Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,195 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2020-37280 | 8.7 High | cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengths | Oct 12, 2026 |
| CVE-2020-37279 | 9.2 Critical | easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function | Oct 12, 2026 |
| CVE-2026-16678 | 4.5 Medium | IBM Power Systems Firmware Denial of Service | Oct 12, 2026 |
| CVE-2026-96261 | 7.3 High | IBM Power Systems Firmware Buffer Overflow | Oct 12, 2026 |
| CVE-2026-96262 | 8.2 High | IBM Power Systems Firmware Buffer Overflow | Oct 12, 2026 |
| CVE-2026-96263 | 8.2 High | IBM Power Systems Firmware Buffer Overflow | Oct 12, 2026 |
| CVE-2026-96264 | 8.2 High | IBM Power Systems Firmware Buffer Overflow | Oct 12, 2026 |
| CVE-2026-96265 | 8.2 High | IBM Power Systems Firmware Improper Memory Buffer Restriction | Oct 12, 2026 |
| CVE-2026-96266 | 8.2 High | IBM Power Systems Firmware Buffer Overflow | Oct 12, 2026 |
| CVE-2026-84313 | 8.8 High | Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover | Oct 12, 2026 |
| CVE-2026-84321 | 5.4 Medium | Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable | Oct 12, 2026 |
| CVE-2026-53997 | 9.1 Critical | Netherman Portal del Hermano Account Takeover via Password Reset Oracle | Oct 12, 2026 |
| CVE-2026-84314 | 8.7 High | Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint | Oct 12, 2026 |
| CVE-2026-108930 | 5.1 Medium | Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure | Oct 12, 2026 |
| CVE-2026-84320 | 6.3 Medium | Nginx UI: Auto backup name allows path traversal outside validated storage path | Oct 12, 2026 |
| CVE-2026-109427 | 7.1 High | Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs | Oct 12, 2026 |
| CVE-2026-109426 | 8.2 High | Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string | Oct 12, 2026 |
| CVE-2026-108929 | 9.4 Critical | Netcore NR268 DDNS DDNSset.cgi execvp argument injection | Oct 12, 2026 |
| CVE-2026-84318 | 8.8 High | Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE | Oct 12, 2026 |
| CVE-2026-108928 | 5.3 Medium | itsourcecode Online Admission System sum.php sql injection | Oct 12, 2026 |
| CVE-2026-97691 | 4.3 Medium | Convex: Unauthorized data access | Oct 12, 2026 |
| CVE-2026-106495 | 4.3 Medium | Backstage: Improper access control in backend action invocation | Oct 12, 2026 |
| CVE-2026-92120 | 9.1 Critical | Apache Allura: Oauth1 Replay Attack | Oct 12, 2026 |
| CVE-2026-92119 | 9.1 Critical | Apache Allura: REST API Mass Assignment | Oct 12, 2026 |
| CVE-2026-84315 | 8.3 High | Nginx UI OTP secure-session step-up is missing on sensitive mutation routes | Oct 12, 2026 |
| CVE-2026-92116 | 9.1 Critical | Apache Allura: OAuth1 missing callback validation | Oct 12, 2026 |
| CVE-2026-41508 | 5.8 Medium | OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling | Oct 12, 2026 |
| CVE-2026-108927 | 5.3 Medium | itsourcecode Baptism Information Management System pbaptism.php sql injection | Oct 12, 2026 |
| CVE-2026-41504 | 5.8 Medium | OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields | Oct 12, 2026 |
| CVE-2026-104774 | 5.8 Medium | OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass | Oct 12, 2026 |
| CVE-2026-41510 | 7.2 High | OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding | Oct 12, 2026 |
| CVE-2026-109425 | 6.9 Medium | Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets | Oct 12, 2026 |
| CVE-2026-95838 | 4.6 Medium | containerd: Unpack DoS via repeated opaque whiteouts | Oct 12, 2026 |
| CVE-2026-108926 | 5.3 Medium | itsourcecode Baptism Information Management System ebaptism.php sql injection | Oct 12, 2026 |
| CVE-2026-95837 | 7.8 High | containerd CRI plugin: Checkpoint restore bypasses destination security context | Oct 12, 2026 |
| CVE-2026-109424 | 8.2 High | NetEase Cloud Music Weak Encryption via eapi/xeapi | Oct 12, 2026 |
| CVE-2026-109423 | 9.1 Critical | NetEase Cloud Music TLS Certificate Validation Bypass | Oct 12, 2026 |
| CVE-2026-109422 | 9.2 Critical | NetEase Cloud Music RCE via os.navigateExternal IPC | Oct 12, 2026 |
| CVE-2026-109575 | 9.8 Critical | In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a… | Oct 12, 2026 |
| CVE-2026-96012 | 9.9 Critical | IBM Db2 Mirror for i Privilege Escalation | Oct 12, 2026 |
| CVE-2026-108924 | 5.3 Medium | getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization | Oct 12, 2026 |
| CVE-2026-104364 | 3.3 Low | IBM® Db2® Denial of Service | Oct 12, 2026 |
| CVE-2026-104332 | 5.5 Medium | IBM® Db2® Denial of Service | Oct 12, 2026 |
| CVE-2026-108923 | 5.3 Medium | 1024-lab smart-admin Support Config Query queryByKey access control | Oct 12, 2026 |
| CVE-2025-27895 | 6.1 Medium | DB2 Recovery Expert for Linux, UNIX and Windows Cross-Site Scripting | Oct 12, 2026 |
| CVE-2025-27896 | 6.1 Medium | IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting | Oct 12, 2026 |
| CVE-2026-108361 | 7.2 High | Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks | Oct 12, 2026 |
| CVE-2026-108362 | 9.1 Critical | Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack) | Oct 12, 2026 |
| CVE-2025-27897 | 6.1 Medium | IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting | Oct 12, 2026 |
| CVE-2025-27902 | 6.1 Medium | IBM Db2 Recovery Expert for Linux, Unix and Windows Information Disclosure | Oct 12, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.