Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,180 vulnerabilities match.

CVESeveritySummary
CVE-2026-1101205.3 Mediumyshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController
CVE-2026-1101197.1 Highyshopmall through 2.0.0 IDOR via Member Address API in UserAddressController
CVE-2026-1101187.1 HighWorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints
CVE-2026-1101177.1 HighSmartAdmin through 3.30.0 Missing Authorization via AdminProtectController
CVE-2026-1101168.8 HighDigital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFile
CVE-2026-1101158.7 HighDigital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream
CVE-2026-1101146.9 Mediumoms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints
CVE-2026-1101135.3 MediumPublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint
CVE-2026-1101105.3 MediumJetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints
CVE-2026-1101097.1 HighJetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save
CVE-2026-1101088.6 HighMateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API
CVE-2026-1101072.3 LowRuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
CVE-2026-1101062.3 LowRuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
CVE-2026-1101056.9 MediumB3log Symphony through 3.6.4 Missing Authorization in Admin Console Routes
CVE-2026-1101048.2 Highnovel through 3.5.0 Unsalted MD5 Password Storage
CVE-2026-1101035.1 Mediumbbs-go through 4.4.6 Stored XSS via Image Upload Content-Type
CVE-2026-1101027.7 Highpowerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer
CVE-2026-1101015.1 MediumKoillection through 1.8.4 Stored XSS via Datum File Attachment Uploads
CVE-2026-1101005.3 MediumJorani before 1.0.4 Missing Authorization and SSRF via Contracts::import()
CVE-2026-1100995.3 MediumJorani before 1.0.4 Missing Authorization in HR Export Actions
CVE-2026-1100985.3 MediumJorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests
CVE-2026-1100978.6 HighIkaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token
CVE-2026-9460310.0 CriticalPodman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
CVE-2026-558238.7 HighFrappe: Possibility of SQL injection in reportview
CVE-2026-660575.1 MediumFrappe: Open Redirect via Unsanitized OAuth State Param.
CVE-2026-1098275.3 MediumGPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write
CVE-2026-199406.5 MediumBluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping
CVE-2026-199396.3 MediumBluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption
CVE-2026-1041266.0 MediumJumpServer: Ansible Automation Template Rendering Allows Unsafe Lookup Plugin Invocation
CVE-2026-544549.1 CriticalOpenCATS: Authenticated RCE in the Import module
CVE-2026-1030307.5 HighDio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
CVE-2026-1096206.9 MediumSourceCodester Online Reviewer System index.php prepare sql injection
CVE-2026-616427.7 HighSquid Request Smuggling in HTTP Transfer-Encoding
CVE-2026-1042506.1 Mediumunstructured: Stored XSS via unescaped HTML generation
CVE-2026-774599.9 CriticalArgo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
CVE-2026-1094129.9 CriticalAn exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.
CVE-2026-857335.3 MediumFrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables
CVE-2026-1098985.3 MediumWordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability
CVE-2026-1098964.3 MediumWordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability
CVE-2026-1098905.3 MediumWordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability
CVE-2026-824167.7 HighFrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
CVE-2026-551839.6 CriticalRClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page
CVE-2026-1060477.7 HighA Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.
CVE-2026-555629.0 CriticalCronicle: Stored XSS in admin Activity Log via account full_name field
CVE-2026-1060437.5 HighA Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.
CVE-2026-1096076.9 MediumSourceCodester Online Exam System Login Endpoint loginExe.php sql injection
CVE-2026-859908.8 HighLeantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
CVE-2026-1029899.3 CriticalTanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
CVE-2026-1060429.9 CriticalAn External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector…
CVE-2026-1060355.5 MediumAn Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log.

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.