Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,217 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-109364 | 6.9 Medium | Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying | Oct 12, 2026 |
| CVE-2026-109363 | 8.7 High | Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction | Oct 12, 2026 |
| CVE-2026-109362 | 5.3 Medium | Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens | Oct 12, 2026 |
| CVE-2026-109361 | 7.0 High | MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path | Oct 12, 2026 |
| CVE-2026-109360 | 7.7 High | MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP | Oct 12, 2026 |
| CVE-2026-109359 | 8.7 High | Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery | Oct 12, 2026 |
| CVE-2026-109358 | 8.5 High | Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation | Oct 12, 2026 |
| CVE-2026-109357 | 9.2 Critical | LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header | Oct 12, 2026 |
| CVE-2026-109356 | 5.3 Medium | LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController | Oct 12, 2026 |
| CVE-2026-109355 | 5.3 Medium | LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List | Oct 12, 2026 |
| CVE-2026-109354 | 5.3 Medium | LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter | Oct 12, 2026 |
| CVE-2026-109353 | 7.1 High | LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php | Oct 12, 2026 |
| CVE-2026-109352 | 5.3 Medium | LibreNMS before 26.9.0 Stored XSS via wireless sensor description | Oct 12, 2026 |
| CVE-2026-109351 | 7.1 High | Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count | Oct 12, 2026 |
| CVE-2026-109350 | 7.1 High | Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance | Oct 12, 2026 |
| CVE-2026-109349 | 7.1 High | gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header | Oct 12, 2026 |
| CVE-2026-109348 | 5.3 Medium | Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing | Oct 12, 2026 |
| CVE-2026-109347 | 8.6 High | Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass | Oct 12, 2026 |
| CVE-2026-109346 | 8.5 High | better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device | Oct 12, 2026 |
| CVE-2026-109345 | 5.1 Medium | DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root | Oct 12, 2026 |
| CVE-2026-109344 | 5.1 Medium | DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks | Oct 12, 2026 |
| CVE-2026-109343 | 8.6 High | SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement | Oct 12, 2026 |
| CVE-2026-109342 | 5.3 Medium | SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method | Oct 12, 2026 |
| CVE-2026-109341 | 7.1 High | SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations | Oct 12, 2026 |
| CVE-2026-109340 | 5.3 Medium | SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE | Oct 12, 2026 |
| CVE-2026-109339 | 6.9 Medium | SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering | Oct 12, 2026 |
| CVE-2026-109338 | 7.1 High | SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values | Oct 12, 2026 |
| CVE-2026-109337 | 5.3 Medium | SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause | Oct 12, 2026 |
| CVE-2026-109336 | 5.3 Medium | SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after | Oct 12, 2026 |
| CVE-2026-109335 | 7.1 High | SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields | Oct 12, 2026 |
| CVE-2026-109334 | 8.6 High | SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use | Oct 12, 2026 |
| CVE-2026-109333 | 7.1 High | SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH | Oct 12, 2026 |
| CVE-2026-109332 | 2.3 Low | Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport | Oct 12, 2026 |
| CVE-2026-109331 | 7.5 High | Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget | Oct 12, 2026 |
| CVE-2026-109330 | 5.3 Medium | Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer | Oct 12, 2026 |
| CVE-2026-109329 | 8.5 High | Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php | Oct 12, 2026 |
| CVE-2026-109328 | 5.3 Medium | Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name | Oct 12, 2026 |
| CVE-2026-109327 | 5.1 Medium | Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php | Oct 12, 2026 |
| CVE-2026-109326 | 8.7 High | Grav before 2.1.7 Information Disclosure via Nested .git Directories | Oct 12, 2026 |
| CVE-2026-109325 | 8.7 High | Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy | Oct 12, 2026 |
| CVE-2026-109324 | 7.1 High | Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms | Oct 12, 2026 |
| CVE-2026-109323 | 6.9 Medium | Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization | Oct 12, 2026 |
| CVE-2026-109322 | 5.3 Medium | Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views | Oct 12, 2026 |
| CVE-2026-109321 | 9.3 Critical | Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass | Oct 12, 2026 |
| CVE-2026-109320 | 5.3 Medium | Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass | Oct 12, 2026 |
| CVE-2026-109319 | 5.3 Medium | Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation | Oct 12, 2026 |
| CVE-2026-109318 | 8.7 High | Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author | Oct 12, 2026 |
| CVE-2026-109317 | 8.6 High | Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants | Oct 12, 2026 |
| CVE-2026-109316 | 6.9 Medium | Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin | Oct 12, 2026 |
| CVE-2026-109315 | 7.1 High | Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox | Oct 12, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.