Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,217 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-109264 | 6.3 Medium | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder | Oct 12, 2026 |
| CVE-2026-109263 | 6.3 Medium | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV Encoder | Oct 12, 2026 |
| CVE-2026-109262 | 6.9 Medium | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in SVG Encoder | Oct 12, 2026 |
| CVE-2026-109261 | 6.3 Medium | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder | Oct 12, 2026 |
| CVE-2026-109260 | 6.3 Medium | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder | Oct 12, 2026 |
| CVE-2026-109259 | 6.9 Medium | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder | Oct 12, 2026 |
| CVE-2026-109258 | 2.0 Low | ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation | Oct 12, 2026 |
| CVE-2026-109257 | 8.2 High | FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure | Oct 12, 2026 |
| CVE-2026-109256 | 6.0 Medium | FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion | Oct 12, 2026 |
| CVE-2026-109255 | 6.1 Medium | FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length | Oct 12, 2026 |
| CVE-2026-109254 | 6.0 Medium | FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path | Oct 12, 2026 |
| CVE-2026-109253 | 6.0 Medium | FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read | Oct 12, 2026 |
| CVE-2026-109252 | 6.0 Medium | FreeRDP from 3.9.0 before 3.32.0 RDPEAR NULL Pointer Dereference via KERB_RPC_INTERNAL_NAME | Oct 12, 2026 |
| CVE-2026-109251 | 6.0 Medium | FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry | Oct 12, 2026 |
| CVE-2026-109250 | 7.0 High | FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect_keys() | Oct 12, 2026 |
| CVE-2026-109249 | 6.8 Medium | FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing | Oct 12, 2026 |
| CVE-2026-109248 | 6.9 Medium | FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via WinPR Clipboard cFileName | Oct 12, 2026 |
| CVE-2026-109247 | 2.1 Low | FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName | Oct 12, 2026 |
| CVE-2026-109246 | 7.1 High | FreeRDP before 3.32.0 Shadow Server Divide-by-Zero via Frame Acknowledge PDU | Oct 12, 2026 |
| CVE-2026-109245 | 7.4 High | FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request | Oct 12, 2026 |
| CVE-2026-109244 | 6.8 Medium | FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert | Oct 12, 2026 |
| CVE-2026-109243 | 4.1 Medium | FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File | Oct 12, 2026 |
| CVE-2026-109242 | 7.1 High | FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade | Oct 12, 2026 |
| CVE-2026-109241 | 2.3 Low | FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel | Oct 12, 2026 |
| CVE-2026-109240 | 2.3 Low | FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer | Oct 12, 2026 |
| CVE-2026-109239 | 6.9 Medium | Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch | Oct 12, 2026 |
| CVE-2026-109238 | 9.2 Critical | Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder | Oct 12, 2026 |
| CVE-2026-109237 | 8.6 High | Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables | Oct 12, 2026 |
| CVE-2026-85958 | 7.5 High | Improper OAuth token validation in Progress MarkLogic Server | Oct 12, 2026 |
| CVE-2026-85957 | 7.5 High | Improper XML external entity restriction in Progress MarkLogic Server SAML processing | Oct 12, 2026 |
| CVE-2026-85956 | 9.6 Critical | Improper privilege management in Progress MarkLogic Server backup and restore operations | Oct 12, 2026 |
| CVE-2026-108906 | 8.6 High | Netcore NR268 filter_arp_put_file.cgi filter_arp_put_file_cgi out-of-bounds | Oct 12, 2026 |
| CVE-2026-85955 | 9.9 Critical | Improper privilege management in Progress MarkLogic Server xdmp:eval-in | Oct 12, 2026 |
| CVE-2026-85954 | 8.6 High | Improper privilege management in Progress MarkLogic Server higher-order XQuery functions | Oct 12, 2026 |
| CVE-2026-85953 | 8.5 High | Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio | Oct 12, 2026 |
| CVE-2026-85952 | 8.5 High | Server-side request forgery in Progress MarkLogic Server Linux cloud deployments | Oct 12, 2026 |
| CVE-2026-85951 | 8.5 High | Server-side request forgery in Progress MarkLogic Server Azure deployments | Oct 12, 2026 |
| CVE-2026-81856 | 2.3 Low | Terminal escape sequence injection in Hex via unneutralized server-supplied output | Oct 12, 2026 |
| CVE-2026-108901 | 5.1 Medium | Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer | Oct 12, 2026 |
| CVE-2026-103060 | 7.5 High | Path traversal in rebar3 via unvalidated dependency app names | Oct 12, 2026 |
| CVE-2026-85950 | 8.4 High | Improper privilege management in Progress MarkLogic Server REST extensions | Oct 12, 2026 |
| CVE-2026-96612 | 7.5 High | Path traversal in Hex via unvalidated dependency app names | Oct 12, 2026 |
| CVE-2026-85949 | 8.1 High | Sensitive information exposure in Progress MarkLogic Server trace logs | Oct 12, 2026 |
| CVE-2026-85948 | 9.9 Critical | Improper privilege management in Progress MarkLogic Server Management API | Oct 12, 2026 |
| CVE-2026-85947 | 9.9 Critical | Improper privilege management in Progress MarkLogic Server forest operations | Oct 12, 2026 |
| CVE-2026-9191 | 9.6 Critical | Insufficient isolation of user-supplied code in Progress MarkLogic Server | Oct 12, 2026 |
| CVE-2026-105668 | 7.1 High | Hex release-age cooldown is lifted package-wide when the locked release is retired | Oct 12, 2026 |
| CVE-2026-108900 | 6.9 Medium | Exponent CMS XML-RPC xmlrpc.php userLogin sql injection | Oct 12, 2026 |
| CVE-2026-105280 | 6.9 Medium | Hex writes unverified package tarballs to standard output in mix hex.package fetch | Oct 12, 2026 |
| CVE-2026-96618 | 2.1 Low | Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror | Oct 12, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.