Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,217 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-109195 | 3.1 Low | Quay: repository auto-prune policy uuid idor in quay api | Oct 12, 2026 |
| CVE-2026-109194 | 6.4 Medium | Quay: build trigger uuid idor in quay api | Oct 12, 2026 |
| CVE-2026-103503 | 5.9 Medium | Hex trusts its bundled CA certificates when cacerts_path is set | Oct 12, 2026 |
| CVE-2026-109399 | 9.2 Critical | SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates | Oct 12, 2026 |
| CVE-2026-109398 | 8.7 High | Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs | Oct 12, 2026 |
| CVE-2026-109397 | 8.6 High | Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space | Oct 12, 2026 |
| CVE-2026-109396 | 2.3 Low | Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports | Oct 12, 2026 |
| CVE-2026-109394 | 9.1 Critical | Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout | Oct 12, 2026 |
| CVE-2026-109393 | 5.3 Medium | QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers | Oct 12, 2026 |
| CVE-2026-109392 | 5.1 Medium | Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview | Oct 12, 2026 |
| CVE-2026-109391 | 9.2 Critical | Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API | Oct 12, 2026 |
| CVE-2026-108899 | 6.9 Medium | tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization | Oct 12, 2026 |
| CVE-2026-92681 | 9.3 Critical | @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields | Oct 12, 2026 |
| CVE-2026-92682 | 8.6 High | @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier | Oct 12, 2026 |
| CVE-2026-107248 | 8.8 High | CVE-2026-107248 | Oct 12, 2026 |
| CVE-2026-108898 | 5.1 Medium | Netis WF2409E Wireless Settings cross site scripting | Oct 12, 2026 |
| CVE-2026-103537 | 5.4 Medium | CVE-2026-103537 | Oct 12, 2026 |
| CVE-2026-103535 | 8.8 High | CVE-2026-103535 | Oct 12, 2026 |
| CVE-2026-103529 | 5.4 Medium | CVE-2026-103529 | Oct 12, 2026 |
| CVE-2026-103528 | 5.4 Medium | CVE-2026-103528 | Oct 12, 2026 |
| CVE-2026-103527 | 6.1 Medium | CVE-2026-103527 | Oct 12, 2026 |
| CVE-2026-103526 | 3.7 Low | CVE-2026-103526 | Oct 12, 2026 |
| CVE-2026-103524 | 4.8 Medium | CVE-2026-103524 | Oct 12, 2026 |
| CVE-2026-103523 | 6.1 Medium | CVE-2026-103523 | Oct 12, 2026 |
| CVE-2026-103522 | 7.2 High | CVE-2026-103522 | Oct 12, 2026 |
| CVE-2026-103521 | 7.2 High | CVE-2026-103521 | Oct 12, 2026 |
| CVE-2026-108897 | 6.9 Medium | Smart Media4U Technology SHAREit App WebView JS Bridge syncInvoke routine | Oct 12, 2026 |
| CVE-2026-108094 | 7.8 High | Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path | Oct 12, 2026 |
| CVE-2026-109390 | 9.8 Critical | AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream… | Oct 12, 2026 |
| CVE-2026-108896 | 9.4 Critical | Linksys E1700 setLinksysIpv6 os command injection | Oct 12, 2026 |
| CVE-2026-92877 | 8.3 High | The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who… | Oct 12, 2026 |
| CVE-2026-108895 | 9.4 Critical | Linksys E1700 setDMZ os command injection | Oct 12, 2026 |
| CVE-2026-109229 | 8.7 High | SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor | Oct 12, 2026 |
| CVE-2026-109228 | 8.7 High | SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters | Oct 12, 2026 |
| CVE-2026-109227 | 8.7 High | SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing | Oct 12, 2026 |
| CVE-2026-109226 | 8.7 High | SGLang through 0.5.21 Audio Decompression Amplification via load_audio | Oct 12, 2026 |
| CVE-2026-109225 | 8.7 High | SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload | Oct 12, 2026 |
| CVE-2026-12613 | 8.8 High | Insecure Deserialization Leading to Remote Code Execution in Ministry of Justice's UYAP Document Editor | Oct 12, 2026 |
| CVE-2026-108894 | 9.4 Critical | Linksys E1700 Static Route addStaticRoute os command injection | Oct 12, 2026 |
| CVE-2026-18390 | 7.8 High | Command Injection in Ministry of Justice's UYAP Document Editor | Oct 12, 2026 |
| CVE-2026-108893 | 9.4 Critical | Linksys E1700 setVlan stack-based overflow | Oct 12, 2026 |
| CVE-2026-109206 | 6.9 Medium | LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet | Oct 12, 2026 |
| CVE-2026-109205 | 8.7 High | LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet | Oct 12, 2026 |
| CVE-2026-109204 | 5.3 Medium | LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket | Oct 12, 2026 |
| CVE-2026-109203 | 7.1 High | LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet | Oct 12, 2026 |
| CVE-2026-109202 | 7.1 High | LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet | Oct 12, 2026 |
| CVE-2026-109201 | 8.7 High | LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService | Oct 12, 2026 |
| CVE-2026-109200 | 5.3 Medium | LogicalDOC Community Edition through 9.3 SSRF via XMLConverter xml-stylesheet href | Oct 12, 2026 |
| CVE-2026-109199 | 8.7 High | LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template | Oct 12, 2026 |
| CVE-2026-109170 | 7.1 High | LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter | Oct 12, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.