Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,195 vulnerabilities match.

CVESeveritySummary
CVE-2026-909217.5 HighMaximo AI Service Denial of Service
CVE-2026-928767.5 HighIBM Maximo Application Suite - IoT Component Denial of Service
CVE-2026-494845.1 MediumCode for IBM i: Temporary files are visible to all users
CVE-2026-494838.9 HighCode for IBMi: Uses IBM i components with blind check allowing arbitrary code execution
CVE-2026-539226.5 Mediumodhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)
CVE-2026-1089325.3 MediumNetcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting
CVE-2026-412106.5 MediumMoonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id
CVE-2026-1036585.9 MediumGNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int…
CVE-2026-1025395.7 MediumSuper Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is set
CVE-2026-843127.1 HighNginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
CVE-2026-843608.1 HighNginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
CVE-2026-843168.8 HighNginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
CVE-2026-843198.3 HighNginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
CVE-2026-185137.2 HighIBM Maximo Application Suite - Location Service for Esri Component Improper Privilege Management
CVE-2026-185177.7 HighIBM Maximo Application Suite - Location Service for Esri Component Improper Access Control
CVE-2026-185298.7 HighIBM Maximo Application Suite - Location Service for Esri Component Code Execution
CVE-2026-185336.5 MediumIBM Maximo Application Suite - Location Service for Esri Component Code Execution
CVE-2026-185378.7 HighIBM Maximo Application Suite - Location Service for Esri Component Code Execution
CVE-2026-758817.5 HighIBM Maximo Application Suite - IoT Component Denial of Service
CVE-2026-786737.5 HighMaximo AI Service Improper Input Validation
CVE-2026-1050527.5 HighIBM Maximo Application Suite Information Disclosure
CVE-2026-1089315.3 MediumNetcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting
CVE-2026-843178.8 HighNginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
CVE-2026-1095712.3 LowFire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE
CVE-2026-1095705.3 MediumFire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notification Injection
CVE-2026-1095699.3 Criticalsandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace
CVE-2026-1095687.1 HighShaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routes
CVE-2026-1095678.6 HighRapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component
CVE-2026-1095669.3 CriticalRapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder
CVE-2026-1095655.3 MediumRapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component
CVE-2026-1095642.3 LowLearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint
CVE-2026-1095638.7 HighN3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex
CVE-2026-1095625.3 MediumSnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API
CVE-2026-1095612.3 Lowgoose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations
CVE-2026-1095607.7 HighContinue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chaining
CVE-2026-1095598.4 HighEdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate
CVE-2026-1095588.5 HighEdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview
CVE-2026-1095578.4 HighEdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview
CVE-2026-1095567.3 HighEdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC
CVE-2026-1093808.7 Highmodern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field
CVE-2026-1093796.9 MediumCockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check
CVE-2026-1093785.3 MediumSPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url
CVE-2026-1093775.3 MediumERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods
CVE-2026-1093765.3 MediumERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html
CVE-2026-1093754.9 MediumVercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction
CVE-2025-714299.3 CriticalGPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py
CVE-2024-583895.1 MediumHoloViz Panel from 1.2.2 before 1.9.0 Open Redirect via next Parameter
CVE-2022-510206.0 MediumFlower before 2.2.0 CSRF via Worker and Task Control API Endpoints
CVE-2021-480128.8 Highfast-toml through 0.5.4 Prototype Pollution via __proto__ Keys in Parsed TOML
CVE-2021-480118.7 HighServor 1.0.0 through 4.0.2 Unauthenticated Path Traversal via URL-Encoded Dot Segments

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.