Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,217 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-109169 | 7.1 High | LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter | Oct 12, 2026 |
| CVE-2026-108892 | 10.0 Critical | Linksys E1700 Mac Filter ssid1MACFilter stack-based overflow | Oct 12, 2026 |
| CVE-2026-103502 | 5.9 Medium | hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25 | Oct 12, 2026 |
| CVE-2026-108890 | 5.3 Medium | BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization | Oct 12, 2026 |
| CVE-2026-109188 | 5.3 Medium | jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints | Oct 12, 2026 |
| CVE-2026-109187 | 7.1 High | jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey | Oct 12, 2026 |
| CVE-2026-109186 | 8.7 High | jshERP through 3.6 Mass Assignment via PUT /user/update | Oct 12, 2026 |
| CVE-2026-109185 | 8.7 High | jshERP through 3.6 Privilege Escalation via PUT /user/updateUser | Oct 12, 2026 |
| CVE-2026-109184 | 5.3 Medium | jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList | Oct 12, 2026 |
| CVE-2026-109183 | 5.3 Medium | jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter | Oct 12, 2026 |
| CVE-2026-109182 | 5.3 Medium | jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel | Oct 12, 2026 |
| CVE-2026-109181 | 5.3 Medium | jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list | Oct 12, 2026 |
| CVE-2026-109180 | 5.3 Medium | jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs | Oct 12, 2026 |
| CVE-2026-109179 | 5.3 Medium | jshERP through 3.6 Missing Authorization via /log/list and /log/info | Oct 12, 2026 |
| CVE-2026-109178 | 5.3 Medium | jshERP through 3.6 Missing Authorization via /log Audit Endpoints | Oct 12, 2026 |
| CVE-2026-109177 | 5.3 Medium | MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit | Oct 12, 2026 |
| CVE-2026-109176 | 5.3 Medium | MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files | Oct 12, 2026 |
| CVE-2026-109175 | 5.3 Medium | MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList | Oct 12, 2026 |
| CVE-2026-109174 | 7.1 High | MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig | Oct 12, 2026 |
| CVE-2026-109173 | 5.3 Medium | yshop-crm through 2.1.3 Missing Authorization via invoice check endpoint | Oct 12, 2026 |
| CVE-2026-109172 | 5.3 Medium | yshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint | Oct 12, 2026 |
| CVE-2026-109171 | 5.3 Medium | yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check | Oct 12, 2026 |
| CVE-2026-109168 | 7.1 High | lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId | Oct 12, 2026 |
| CVE-2026-109167 | 5.3 Medium | TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save | Oct 12, 2026 |
| CVE-2026-109166 | 7.1 High | lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById | Oct 12, 2026 |
| CVE-2026-109165 | 5.3 Medium | TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create | Oct 12, 2026 |
| CVE-2026-109164 | 7.1 High | TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey} | Oct 12, 2026 |
| CVE-2026-105081 | 2.0 Low | ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName | Oct 12, 2026 |
| CVE-2026-108889 | 4.8 Medium | Yungengxin Cloud Billing IOCTL Process Termination LWBilling64.sys sub_14000443C exposed ioctl with insufficient access control | Oct 12, 2026 |
| CVE-2026-93695 | 7.4 High | Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService | Oct 12, 2026 |
| CVE-2026-93694 | 4.0 Medium | Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller | Oct 12, 2026 |
| CVE-2026-93693 | 6.5 Medium | Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller | Oct 12, 2026 |
| CVE-2026-108836 | 6.9 Medium | Ollama Pull API name.go IsValid server-side request forgery | Oct 12, 2026 |
| CVE-2026-108835 | 4.8 Medium | Yungengxin Yun Jia Security Guard kgameprotect.sys sub_14000885C privileges management | Oct 12, 2026 |
| CVE-2026-52903 | 8.8 High | YAML safe_load production fallback to unsafe_load enables RCE via deserialization | Oct 12, 2026 |
| CVE-2026-108834 | 5.3 Medium | Cairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting | Oct 12, 2026 |
| CVE-2026-108953 | 8.5 High | mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments | Oct 12, 2026 |
| CVE-2026-108952 | 5.1 Medium | RT-Thread through 5.3.0 Memory Corruption via USB CDC VCOM Driver | Oct 12, 2026 |
| CVE-2026-108951 | 7.1 High | LavaLite CMS through 10.1.2 Authorization Bypass via User Update API | Oct 12, 2026 |
| CVE-2026-108950 | 6.9 Medium | Open Source Social Network (OSSN) through 10.1 Missing Authorization via Album Photo Routes | Oct 12, 2026 |
| CVE-2026-108831 | 5.3 Medium | meetecho janus-gateway Admin API admin.js hard-coded credentials | Oct 12, 2026 |
| CVE-2026-108830 | 2.3 Low | meetecho janus-gateway VideoRoom janus_videoroom.c race condition | Oct 12, 2026 |
| CVE-2026-108829 | 5.1 Medium | Zen Cart Module Configuration modules.php sql injection | Oct 12, 2026 |
| CVE-2026-105283 | 6.3 Medium | Internal error terms inspected into AshTypescript RPC error responses | Oct 12, 2026 |
| CVE-2026-108828 | 2.1 Low | Zen Cart Admin Panel configuration.php eval sql injection | Oct 12, 2026 |
| CVE-2026-85499 | 9.1 Critical | Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy | Oct 12, 2026 |
| CVE-2026-108827 | 2.1 Low | Zen Cart Administrative Module Management general.php zen_call_function code injection | Oct 12, 2026 |
| CVE-2026-105412 | 7.1 High | SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 | Oct 12, 2026 |
| CVE-2026-105411 | 8.1 High | Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 | Oct 12, 2026 |
| CVE-2026-108826 | 6.9 Medium | Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection | Oct 12, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.