Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,180 vulnerabilities match.

CVESeveritySummary
CVE-2026-546417.7 HighOpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl
CVE-2026-692266.5 MediumPortal for ArcGIS has a security vulnerability
CVE-2026-107595.5 MediumBUG-000171040 Portal for ArcGIS has a security vulnerability
CVE-2026-1060345.0 MediumA Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.
CVE-2026-692279.8 CriticalBUG-000187331 Portal for ArcGIS has a security vulnerability
CVE-2026-546407.6 HighOpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
CVE-2026-1096066.9 MediumSourceCodester Art Gallery Management System Account Creation admin_class.php save_user sql injection
CVE-2026-546976.7 MediumConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing
CVE-2026-547006.9 MediumConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation
CVE-2026-1026726.7 MediumElectron: Local race condition in Squirrel.Mac update installation on macOS
CVE-2026-556959.1 CriticalFearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater
CVE-2026-1018996.9 MediumAxios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
CVE-2026-492646.1 MediumOAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
CVE-2026-492656.8 MediumOAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison
CVE-2026-1027004.7 Mediumgnttab: cache-flush handling may cause page reference leak
CVE-2026-1027027.5 HighArm: multiple issues with GNTTABOP_cache_flush
CVE-2026-1026997.5 HighArm: multiple issues with GNTTABOP_cache_flush
CVE-2026-1096056.9 MediumSourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization
CVE-2026-796115.5 MediumVMX: VMentry failure with branch tracing and blocked states
CVE-2026-796108.8 Highgrant-table: double version change race
CVE-2026-1039289.3 CriticalMetabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
CVE-2026-796098.8 Highx86: XPTI may break on huge-memory systems
CVE-2026-796089.8 Criticalx86/AMD: ineffectual Zenbleed workaround
CVE-2026-796075.5 MediumXenstore: Guests can crash xenstored during Live Update
CVE-2026-1100256.9 Mediumslackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload
CVE-2026-1040057.1 HighIncorrect authorization in MongoDB Server router for bulk writes to system namespaces
CVE-2026-1040047.1 HighCollection validators using collation-accepting expressions can crash MongoDB Server on insert
CVE-2026-1029816.5 MediumPlane: Unauthenticated Workspace Invitation Token Leakage
CVE-2026-1039655.3 MediumFixed values in MongoDB Server $bucket stage may be misread as field references
CVE-2026-1029828.5 HighPlane: XSS in work item comments
CVE-2026-1049358.6 HighAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
CVE-2026-1029885.3 MediumPlane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)
CVE-2026-1095264.8 MediumHBAI-Ltd Toonflow-app exportData Endpoint information disclosure
CVE-2026-1027345.5 Mediumasteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
CVE-2026-962997.1 HighMissing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service
CVE-2026-962976.0 MediumMongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline
CVE-2026-691504.3 MediumKeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map
CVE-2026-1028324.2 MediumJupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
CVE-2026-5567510.0 CriticalSalty documentation workflow executes fork-controlled Python build hooks with deployment secrets
CVE-2026-1095256.9 Mediumgirishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization
CVE-2026-553768.8 Highheym Python Tool Sandbox Escape
CVE-2026-1054605.5 MediumBluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()
CVE-2026-815076.5 MediumESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data
CVE-2026-1095246.9 Mediumgirishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization
CVE-2026-1061085.7 MediumQuasar Framework: App Vite SSG page output paths can escape the configured distribution directory
CVE-2026-1030284.3 MediumSFTPGo source-side file-pattern filter bypass during copy operations
CVE-2026-773756.5 MediumSFTPGo: Denial of service via malformed SSH channel request
CVE-2026-1022508.6 HighCWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.
CVE-2026-1079184.3 MediumInsufficient input validation vulnerability in NETGEAR R7300
CVE-2026-1079174.3 MediumInsufficient input validation vulnerability in NETGEAR R7300 router

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.