Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,180 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-100133 | 9.3 Critical | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-92911 | 8.7 High | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-104937 | 8.1 High | CVE-2026-104937 | Oct 13, 2026 |
| CVE-2026-110249 | 8.6 High | Denial-of-service in the Exchange email component | Oct 13, 2026 |
| CVE-2026-110247 | 8.4 High | Integer overflow in libmime buffer growth could lead to heap corruption | Oct 13, 2026 |
| CVE-2026-75120 | 9.3 Critical | Remote Code Execution (RCE) vulnerability identified in the OpenText™ EnCase SAFE Agents | Oct 13, 2026 |
| CVE-2026-108385 | 8.8 High | dataclasses-avroschema enum symbols can inject statements through generated member names | Oct 13, 2026 |
| CVE-2026-108384 | 8.8 High | dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare string | Oct 13, 2026 |
| CVE-2026-108383 | 8.8 High | dataclasses-avroschema enum field defaults can inject statements into generated modules | Oct 13, 2026 |
| CVE-2026-92892 | 9.0 Critical | Potential command execution on the host running JFrog CLI. | Oct 13, 2026 |
| CVE-2026-108382 | 8.8 High | dataclasses-avroschema allows code injection through generated enum-symbol string literals | Oct 13, 2026 |
| CVE-2026-108381 | 8.8 High | dataclasses-avroschema pydantic-class metadata allows code injection in generated annotations | Oct 13, 2026 |
| CVE-2026-108380 | 8.8 High | dataclasses-avroschema field documentation allows code injection in generated Pydantic descriptions | Oct 13, 2026 |
| CVE-2026-108379 | 8.8 High | dataclasses-avroschema fixed namespaces allow code injection in generated annotations | Oct 13, 2026 |
| CVE-2026-106175 | 2.1 Low | A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions,… | Oct 13, 2026 |
| CVE-2026-106172 | 4.9 Medium | A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.0.4 through 5.0.6, FortiSandbox Cloud 5.0.0 through… | Oct 13, 2026 |
| CVE-2026-23707 | 6.5 Medium | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions,… | Oct 13, 2026 |
| CVE-2026-23706 | 5.9 Medium | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.6.2,… | Oct 13, 2026 |
| CVE-2026-23705 | 6.5 Medium | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through… | Oct 13, 2026 |
| CVE-2025-46773 | 7.9 High | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions,… | Oct 13, 2026 |
| CVE-2025-57739 | 7.7 High | An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an… | Oct 13, 2026 |
| CVE-2026-106170 | 4.8 Medium | An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow a privileged attacker to deny access to the GUI and CLI… | Oct 13, 2026 |
| CVE-2026-106173 | 9.4 Critical | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets. | Oct 13, 2026 |
| CVE-2026-106176 | 3.4 Low | A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests | Oct 13, 2026 |
| CVE-2026-106171 | 5.3 Medium | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to… | Oct 13, 2026 |
| CVE-2026-105445 | 9.4 Critical | Docker Hub account conversion could reassign an active personal access token to another user | Oct 13, 2026 |
| CVE-2026-108378 | 8.8 High | dataclasses-avroschema record documentation can terminate generated class docstrings | Oct 13, 2026 |
| CVE-2026-104085 | 8.7 High | odt2spip < 4.4.0 OS Command Injection via Document Filename | Oct 13, 2026 |
| CVE-2026-108377 | 8.8 High | dataclasses-avroschema allows code injection through generated Meta.schema_name | Oct 13, 2026 |
| CVE-2026-108376 | 8.8 High | dataclasses-avroschema allows code injection through record names in generated default factories | Oct 13, 2026 |
| CVE-2026-33374 | 6.5 Medium | Unbounded memory allocation in the Prometheus rule conversion API | Oct 13, 2026 |
| CVE-2026-15577 | 6.5 Medium | Git Sync connection configuration can be modified with read-only access | Oct 13, 2026 |
| CVE-2026-93294 | 6.3 Medium | Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs | Oct 13, 2026 |
| CVE-2026-95502 | 5.3 Medium | Git Sync memory exhaustion via a malicious Git server | Oct 13, 2026 |
| CVE-2026-108375 | 8.8 High | dataclasses-avroschema allows code injection through generated field-default literals | Oct 13, 2026 |
| CVE-2026-109828 | 5.3 Medium | libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable | Oct 13, 2026 |
| CVE-2026-88834 | 3.7 Low | Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds | Oct 13, 2026 |
| CVE-2026-88838 | 5.5 Medium | Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions | Oct 13, 2026 |
| CVE-2026-88833 | 6.5 Medium | Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service | Oct 13, 2026 |
| CVE-2026-53562 | 8.5 High | Local Privilege Escalation | Oct 13, 2026 |
| CVE-2026-110131 | 6.9 Medium | ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints | Oct 13, 2026 |
| CVE-2026-110129 | 7.1 High | fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail | Oct 13, 2026 |
| CVE-2026-110128 | 8.7 High | fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detail | Oct 13, 2026 |
| CVE-2026-110127 | 5.3 Medium | waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints | Oct 13, 2026 |
| CVE-2026-110126 | 5.3 Medium | waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoints | Oct 13, 2026 |
| CVE-2026-110125 | 5.3 Medium | waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints | Oct 13, 2026 |
| CVE-2026-110124 | 8.6 High | FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints | Oct 13, 2026 |
| CVE-2026-110123 | 7.1 High | Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints | Oct 13, 2026 |
| CVE-2026-110122 | 5.3 Medium | PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint | Oct 13, 2026 |
| CVE-2026-110121 | 7.1 High | PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint | Oct 13, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.