Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
405,578 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-106618 | 8.8 High | ColdFusion | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-105994 | 7.7 High | ColdFusion | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-106622 | 10.0 Critical | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) | Oct 13, 2026 |
| CVE-2026-106619 | 9.0 Critical | ColdFusion | Improper Input Validation (CWE-20) | Oct 13, 2026 |
| CVE-2026-106089 | 8.8 High | ColdFusion | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-106613 | 8.8 High | ColdFusion | Improper Input Validation (CWE-20) | Oct 13, 2026 |
| CVE-2026-106614 | 7.8 High | ColdFusion | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-106624 | 10.0 Critical | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) | Oct 13, 2026 |
| CVE-2026-75996 | 7.5 High | ColdFusion | Uncontrolled Resource Consumption (CWE-400) | Oct 13, 2026 |
| CVE-2026-106621 | 9.1 Critical | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) | Oct 13, 2026 |
| CVE-2026-90530 | 9.3 Critical | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | Oct 13, 2026 |
| CVE-2026-105898 | 8.2 High | ColdFusion | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-105903 | 9.9 Critical | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) | Oct 13, 2026 |
| CVE-2026-75994 | 9.6 Critical | ColdFusion | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-106090 | 8.8 High | ColdFusion | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-34634 | 8.6 High | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) | Oct 13, 2026 |
| CVE-2026-106620 | 9.6 Critical | ColdFusion | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-76001 | 7.1 High | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) | Oct 13, 2026 |
| CVE-2026-106612 | 9.9 Critical | ColdFusion | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-106615 | 8.8 High | ColdFusion | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-75995 | 8.4 High | ColdFusion | Improper Input Validation (CWE-20) | Oct 13, 2026 |
| CVE-2026-75748 | 7.6 High | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) | Oct 13, 2026 |
| CVE-2026-105900 | 7.5 High | ColdFusion | Improper Input Validation (CWE-20) | Oct 13, 2026 |
| CVE-2026-105901 | 8.8 High | ColdFusion | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-71385 | 8.4 High | ColdFusion | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-106623 | 7.5 High | ColdFusion | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-105899 | 10.0 Critical | ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) | Oct 13, 2026 |
| CVE-2026-106617 | 8.8 High | ColdFusion | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-49950 | 9.3 Critical | Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool | Oct 13, 2026 |
| CVE-2026-93905 | 8.2 High | IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data | Oct 13, 2026 |
| CVE-2026-93909 | 9.1 Critical | IBM WebSphere Application Server Liberty is affected by an authentication bypass | Oct 13, 2026 |
| CVE-2026-93895 | 9.1 Critical | IBM WebSphere Application Server Liberty Improper Access Control | Oct 13, 2026 |
| CVE-2026-95695 | 7.4 High | IBM WebSphere Application Server Liberty Incorrect Authorization | Oct 13, 2026 |
| CVE-2026-95696 | 6.5 Medium | IBM WebSphere Application Server Liberty Denial of Service | Oct 13, 2026 |
| CVE-2026-101294 | 8.7 High | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step | Oct 13, 2026 |
| CVE-2026-105442 | 7.5 High | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data | Oct 13, 2026 |
| CVE-2026-105443 | 8.2 High | IBM WebSphere Application Server Liberty is affected by an improper access control | Oct 13, 2026 |
| CVE-2026-11713 | 5.4 Medium | IBM WebSphere Application Server Liberty Incorrect Authorization | Oct 13, 2026 |
| CVE-2026-14532 | 4.3 Medium | IBM WebSphere Application Server Liberty Integer Overflow | Oct 13, 2026 |
| CVE-2026-14909 | 6.5 Medium | IBM WebSphere Application Server Liberty Information Disclosure | Oct 13, 2026 |
| CVE-2026-77816 | 6.5 Medium | IBM WebSphere Application Server Liberty Improper Certificate Validation | Oct 13, 2026 |
| CVE-2026-79715 | 5.5 Medium | IBM WebSphere Application Server Liberty Path Traversal | Oct 13, 2026 |
| CVE-2026-85473 | 5.3 Medium | Out-of-Range Timestamp Claim Handling in auth0/java-jwt | Oct 13, 2026 |
| CVE-2026-78633 | 6.5 Medium | Denial of Service in Okta RADIUS Agent Packet Parser | Oct 13, 2026 |
| CVE-2026-78632 | 5.3 Medium | Insecure Default File Permissions in Okta RADIUS Agent Windows Installer | Oct 13, 2026 |
| CVE-2026-107371 | 5.4 Medium | Missing Verification of auth_time Claim in auth0.js | Oct 13, 2026 |
| CVE-2026-107370 | 5.3 Medium | Improper Request Handling for Active Directory Logins in auth0-lock | Oct 13, 2026 |
| CVE-2026-107369 | 6.1 Medium | Improper Validation of Post-Login Redirect URL in nextjs-auth0 | Oct 13, 2026 |
| CVE-2026-78628 | 6.0 Medium | Improper Input Validation in the Okta Credential Provider for Windows | Oct 13, 2026 |
| CVE-2026-63171 | 5.1 Medium | Omnispace Agora Project < 26.10.0 Stored XSS via Category Description | Oct 13, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.