Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,369 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-57194 | 5.9 Medium | Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk | Oct 27, 2026 |
| CVE-2026-114597 | 8.7 High | Improper handling of length parameter inconsistency in EPICS Base | Oct 27, 2026 |
| CVE-2026-114596 | 8.8 High | Integer overflow or wraparound in EPICS Base | Oct 27, 2026 |
| CVE-2026-114595 | 9.3 Critical | Integer overflow or wraparound in EPICS Base | Oct 27, 2026 |
| CVE-2026-57198 | 2.3 Low | Asterisk: Possible RED T.140 Heap Buffer Overflow | Oct 27, 2026 |
| CVE-2026-116675 | 8.5 High | TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization | Oct 27, 2026 |
| CVE-2026-117513 | 6.9 Medium | oretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection | Oct 27, 2026 |
| CVE-2026-116674 | 6.5 Medium | systeminformation: Prototype pollution in `networkStats()` via the interface name | Oct 27, 2026 |
| CVE-2026-57185 | 6.5 Medium | Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser | Oct 27, 2026 |
| CVE-2026-48360 | 9.6 Critical | Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94) | Oct 27, 2026 |
| CVE-2026-116673 | 3.3 Low | systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net | Oct 27, 2026 |
| CVE-2026-108014 | 9.1 Critical | eMudhra Compromised Certificate vulnerability impacts HCL Domino Server | Oct 27, 2026 |
| CVE-2026-57197 | 7.7 High | Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex) | Oct 27, 2026 |
| CVE-2026-109090 | 7.5 High | libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow | Oct 27, 2026 |
| CVE-2026-116672 | 8.8 High | Authlib RFC 7592 examples omit registration-access-token client binding | Oct 27, 2026 |
| CVE-2026-117512 | 6.9 Medium | oretnom23 php-travel-agency-system employee_insert.php unrestricted upload | Oct 27, 2026 |
| CVE-2026-109088 | 6.5 Medium | libXtst RECORD EnableContext Reply Endless Loop | Oct 27, 2026 |
| CVE-2026-48380 | 5.5 Medium | Substance3D - Painter | Out-of-bounds Read (CWE-125) | Oct 27, 2026 |
| CVE-2026-48379 | 7.8 High | Substance3D - Painter | Stack-based Buffer Overflow (CWE-121) | Oct 27, 2026 |
| CVE-2026-104349 | 7.3 High | Creative Cloud Desktop | Uncontrolled Search Path Element (CWE-427) | Oct 27, 2026 |
| CVE-2025-64394 | 4.3 Medium | A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service. | Oct 27, 2026 |
| CVE-2026-108141 | 5.9 Medium | A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path… | Oct 27, 2026 |
| CVE-2026-106078 | 6.9 Medium | A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service. | Oct 27, 2026 |
| CVE-2026-107671 | 8.5 High | A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification. | Oct 27, 2026 |
| CVE-2026-108142 | 9.1 Critical | A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. | Oct 27, 2026 |
| CVE-2026-106077 | 8.3 High | A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges. | Oct 27, 2026 |
| CVE-2026-106076 | 9.0 Critical | A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote… | Oct 27, 2026 |
| CVE-2026-108140 | 5.9 Medium | A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path… | Oct 27, 2026 |
| CVE-2026-105477 | 7.3 High | A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected. | Oct 27, 2026 |
| CVE-2026-82984 | 4.3 Medium | When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated… | Oct 27, 2026 |
| CVE-2026-77167 | 7.5 High | Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions… | Oct 27, 2026 |
| CVE-2026-77173 | 4.3 Medium | A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential. | Oct 27, 2026 |
| CVE-2026-67400 | 3.5 Low | A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token. | Oct 27, 2026 |
| CVE-2026-77171 | 3.5 Low | A public shared collective always allowed recipients of the link to create pages. | Oct 27, 2026 |
| CVE-2026-77172 | 5.3 Medium | App passwords were allowed to bypass password confirmation on sensitive endpoints. | Oct 27, 2026 |
| CVE-2026-87897 | 4.6 Medium | A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT… | Oct 27, 2026 |
| CVE-2026-82983 | 3.3 Low | The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams)… | Oct 27, 2026 |
| CVE-2026-82986 | 4.6 Medium | The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission. | Oct 27, 2026 |
| CVE-2026-54462 | 6.5 Medium | knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion | Oct 27, 2026 |
| CVE-2026-112353 | 6.2 Medium | GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment | Oct 27, 2026 |
| CVE-2026-113775 | 7.8 High | Dynamic Library Loading Process Control in Autodesk Fusion Desktop | Oct 27, 2026 |
| CVE-2026-109089 | 7.5 High | libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow | Oct 27, 2026 |
| CVE-2026-102638 | 7.1 High | Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop | Oct 27, 2026 |
| CVE-2026-102637 | 7.1 High | Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop | Oct 27, 2026 |
| CVE-2026-102636 | 7.1 High | Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop | Oct 27, 2026 |
| CVE-2026-107672 | 8.8 High | Stack File Trusted Markdown Injection in Autodesk Fusion Post Processor Utility | Oct 27, 2026 |
| CVE-2026-117511 | 6.9 Medium | desmondmorris node-tesseract Command Builder tesseract.js process os command injection | Oct 27, 2026 |
| CVE-2026-116863 | 9.6 Critical | WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability | Oct 27, 2026 |
| CVE-2026-115495 | 5.7 Medium | Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket | Oct 27, 2026 |
| CVE-2026-90465 | 8.7 High | Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation | Oct 27, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.