Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,187 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-109718 | 5.4 Medium | Use-after-free in the XML component | Oct 13, 2026 |
| CVE-2026-109716 | 8.1 High | Incorrect boundary conditions in the JavaScript Engine component | Oct 13, 2026 |
| CVE-2026-109715 | 8.1 High | Incorrect boundary conditions in the JavaScript Engine component | Oct 13, 2026 |
| CVE-2026-109712 | 7.1 High | Sandbox escape due to uninitialized memory in the Graphics component | Oct 13, 2026 |
| CVE-2026-109710 | 5.4 Medium | Use-after-free in the Graphics: Text component | Oct 13, 2026 |
| CVE-2026-109706 | 5.4 Medium | Use-after-free in the Storage: IndexedDB component | Oct 13, 2026 |
| CVE-2026-109976 | 4.7 Medium | Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection | Oct 13, 2026 |
| CVE-2026-109404 | 6.9 Medium | conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery | Oct 13, 2026 |
| CVE-2026-109833 | 5.9 Medium | Gnome-remote-desktop: heap buffer overflow in gnome-remote-desktop vnc tls peek buffer handling allows remote denial of service | Oct 13, 2026 |
| CVE-2026-109403 | 6.9 Medium | conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery | Oct 13, 2026 |
| CVE-2026-109402 | 5.3 Medium | conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery | Oct 13, 2026 |
| CVE-2026-94410 | 5.3 Medium | Exposure of Role List to Low-Privileged Remote Users in Bender Custom&Partner Service | Oct 13, 2026 |
| CVE-2026-109832 | 7.5 High | Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted) | Oct 13, 2026 |
| CVE-2026-109190 | 5.3 Medium | conductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgery | Oct 13, 2026 |
| CVE-2026-89279 | 6.5 Medium | Active Directory Password Change CSRF in AuthTake Technology's authtake | Oct 13, 2026 |
| CVE-2026-109189 | 5.3 Medium | fit2cloud MeterSphere Swagger3 Swagger3ParserApiDefinition.java Swagger3ParserApiDefinition.testUrlTimeout server-side request forgery | Oct 13, 2026 |
| CVE-2026-63316 | 8.7 High | SQL Injection in Payload CMS | Oct 13, 2026 |
| CVE-2026-109160 | 5.3 Medium | PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect | Oct 13, 2026 |
| CVE-2026-109157 | 9.4 Critical | TRENDnet TEW-432BRP formTcpipSetup stack-based overflow | Oct 13, 2026 |
| CVE-2026-109156 | 5.3 Medium | SeldonIO MLServer environment_tarball env.py _extract_env path traversal | Oct 13, 2026 |
| CVE-2026-109155 | 5.3 Medium | DeepPavlov Model Download untar path traversal | Oct 13, 2026 |
| CVE-2026-109153 | 5.3 Medium | MosaicML Composer Checkpoint Extraction checkpoint.py tarball.extractall path traversal | Oct 13, 2026 |
| CVE-2026-109152 | 5.3 Medium | jbardin scp.py SCP Receive _recv_pushd path traversal | Oct 13, 2026 |
| CVE-2026-109149 | 6.9 Medium | beautifier js-beautify memory allocation | Oct 13, 2026 |
| CVE-2026-109162 | 6.3 Medium | TYPO3 CMS - Security Misconfiguration in Form Framework | Oct 13, 2026 |
| CVE-2026-102076 | 8.7 High | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact… | Oct 13, 2026 |
| CVE-2026-102075 | 8.7 High | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact… | Oct 13, 2026 |
| CVE-2026-102074 | 8.7 High | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact… | Oct 13, 2026 |
| CVE-2026-102073 | 8.8 High | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact… | Oct 13, 2026 |
| CVE-2026-89208 | 6.9 Medium | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo… | Oct 13, 2026 |
| CVE-2026-89206 | 5.3 Medium | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to modify the state of scheduled actions. This could allow an… | Oct 13, 2026 |
| CVE-2026-89205 | 5.3 Medium | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to schedule special operations. This could allow an authenticated… | Oct 13, 2026 |
| CVE-2026-89204 | 5.3 Medium | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify,… | Oct 13, 2026 |
| CVE-2026-89203 | 5.3 Medium | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for… | Oct 13, 2026 |
| CVE-2026-89202 | 7.1 High | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal… | Oct 13, 2026 |
| CVE-2026-89201 | 7.7 High | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an… | Oct 13, 2026 |
| CVE-2026-89200 | 8.4 High | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker… | Oct 13, 2026 |
| CVE-2026-89199 | 8.7 High | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to… | Oct 13, 2026 |
| CVE-2026-89198 | 8.7 High | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with… | Oct 13, 2026 |
| CVE-2026-89197 | 8.7 High | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile… | Oct 13, 2026 |
| CVE-2026-89196 | 8.7 High | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an… | Oct 13, 2026 |
| CVE-2026-85115 | 6.8 Medium | A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow an… | Oct 13, 2026 |
| CVE-2026-85114 | 8.7 High | A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could… | Oct 13, 2026 |
| CVE-2026-78557 | 7.7 High | A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front… | Oct 13, 2026 |
| CVE-2026-78556 | 7.6 High | A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept… | Oct 13, 2026 |
| CVE-2026-72895 | 8.4 High | A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test… | Oct 13, 2026 |
| CVE-2026-63357 | 5.3 Medium | Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the… | Oct 13, 2026 |
| CVE-2026-63356 | 5.3 Medium | Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who… | Oct 13, 2026 |
| CVE-2026-63355 | 5.3 Medium | Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This could allow an attacker to social engineer an authorized user who holds the… | Oct 13, 2026 |
| CVE-2026-63354 | 9.4 Critical | Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the… | Oct 13, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.