Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,118 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-118583 | Not scored | Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288 | Oct 30, 2026 |
| CVE-2026-118584 | Not scored | Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289 | Oct 30, 2026 |
| CVE-2026-118573 | Not scored | OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290 | Oct 30, 2026 |
| CVE-2026-118568 | Not scored | Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291 | Oct 30, 2026 |
| CVE-2026-118571 | Not scored | Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292 | Oct 30, 2026 |
| CVE-2026-74915 | Not scored | GPU DDK - OOB write in UntwiddlePOTSquare64bpp | Oct 30, 2026 |
| CVE-2026-74912 | Not scored | GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB | Oct 30, 2026 |
| CVE-2026-19199 | Not scored | GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet | Oct 30, 2026 |
| CVE-2026-18629 | Not scored | GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation | Oct 30, 2026 |
| CVE-2026-65587 | Not scored | GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change | Oct 30, 2026 |
| CVE-2026-65586 | Not scored | GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM | Oct 30, 2026 |
| CVE-2026-65584 | Not scored | GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo | Oct 30, 2026 |
| CVE-2026-118475 | 3.6 Low | Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk | Oct 30, 2026 |
| CVE-2026-112922 | 3.3 Low | Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading | Oct 30, 2026 |
| CVE-2026-15466 | Not scored | GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM() | Oct 30, 2026 |
| CVE-2026-91920 | 6.5 Medium | Undertow: undertow: chunkreader message length permits chunk-size overflow | Oct 30, 2026 |
| CVE-2026-92744 | 8.7 High | Delinea Privilege Manager agent unauthenticated remote code execution vulnerability | Oct 29, 2026 |
| CVE-2026-107238 | 8.7 High | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service. | Oct 29, 2026 |
| CVE-2026-107239 | 8.8 High | A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service. | Oct 29, 2026 |
| CVE-2023-22793 | 9.3 Critical | A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center. | Oct 29, 2026 |
| CVE-2026-119286 | 7.5 High | GraphQL-core: Denial of service via memory leak in aborted validations | Oct 29, 2026 |
| CVE-2026-115943 | Not scored | Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt | Oct 29, 2026 |
| CVE-2026-119285 | 5.9 Medium | Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads | Oct 29, 2026 |
| CVE-2026-119284 | 6.9 Medium | joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection | Oct 29, 2026 |
| CVE-2026-61719 | 8.9 High | WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field | Oct 29, 2026 |
| CVE-2026-61707 | 9.0 Critical | SOCFortress CoPilot: Stored case-report template injection permits backend code execution | Oct 29, 2026 |
| CVE-2026-61673 | 6.3 Medium | WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover | Oct 29, 2026 |
| CVE-2026-61671 | 8.1 High | WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes | Oct 29, 2026 |
| CVE-2026-61654 | 8.3 High | Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key | Oct 29, 2026 |
| CVE-2026-61645 | 9.1 Critical | Docat has Arbitrary File Upload exists in Upload API | Oct 29, 2026 |
| CVE-2026-45049 | 8.3 High | OpenAM Session Hijacking via CDSSO | Oct 29, 2026 |
| CVE-2026-119317 | 6.0 Medium | Incorrect Authorization | Oct 29, 2026 |
| CVE-2026-119283 | 7.5 High | joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption | Oct 29, 2026 |
| CVE-2026-119282 | 7.3 High | Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle | Oct 29, 2026 |
| CVE-2026-13303 | 8.7 High | Boundary vulnerable to server-side request forgery in Vault credential store | Oct 29, 2026 |
| CVE-2026-61576 | 8.3 High | Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key | Oct 29, 2026 |
| CVE-2026-119281 | 5.9 Medium | MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing | Oct 29, 2026 |
| CVE-2026-119280 | 3.7 Low | MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths | Oct 29, 2026 |
| CVE-2026-119279 | 5.9 Medium | MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths | Oct 29, 2026 |
| CVE-2026-119278 | 5.9 Medium | MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication | Oct 29, 2026 |
| CVE-2026-119277 | 5.9 Medium | MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths | Oct 29, 2026 |
| CVE-2026-119276 | 5.9 Medium | MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets | Oct 29, 2026 |
| CVE-2026-119210 | 5.9 Medium | MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files | Oct 29, 2026 |
| CVE-2026-119209 | 7.1 High | pypdf: Possible large memory usage when parsing cross-reference streams | Oct 29, 2026 |
| CVE-2026-119208 | 7.1 High | pypdf: Possible long runtimes/large memory usage for encrypted PDF files | Oct 29, 2026 |
| CVE-2026-119207 | 7.1 High | pypdf: Possible large memory usage for exceptions in strict mode | Oct 29, 2026 |
| CVE-2026-119206 | 7.1 High | pypdf: Possible long runtimes when retrieving page labels | Oct 29, 2026 |
| CVE-2026-119205 | 7.1 High | pypdf: Possible infinite loop when cloning dictionaries | Oct 29, 2026 |
| CVE-2026-119325 | 7.5 High | Bricks Theme Broken Access Control via load_popup_content | Oct 29, 2026 |
| CVE-2026-119204 | 7.1 High | pypdf: Possible large memory usage when parsing page tree | Oct 29, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.