct 13, 2026 |
| CVE-2026-63160 | 9.1 Critical | Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage | Oct 13, 2026 |
| CVE-2026-63159 | 9.1 Critical | Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover | Oct 13, 2026 |
| CVE-2026-63158 | 9.1 Critical | Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies | Oct 13, 2026 |
| CVE-2026-63149 | 9.1 Critical | Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid() | Oct 13, 2026 |
| CVE-2026-90532 | 10.0 Critical | Adobe Experience Manager | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.