Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,180 vulnerabilities match.

CVESeveritySummary
CVE-2026-1102207.1 HighKubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation
CVE-2026-1102195.1 MediumQloApps through 1.7.0 Reflected XSS via Additional Facility Price Field
CVE-2026-1102186.3 MediumAureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL
CVE-2026-1102177.1 Highvhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs
CVE-2026-1102167.1 Highyoulai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint
CVE-2026-1102158.7 Highyoulai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege Escalation
CVE-2026-1102146.3 MediumSnowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download
CVE-2026-1102135.3 Mediumai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints
CVE-2026-1102125.3 Mediumai-fusion-video through 1.2.0 Path Traversal in Media Upload subDir Parameter
CVE-2026-1102117.2 HighSkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint
CVE-2026-1102106.0 MediumPhase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query
CVE-2026-1102097.1 Highai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials
CVE-2026-1102087.1 HighWukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys
CVE-2026-1102078.7 HighWukong AICRM through 20260610 Missing Authorization in User and Role Management APIs
CVE-2026-1102067.7 HighRoo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position
CVE-2026-1102057.7 HighRoo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution
CVE-2026-1102047.7 HighRoo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution
CVE-2026-1102037.7 HighRoo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization
CVE-2026-1102027.7 HighRoo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping
CVE-2026-920888.6 HighImproper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation. This issue affects upKeeper Instant Privilege Access: through 1.7.1.
CVE-2026-1100363.3 LowDevice-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices
CVE-2026-1039378.7 HighMisskey: Denial of service resulting from insufficient cleanup processing during file uploads
CVE-2026-1048178.7 HighMisskey: Lack of rate limiting and size restrictions in RSS fetching API
CVE-2026-1048168.5 HighMisskey: Cross-site scripting in RSS feed item links
CVE-2026-1043407.8 HighAdobe Framemaker | Heap-based Buffer Overflow (CWE-122)
CVE-2026-1038565.5 MediumAdobe Framemaker | Out-of-bounds Read (CWE-125)
CVE-2026-1043435.5 MediumAdobe Framemaker | NULL Pointer Dereference (CWE-476)
CVE-2026-1039667.8 HighAdobe Framemaker | Heap-based Buffer Overflow (CWE-122)
CVE-2026-1066257.8 HighAdobe Framemaker | Out-of-bounds Write (CWE-787)
CVE-2026-1043417.8 HighAdobe Framemaker | Out-of-bounds Write (CWE-787)
CVE-2026-1043427.8 HighAdobe Framemaker | Use After Free (CWE-416)
CVE-2026-1043447.8 HighAdobe Framemaker | Heap-based Buffer Overflow (CWE-122)
CVE-2026-1039677.8 HighAdobe Framemaker | Out-of-bounds Write (CWE-787)
CVE-2026-1038575.5 MediumAdobe Framemaker | Out-of-bounds Read (CWE-125)
CVE-2026-540865.3 MediumSLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of Service
CVE-2026-1094298.7 HighMistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-Transform
CVE-2026-857476.8 MediumDistribution: Client `manifests.Get()` does not verify returned content against requested digest
CVE-2026-1076076.9 MediumMissing authentication for critical function in Swann Communications SWIFI-SE2KIC
CVE-2026-1076066.9 MediumMissing authentication for critical function in Swann Communications SWIFI-SE2KIC
CVE-2026-1076055.9 MediumMissing authentication for critical function in Swann Communications SWIFI-SE2KIC
CVE-2026-1094288.7 HighMistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation
CVE-2026-956318.7 HighAdobe Commerce | Improper Input Validation (CWE-20)
CVE-2026-10384910.0 CriticalAdobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
CVE-2026-929107.2 HighAdobe Commerce | Incorrect Authorization (CWE-863)
CVE-2026-910139.3 CriticalAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-924649.1 CriticalAdobe Commerce | Improper Input Validation (CWE-20)
CVE-2026-956304.3 MediumAdobe Commerce | Improper Input Validation (CWE-20)
CVE-2026-929228.1 HighAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-929088.3 HighAdobe Commerce | Incorrect Authorization (CWE-863)
CVE-2026-929099.8 CriticalAdobe Commerce | Incorrect Authorization (CWE-863)

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.