Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,195 vulnerabilities match.

CVESeveritySummary
CVE-2026-1089225.3 MediumKusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload
CVE-2026-659548.6 HighPHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
CVE-2026-835357.4 HighOpenstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparison
CVE-2026-835365.3 MediumOpenstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)
CVE-2026-854716.4 MediumQuay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable
CVE-2026-1026634.3 MediumOpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
CVE-2026-571189.8 CriticalPraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints
CVE-2026-571438.8 HighPraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
CVE-2026-181667.7 HighIBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem
CVE-2026-1054648.8 HighIBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management
CVE-2026-1089216.9 MediumKusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication
CVE-2026-891406.0 MediumTemporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state
CVE-2026-1043557.0 HighTemporal Server applies inbound namespace replication from a connected peer cluster to local namespaces
CVE-2026-1054666.5 MediumIBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions
CVE-2026-877449.1 CriticalIo.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations
CVE-2026-1054658.8 HighIBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance
CVE-2026-784046.5 MediumIBM® Db2® is vulnerable to local privilege escalation via the db2pd utility
CVE-2026-599768.1 HighConvertX: Path Traversal vulnerability leading to Arbitrary File Write
CVE-2026-599778.1 HighConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction
CVE-2026-1072266.8 MediumAsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
CVE-2026-1041025.3 Mediumcopyparty FTP: upload outside defined volumes (limited path traversal)
CVE-2026-1089205.3 MediumSourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scripting
CVE-2026-1030615.9 MediumPath traversal in Gleam via unvalidated package application names
CVE-2026-1089195.3 MediumSourceCodester Drug Recommendation System Student Registration add_student.php cross site scripting
CVE-2026-10891810.0 CriticalEdimax BR-6208AC formWlanMP command injection
CVE-2026-773669.9 Criticalobsidian-tc tokens can access arbitrary configured vaults
CVE-2026-773646.5 Mediumobsidian-tc fail-open default ACL exposes Obsidian control-directory secrets
CVE-2026-619945.4 MediumWordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability
CVE-2026-426893.7 LowWordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability
CVE-2026-773638.8 Highobsidian-tc Streamable HTTP transport permits cross-origin loopback vault access
CVE-2026-10891710.0 CriticalEdimax BR-6208AC formAutoFWupgrade command injection
CVE-2026-1094485.9 MediumpsqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters
CVE-2026-1084798.1 HighWordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2026-1084817.4 HighWordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2026-1030805.3 MediumWordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability
CVE-2026-1089166.9 MediumEdimax BR-6208AC formAccept command injection
CVE-2026-62325.2 MediumOut-of-bounds write in LR11xx Transceiver
CVE-2026-1089159.4 CriticalEdimax BR-6208AC formWlanMP buffer overflow
CVE-2026-1084826.5 MediumWordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1078626.5 MediumWordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1084865.3 MediumWordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability
CVE-2026-1074185.4 MediumWordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability
CVE-2026-1084786.5 MediumWordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1084754.3 MediumWordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability
CVE-2026-1084765.0 MediumWordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerability
CVE-2026-842869.8 CriticalOOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table
CVE-2026-1089149.4 CriticalEdimax BR-6208AC formWlSiteSurvey buffer overflow
CVE-2026-859765.4 MediumHTTP response splitting in Progress MarkLogic Server Query Console
CVE-2026-859757.5 HighCleartext transmission in Progress MarkLogic Server Amazon S3 connections
CVE-2026-859747.4 HighImproper TLS hostname verification in Progress MarkLogic Server

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.