Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,390 vulnerabilities match.

CVESeveritySummary
CVE-2026-117881Not scoredUse-after-free in the DOM: Core & HTML component
CVE-2026-117880Not scoredUse-after-free in the XML component
CVE-2026-117879Not scoredIncorrect boundary conditions in the Layout: Tables component
CVE-2026-117878Not scoredOther issue, use-after-free in the Storage: IndexedDB component
CVE-2026-117877Not scoredUse-after-free in the Layout: Text and Fonts component
CVE-2026-117876Not scoredUse-after-free in the Layout: Text and Fonts component
CVE-2026-117875Not scoredUse-after-free in the Layout: Scrolling and Overflow component
CVE-2026-117874Not scoredUse-after-free in the Internationalization component
CVE-2026-117873Not scoredIncorrect boundary conditions in the Audio/Video: Playback component
CVE-2026-117872Not scoredUse-after-free in the JavaScript: Standard Library component
CVE-2026-117871Not scoredInvalid pointer in the Graphics component
CVE-2026-117870Not scoredUse-after-free in the JavaScript Engine component
CVE-2026-117869Not scoredUse-after-free in the DOM: Core & HTML component
CVE-2026-117868Not scoredSandbox escape in the DOM: Networking component
CVE-2026-117867Not scoredUse-after-free in the Layout component
CVE-2026-117866Not scoredPrivilege escalation due to use-after-free in the Graphics: Canvas2D component
CVE-2026-117865Not scoredUse-after-free in the JavaScript: GC component
CVE-2026-117864Not scoredSandbox escape in the Form Manager component
CVE-2026-117863Not scoredInformation disclosure due to uninitialized memory in the Audio/Video component
CVE-2026-117862Not scoredPrivilege escalation due to incorrect boundary conditions in the Networking component
CVE-2026-117861Not scoredSandbox escape in the DOM: Navigation component
CVE-2026-117860Not scoredSame-origin policy bypass in the DOM: Navigation component
CVE-2026-1175046.9 Mediuma2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service
CVE-2026-907254.9 MediumDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain…
CVE-2026-1175036.9 Mediuma2aproject a2a-go REST SSE handler rest.go resource consumption
CVE-2026-688666.5 MediumPowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a…
CVE-2026-907266.0 MediumDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain…
CVE-2026-907273.8 LowDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain…
CVE-2026-943477.2 HighPowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through…
CVE-2026-105376.9 MediumRemote unauthenticated information disclosure and denial of service due to unauthenticated service access
CVE-2026-943467.2 HighPowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through…
CVE-2026-163074.3 MediumIDOR in Netiket Information Technologies' EdoWEB
CVE-2026-128875.1 MediumIn affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory.
CVE-2026-1176039.3 CriticalElectrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
CVE-2026-1176028.6 HighElectrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution
CVE-2026-1176019.3 CriticalElectrum before 4.8.3 Missing Signature Verification of Mempool Transactions
CVE-2026-1175738.5 Highhagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools
CVE-2026-1175704.8 Mediumnmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilities
CVE-2026-1175698.5 HighKali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parameters
CVE-2026-1175687.3 Highmcp-ffmpeg through 1.0.5 OS Command Injection via videoPath and outputDir
CVE-2026-1175678.5 Highesp-mcp through commit 28afddf OS Command Injection via MCP Tool Parameters
CVE-2026-1175666.9 MediumEasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php
CVE-2026-1175656.9 MediumArtalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch
CVE-2026-1175649.3 Criticalnest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret
CVE-2026-1175635.3 MediumMrDoc through 1.1.1 Broken Access Control via manage_doc_share
CVE-2026-1175626.9 Mediumrssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint
CVE-2026-1175618.5 Highsf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values
CVE-2026-1175608.5 HighATXP Gemini CLI Extension through 1.0.0 OS Command Injection via MCP Tools
CVE-2026-1175598.5 HighDroidMind through 0.4.0 Command Injection via Shell Allowlist Bypass
CVE-2026-1175588.5 Highai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.