Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,195 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-78799 | 9.8 Critical | Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai… | Oct 13, 2026 |
| CVE-2026-52394 | 9.1 Critical | DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. | Oct 13, 2026 |
| CVE-2026-37107 | 9.8 Critical | An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component | Oct 13, 2026 |
| CVE-2026-104587 | 5.4 Medium | blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields… | Oct 13, 2026 |
| CVE-2026-104585 | 9.8 Critical | Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module. | Oct 13, 2026 |
| CVE-2026-104584 | 9.8 Critical | reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and… | Oct 13, 2026 |
| CVE-2024-34326 | 6.1 Medium | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint. | Oct 13, 2026 |
| CVE-2024-34324 | 9.1 Critical | An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie. | Oct 13, 2026 |
| CVE-2024-34323 | 10.0 Critical | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request. | Oct 13, 2026 |
| CVE-2024-34321 | 6.1 Medium | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint. | Oct 13, 2026 |
| CVE-2024-34320 | 9.8 Critical | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints. | Oct 13, 2026 |
| CVE-2024-34319 | 6.5 Medium | A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request. | Oct 13, 2026 |
| CVE-2026-108941 | 2.4 Low | Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection | Oct 12, 2026 |
| CVE-2026-108940 | 6.9 Medium | EricLBuehler Mistral.rs handlers.rs calibration_apply path traversal | Oct 12, 2026 |
| CVE-2026-17484 | 5.3 Medium | IBM i is Information Disclosure | Oct 12, 2026 |
| CVE-2026-17487 | 5.3 Medium | IBM i is Information Disclosure | Oct 12, 2026 |
| CVE-2026-18318 | 5.3 Medium | IBM i Information Disclosure | Oct 12, 2026 |
| CVE-2026-18343 | 4.4 Medium | IBM i is Affected By An Improper Privilege Management Vulnerability | Oct 12, 2026 |
| CVE-2026-81858 | 5.4 Medium | IBM i is Affected By A Denial of Service Vulnerability in Host Servers | Oct 12, 2026 |
| CVE-2026-93886 | 8.3 High | IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI | Oct 12, 2026 |
| CVE-2026-96119 | 9.9 Critical | IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI | Oct 12, 2026 |
| CVE-2026-19938 | 5.9 Medium | Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails | Oct 12, 2026 |
| CVE-2026-19937 | 5.7 Medium | Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses | Oct 12, 2026 |
| CVE-2026-19936 | 4.8 Medium | Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference | Oct 12, 2026 |
| CVE-2026-108939 | 6.9 Medium | EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery | Oct 12, 2026 |
| CVE-2026-108938 | 6.9 Medium | code-projects Matrimonial System matrimony.sql file access | Oct 12, 2026 |
| CVE-2026-75076 | 4.3 Medium | IBM Aspera Enterprise Webapps Information Disclosure | Oct 12, 2026 |
| CVE-2026-75095 | 7.5 High | IBM Aspera Enterprise Webapps Denial of Service | Oct 12, 2026 |
| CVE-2026-75621 | 6.2 Medium | IBM Aspera Enterprise Webapps Execution with Unnecessary Privileges | Oct 12, 2026 |
| CVE-2026-75782 | 7.8 High | IBM Aspera Enterprise Webapps Untrusted Search Path | Oct 12, 2026 |
| CVE-2026-92832 | 5.1 Medium | IBM Aspera Enterprise Webapps Information Disclosure | Oct 12, 2026 |
| CVE-2026-93891 | 7.6 High | Security Vulnerability identified in IBM TRIRIGA - XXE | Oct 12, 2026 |
| CVE-2026-93892 | 8.1 High | Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console | Oct 12, 2026 |
| CVE-2026-102627 | 8.8 High | Security Vulnerability identified in IBM TRIRIGA - Zip Slip | Oct 12, 2026 |
| CVE-2026-108937 | 6.9 Medium | code-projects Online Ticket Reservation System medallion.sql file information disclosure | Oct 12, 2026 |
| CVE-2026-17475 | 7.1 High | IBM Planning Analytics Local is affected by security vulnerabilities | Oct 12, 2026 |
| CVE-2026-18541 | 6.4 Medium | IBM Planning Analytics Local is affected by security vulnerabilities | Oct 12, 2026 |
| CVE-2026-19620 | 8.8 High | IBM Planning Analytics Local is affected by security vulnerabilities | Oct 12, 2026 |
| CVE-2026-19622 | 8.8 High | IBM Planning Analytics Local is affected by security vulnerabilities | Oct 12, 2026 |
| CVE-2026-75063 | 5.4 Medium | IBM Planning Analytics Local is affected by security vulnerabilities | Oct 12, 2026 |
| CVE-2026-75061 | 7.5 High | IBM Planning Analytics Local is affected by security vulnerabilities | Oct 12, 2026 |
| CVE-2026-19627 | 8.2 High | IBM Planning Analytics Local is affected by security vulnerabilities | Oct 12, 2026 |
| CVE-2026-85457 | 8.1 High | IBM Planning Analytics Local is affected by security vulnerabilities | Oct 12, 2026 |
| CVE-2026-108936 | 4.8 Medium | Edimax BR-6208AC QoS Page formQoS cross site scripting | Oct 12, 2026 |
| CVE-2026-82101 | 9.6 Critical | DataStage on Cloud Pak for Data Path Traversal | Oct 12, 2026 |
| CVE-2026-82103 | 9.6 Critical | DataStage on Cloud Pak for Data Information Disclosure | Oct 12, 2026 |
| CVE-2026-82110 | 9.6 Critical | DataStage on Cloud Pak for Data Path Traversal | Oct 12, 2026 |
| CVE-2026-82096 | 8.8 High | DataStage on Cloud Pak for Data Command Injection | Oct 12, 2026 |
| CVE-2026-82108 | 8.8 High | DataStage on Cloud Pak for Data Code Injection | Oct 12, 2026 |
| CVE-2026-84418 | 7.4 High | DataStage on Cloud Pak for Data Improper Certificate Validation | Oct 12, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.