Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,187 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-97229 | 10.0 Critical | Integer Overflow or Wraparound in GitLab | Oct 13, 2026 |
| CVE-2026-96893 | 7.3 High | Improper Neutralization of Input Used for LLM Prompting in GitLab | Oct 13, 2026 |
| CVE-2026-100104 | 3.5 Low | Server-Side Request Forgery (SSRF) in GitLab | Oct 13, 2026 |
| CVE-2026-100755 | 4.6 Medium | Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab | Oct 13, 2026 |
| CVE-2026-101168 | 6.2 Medium | Insertion of Sensitive Information into Log File in GitLab | Oct 13, 2026 |
| CVE-2026-103549 | 2.7 Low | Incorrect Authorization in GitLab | Oct 13, 2026 |
| CVE-2026-104661 | 4.3 Medium | Incorrect Privilege Assignment in GitLab | Oct 13, 2026 |
| CVE-2026-105458 | 4.3 Medium | Reliance on Untrusted Inputs in a Security Decision in GitLab | Oct 13, 2026 |
| CVE-2026-108947 | 4.8 Medium | yoshitomo-matsubara torchdistill main_util.py load_ckpt deserialization | Oct 13, 2026 |
| CVE-2026-87689 | 9.8 Critical | Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints | Oct 13, 2026 |
| CVE-2026-108945 | 4.8 Medium | iMoonLab yolov13 AutoBackend Model Loading autobackend.py eval code injection | Oct 13, 2026 |
| CVE-2026-108944 | 2.4 Low | repository RAE Config-Driven Model Instantiation model_utils.py get_obj_from_str code injection | Oct 13, 2026 |
| CVE-2026-89124 | 4.3 Medium | Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration) | Oct 13, 2026 |
| CVE-2026-89122 | 6.1 Medium | Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal | Oct 13, 2026 |
| CVE-2026-89121 | 4.7 Medium | Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object) | Oct 13, 2026 |
| CVE-2026-89120 | 7.1 High | Missing authorization check in SAP ABAP Platform | Oct 13, 2026 |
| CVE-2026-89118 | 5.3 Medium | Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal | Oct 13, 2026 |
| CVE-2026-89117 | 6.1 Medium | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal | Oct 13, 2026 |
| CVE-2026-89116 | 5.9 Medium | OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code | Oct 13, 2026 |
| CVE-2026-89113 | 8.8 High | SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) | Oct 13, 2026 |
| CVE-2026-89112 | 6.5 Medium | Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure | Oct 13, 2026 |
| CVE-2026-89111 | 10.0 Critical | OAuth2 SSRF vulnerability in SAP Cloud SDK for Python | Oct 13, 2026 |
| CVE-2026-89110 | 9.9 Critical | Broken Access Control in SAP NetWeaver Visual Composer | Oct 13, 2026 |
| CVE-2026-89108 | 9.1 Critical | Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service) | Oct 13, 2026 |
| CVE-2026-89107 | 9.9 Critical | Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) | Oct 13, 2026 |
| CVE-2026-89106 | 4.4 Medium | Cross Site Scripting (XSS) vulnerability in SAPUI5 | Oct 13, 2026 |
| CVE-2026-89105 | 4.2 Medium | Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library | Oct 13, 2026 |
| CVE-2026-76976 | 5.4 Medium | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) | Oct 13, 2026 |
| CVE-2026-76975 | 6.1 Medium | Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay) | Oct 13, 2026 |
| CVE-2026-76972 | 6.5 Medium | Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence | Oct 13, 2026 |
| CVE-2026-58249 | 7.5 High | Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) | Oct 13, 2026 |
| CVE-2026-58242 | 3.5 Low | Improper Authorization check in SAP Cloud Connector | Oct 13, 2026 |
| CVE-2026-108943 | 4.8 Medium | ModelTC LightX2V Tokenizer cosmos3_runner.py AutoTokenizer.from_pretrained code injection | Oct 13, 2026 |
| CVE-2026-108942 | 5.1 Medium | philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting | Oct 13, 2026 |
| CVE-2026-95127 | 7.5 High | An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c | Oct 13, 2026 |
| CVE-2026-95124 | 7.5 High | Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache() | Oct 13, 2026 |
| CVE-2026-95122 | 7.5 High | mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service | Oct 13, 2026 |
| CVE-2026-95121 | 7.8 High | An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. A specially crafted MP4 file can cause an undersized rtp atom to produce a near-2^64 allocation size through an… | Oct 13, 2026 |
| CVE-2026-95117 | 3.7 Low | Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote attacker to cause a denial of service via the jsmn.h, jsmn_parse(), example/jsondump.c, dump() components | Oct 13, 2026 |
| CVE-2026-95115 | 7.5 High | Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser | Oct 13, 2026 |
| CVE-2026-95114 | 7.5 High | libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service | Oct 13, 2026 |
| CVE-2026-78802 | 9.8 Critical | An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code. | Oct 13, 2026 |
| CVE-2026-78799 | 9.8 Critical | Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai… | Oct 13, 2026 |
| CVE-2026-52394 | 9.1 Critical | DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. | Oct 13, 2026 |
| CVE-2026-37107 | 9.8 Critical | An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component | Oct 13, 2026 |
| CVE-2026-104587 | 5.4 Medium | blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields… | Oct 13, 2026 |
| CVE-2026-104585 | 9.8 Critical | Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module. | Oct 13, 2026 |
| CVE-2026-104584 | 9.8 Critical | reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and… | Oct 13, 2026 |
| CVE-2024-34326 | 6.1 Medium | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint. | Oct 13, 2026 |
| CVE-2024-34324 | 9.1 Critical | An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie. | Oct 13, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.