Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,217 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-109314 | 8.5 High | Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page | Oct 12, 2026 |
| CVE-2026-109313 | 8.6 High | Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie | Oct 12, 2026 |
| CVE-2026-109312 | 8.6 High | Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form | Oct 12, 2026 |
| CVE-2026-109311 | 7.1 High | vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload | Oct 12, 2026 |
| CVE-2026-109310 | 7.1 High | SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template | Oct 12, 2026 |
| CVE-2026-109309 | 6.9 Medium | SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path | Oct 12, 2026 |
| CVE-2026-109308 | 8.7 High | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection | Oct 12, 2026 |
| CVE-2026-109307 | 2.1 Low | Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification | Oct 12, 2026 |
| CVE-2026-109306 | 6.0 Medium | Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition | Oct 12, 2026 |
| CVE-2026-109305 | 8.7 High | Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every | Oct 12, 2026 |
| CVE-2026-109304 | 6.9 Medium | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument | Oct 12, 2026 |
| CVE-2026-109303 | 5.3 Medium | Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query | Oct 12, 2026 |
| CVE-2026-109302 | 6.3 Medium | Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries | Oct 12, 2026 |
| CVE-2026-109301 | 8.2 High | Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL | Oct 12, 2026 |
| CVE-2026-109300 | 5.1 Medium | Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds | Oct 12, 2026 |
| CVE-2026-109299 | 7.1 High | Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation | Oct 12, 2026 |
| CVE-2026-109298 | 7.1 High | Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex | Oct 12, 2026 |
| CVE-2026-109297 | 7.1 High | Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules | Oct 12, 2026 |
| CVE-2026-109296 | 5.3 Medium | Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes | Oct 12, 2026 |
| CVE-2026-109295 | 5.3 Medium | Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop | Oct 12, 2026 |
| CVE-2026-109294 | 7.1 High | Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image | Oct 12, 2026 |
| CVE-2026-109293 | 7.1 High | Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint | Oct 12, 2026 |
| CVE-2026-109292 | 7.6 High | Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections | Oct 12, 2026 |
| CVE-2026-109291 | 8.5 High | Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url | Oct 12, 2026 |
| CVE-2026-109290 | 8.4 High | Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview | Oct 12, 2026 |
| CVE-2026-109289 | 5.3 Medium | Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket | Oct 12, 2026 |
| CVE-2026-109288 | 7.2 High | Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links | Oct 12, 2026 |
| CVE-2026-109287 | 5.3 Medium | Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID | Oct 12, 2026 |
| CVE-2026-109286 | 8.6 High | Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal | Oct 12, 2026 |
| CVE-2026-109285 | 2.3 Low | Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata | Oct 12, 2026 |
| CVE-2026-109284 | 5.3 Medium | Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint | Oct 12, 2026 |
| CVE-2026-109283 | 5.3 Medium | Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange | Oct 12, 2026 |
| CVE-2026-109282 | 2.0 Low | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML Encoders | Oct 12, 2026 |
| CVE-2026-109281 | 4.8 Medium | ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read via -fx Option | Oct 12, 2026 |
| CVE-2026-109280 | 2.0 Low | ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option | Oct 12, 2026 |
| CVE-2026-109279 | 2.0 Low | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access | Oct 12, 2026 |
| CVE-2026-109278 | 6.3 Medium | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operation | Oct 12, 2026 |
| CVE-2026-109277 | 4.8 Medium | ImageMagick before 7.1.2-32 Policy Bypass via -script Operation | Oct 12, 2026 |
| CVE-2026-109276 | 6.9 Medium | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder | Oct 12, 2026 |
| CVE-2026-109275 | 6.3 Medium | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder | Oct 12, 2026 |
| CVE-2026-109274 | 2.0 Low | ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script | Oct 12, 2026 |
| CVE-2026-109273 | 6.9 Medium | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in PostScript Decoder | Oct 12, 2026 |
| CVE-2026-109272 | 6.3 Medium | ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript Decoder | Oct 12, 2026 |
| CVE-2026-109271 | 6.3 Medium | ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder | Oct 12, 2026 |
| CVE-2026-109270 | 4.8 Medium | ImageMagick before 7.1.2-32 Memory Leak via -process Option | Oct 12, 2026 |
| CVE-2026-109269 | 6.9 Medium | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure via JPEG Decoder | Oct 12, 2026 |
| CVE-2026-109268 | 6.3 Medium | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG2000 | Oct 12, 2026 |
| CVE-2026-109267 | 6.9 Medium | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder | Oct 12, 2026 |
| CVE-2026-109266 | 6.9 Medium | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 XML Injection via CIP Encoder | Oct 12, 2026 |
| CVE-2026-109265 | 6.9 Medium | ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile | Oct 12, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.