Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,187 vulnerabilities match.

CVESeveritySummary
CVE-2026-1091064.8 MediumPolaris Office App Document Intake com.infraware.service.m.n.a path traversal
CVE-2026-758268.5 HighTeltonika Command Injection in Backup function
CVE-2026-1089756.9 MediumSourceCodester Library Management System add_admin.php move_uploaded_file unrestricted upload
CVE-2026-1089746.9 MediumSourceCodester E-Learning System Users.php save_users unrestricted upload
CVE-2026-1089736.9 MediumSourceCodester Contact Tracing System Users.php move_uploaded_file unrestricted upload
CVE-2026-1033167.1 HighThe macOS version of the DigiD app is not signed with Hardened Runtime
CVE-2026-1089726.9 MediumSourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication
CVE-2026-892715.3 MediumWP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile
CVE-2026-892696.8 MediumWP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode
CVE-2026-548676.5 MediumWordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vulnerability
CVE-2026-548686.5 MediumWordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability
CVE-2026-548696.5 MediumWordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-548706.5 MediumWordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1089719.4 CriticalD-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification
CVE-2026-1089706.9 Mediumitsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql injection
CVE-2026-1089696.9 Mediumitsmeravitejak Online-Examination-System Session session.php checkLogin comparison
CVE-2026-1089686.9 MediumSourceCodester Performance Indicator System sales_history.php sql injection
CVE-2026-1089676.9 MediumSourceCodester Performance Indicator System edit_credit.php sql injection
CVE-2026-1089666.9 MediumSourceCodester Performance Indicator System product.php sql injection
CVE-2026-1089656.9 MediumSourceCodester Performance Indicator System edit_quantity.php sql injection
CVE-2026-1097589.3 CriticalPerforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the…
CVE-2026-1089646.9 MediumSourceCodester Performance Indicator System addproduct.php sql injection
CVE-2026-1089625.3 Mediumstoryicon comfyui_segment_anything GroundingDINO Model Loading slconfig.py SLConfig._file2dict code injection
CVE-2026-1089615.3 MediumPaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.__init__ code injection
CVE-2026-1089604.8 MediumTiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds
CVE-2026-1089595.3 Mediumitsourcecode Online Cake Ordering System addtransacdetail.php sql injection
CVE-2026-1097865.3 MediumIn fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can…
CVE-2026-1089585.3 MediumTensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization
CVE-2026-1089575.3 MediumTinyLLaVA TinyLLaVA_Factory TinyLlavaConfig configuration_tinyllava.py _load_text_config code injection
CVE-2026-1089566.9 Mediumcode-projects Online Reviewer System User Update btn_functions.php sql injection
CVE-2026-1089554.8 MediumTiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds
CVE-2026-350017.1 HighOpenS100 S-102 Parser Integer Overflow Heap Buffer Overflow
CVE-2026-1089545.3 Mediumk2-fsa sherpa-onnx Offline Transducer Greedy Search Decoder offline-transducer-greedy-search-decoder.cc Decode buffer overflow
CVE-2026-1089485.3 Mediumcode-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes
CVE-2026-59544.2 MediumIncorrect Authorization in GitLab
CVE-2026-65674.3 MediumIncorrect Authorization in GitLab
CVE-2026-77675.8 MediumURL Redirection to Untrusted Site ('Open Redirect') in GitLab
CVE-2026-92682.7 LowIncorrect Authorization in GitLab
CVE-2026-142104.3 MediumInsufficient Granularity of Access Control in GitLab
CVE-2026-145524.3 MediumIncorrect Authorization in GitLab
CVE-2026-148148.2 HighPermissive Regular Expression in GitLab
CVE-2026-162755.3 MediumIncorrect Authorization in GitLab
CVE-2026-163018.5 HighIncorrect Authorization in GitLab
CVE-2026-783354.2 MediumIncorrect Authorization in GitLab
CVE-2026-818397.7 HighIncorrect Authorization in GitLab
CVE-2026-826323.1 LowIncorrect Authorization in GitLab
CVE-2026-842845.3 MediumIncorrect Authorization in GitLab
CVE-2026-855295.3 MediumIncorrect Authorization in GitLab
CVE-2026-925284.2 MediumIncorrect Authorization in GitLab
CVE-2026-928838.7 HighImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.