Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,187 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-109520 | 9.3 Critical | Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actions | Oct 13, 2026 |
| CVE-2026-77362 | 4.3 Medium | obsidian-tc bridge tools expose data outside the read ACL | Oct 13, 2026 |
| CVE-2026-93907 | 8.1 High | IBM WebSphere Application Server is affected by a bypass authentication vulnerability | Oct 13, 2026 |
| CVE-2026-95680 | 8.0 High | IBM WebSphere Application Server is affected by an authorization bypass | Oct 13, 2026 |
| CVE-2026-103499 | 7.5 High | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service | Oct 13, 2026 |
| CVE-2026-109519 | 6.9 Medium | YouTransfer Template Rendering template path traversal | Oct 13, 2026 |
| CVE-2026-109964 | 6.3 Medium | ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder | Oct 13, 2026 |
| CVE-2026-109410 | 4.8 Medium | macrozheng mall mall-admin/mall-portal moneyInfo OmsOrderServiceImpl.updateMoneyInfo calculation | Oct 13, 2026 |
| CVE-2026-93347 | 6.9 Medium | Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file | Oct 13, 2026 |
| CVE-2026-93346 | 6.9 Medium | Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition | Oct 13, 2026 |
| CVE-2026-74047 | 7.1 High | Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint | Oct 13, 2026 |
| CVE-2026-74045 | 7.1 High | Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder | Oct 13, 2026 |
| CVE-2026-74043 | 8.5 High | Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions | Oct 13, 2026 |
| CVE-2026-74041 | 8.6 High | Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch | Oct 13, 2026 |
| CVE-2026-74040 | 9.4 Critical | Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker | Oct 13, 2026 |
| CVE-2026-74037 | 8.6 High | Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token | Oct 13, 2026 |
| CVE-2026-74036 | 8.6 High | Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies | Oct 13, 2026 |
| CVE-2026-74035 | 8.6 High | Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user | Oct 13, 2026 |
| CVE-2026-74034 | 8.7 High | Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command | Oct 13, 2026 |
| CVE-2026-74033 | 8.4 High | Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers | Oct 13, 2026 |
| CVE-2026-74032 | 5.3 Medium | Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions | Oct 13, 2026 |
| CVE-2026-74031 | 7.0 High | Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers | Oct 13, 2026 |
| CVE-2026-74030 | 6.9 Medium | Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion | Oct 13, 2026 |
| CVE-2026-109963 | 5.3 Medium | Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php | Oct 13, 2026 |
| CVE-2026-109962 | 5.3 Medium | Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API | Oct 13, 2026 |
| CVE-2026-109961 | 8.4 High | Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members | Oct 13, 2026 |
| CVE-2026-109960 | 8.7 High | Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value | Oct 13, 2026 |
| CVE-2026-109959 | 5.3 Medium | EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint | Oct 13, 2026 |
| CVE-2026-109958 | 5.3 Medium | EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search | Oct 13, 2026 |
| CVE-2026-109957 | 5.3 Medium | EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter | Oct 13, 2026 |
| CVE-2026-109956 | 8.3 High | NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path | Oct 13, 2026 |
| CVE-2026-109955 | 6.9 Medium | Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding | Oct 13, 2026 |
| CVE-2026-109954 | 8.3 High | Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference | Oct 13, 2026 |
| CVE-2026-109953 | 6.0 Medium | FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin | Oct 13, 2026 |
| CVE-2026-109952 | 6.0 Medium | FreeRDP 3.0.0 before 3.32.0 Security Protocol Downgrade via Negotiation Response | Oct 13, 2026 |
| CVE-2026-109951 | 6.9 Medium | FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name | Oct 13, 2026 |
| CVE-2026-109950 | 5.3 Medium | FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via RD Gateway Messages | Oct 13, 2026 |
| CVE-2026-109949 | 7.1 High | FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard | Oct 13, 2026 |
| CVE-2026-109948 | 5.3 Medium | FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection | Oct 13, 2026 |
| CVE-2026-109947 | 7.1 High | FreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive_process_irp_read | Oct 13, 2026 |
| CVE-2026-109946 | 7.1 High | FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width | Oct 13, 2026 |
| CVE-2026-109945 | 6.0 Medium | FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmit | Oct 13, 2026 |
| CVE-2026-109944 | 7.1 High | FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Smartcard Handle | Oct 13, 2026 |
| CVE-2026-109943 | 7.1 High | FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order | Oct 13, 2026 |
| CVE-2026-109942 | 7.1 High | FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet | Oct 13, 2026 |
| CVE-2026-109941 | 7.1 High | FreeRDP 2.3.0 before 3.32.0 Infinite Loop via RD Gateway Chunked Response | Oct 13, 2026 |
| CVE-2026-109940 | 5.1 Medium | FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name | Oct 13, 2026 |
| CVE-2026-109939 | 7.1 High | FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order | Oct 13, 2026 |
| CVE-2026-109938 | 7.1 High | FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update | Oct 13, 2026 |
| CVE-2026-109680 | 6.0 Medium | FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username | Oct 13, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.