Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,435 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-92546 | 7.5 High | Authentication Bypass with X-Agentic-Ally-Token in Keepnet Labs Agentic AI / Agentic Ally | Oct 27, 2026 |
| CVE-2026-116627 | Not scored | Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission… | Oct 27, 2026 |
| CVE-2026-15586 | 5.3 Medium | OTP Brute-Force Account Takeover in Idvlabs Software's Ontime | Oct 27, 2026 |
| CVE-2026-114409 | 5.7 Medium | Docker Desktop logs can expose stored third-party credentials | Oct 27, 2026 |
| CVE-2026-107590 | 1.9 Low | Out-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts Qt | Oct 27, 2026 |
| CVE-2026-47486 | 7.8 High | NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, information… | Oct 27, 2026 |
| CVE-2026-65145 | 10.0 Critical | NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information… | Oct 27, 2026 |
| CVE-2026-65151 | 8.4 High | NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue. A successful exploit of this vulnerability might lead to data tampering, denial of service and information disclosure. | Oct 27, 2026 |
| CVE-2026-65120 | 7.1 High | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure. | Oct 27, 2026 |
| CVE-2026-24269 | 7.1 High | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure and data tampering. | Oct 27, 2026 |
| CVE-2026-65119 | 8.4 High | NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted control sphere. A successful exploit might lead to code… | Oct 27, 2026 |
| CVE-2026-100164 | 7.5 High | User Enumeration in Rolantis Information Technologies' Agentis | Oct 27, 2026 |
| CVE-2026-106087 | 8.7 High | TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data,… | Oct 27, 2026 |
| CVE-2026-10756 | 7.7 High | TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with… | Oct 27, 2026 |
| CVE-2026-115408 | 5.5 Medium | ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets | Oct 27, 2026 |
| CVE-2026-13162 | 7.7 High | An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time… | Oct 27, 2026 |
| CVE-2026-113644 | 5.5 Medium | iofogctl command injection via Controller provisioning response | Oct 27, 2026 |
| CVE-2026-90728 | 6.3 Medium | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain… | Oct 27, 2026 |
| CVE-2026-105323 | 6.1 Medium | Reflected XSS in Kulga Software's Kulga News Software | Oct 27, 2026 |
| CVE-2026-90729 | 6.7 Medium | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain… | Oct 27, 2026 |
| CVE-2026-115216 | 9.1 Critical | Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials | Oct 27, 2026 |
| CVE-2026-41022 | 5.9 Medium | Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between… | Oct 27, 2026 |
| CVE-2026-10752 | 4.8 Medium | Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field | Oct 27, 2026 |
| CVE-2026-109995 | 7.2 High | Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content | Oct 27, 2026 |
| CVE-2026-90730 | 6.5 Medium | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain… | Oct 27, 2026 |
| CVE-2026-112362 | 9.1 Critical | @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets | Oct 27, 2026 |
| CVE-2026-90731 | 4.9 Medium | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain… | Oct 27, 2026 |
| CVE-2026-41021 | 7.5 High | Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials. | Oct 27, 2026 |
| CVE-2026-90732 | 4.9 Medium | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20,… | Oct 27, 2026 |
| CVE-2026-117499 | 3.7 Low | @fastify/session vulnerable to session revocation bypass via a logout race condition | Oct 27, 2026 |
| CVE-2026-56084 | 5.8 Medium | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain… | Oct 27, 2026 |
| CVE-2026-102800 | 8.7 High | Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 | Oct 27, 2026 |
| CVE-2026-41020 | 7.5 High | Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device. | Oct 27, 2026 |
| CVE-2026-4337 | 8.8 High | Unrestricted Upload of File in PuMuKIT application | Oct 27, 2026 |
| CVE-2026-117541 | 6.9 Medium | svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize() | Oct 27, 2026 |
| CVE-2026-117540 | 8.7 High | svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop | Oct 27, 2026 |
| CVE-2026-117539 | 5.1 Medium | darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass | Oct 27, 2026 |
| CVE-2026-117538 | 2.1 Low | REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter | Oct 27, 2026 |
| CVE-2026-117537 | 2.1 Low | REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter | Oct 27, 2026 |
| CVE-2026-117536 | 8.6 High | REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation | Oct 27, 2026 |
| CVE-2026-117535 | 5.1 Medium | REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool | Oct 27, 2026 |
| CVE-2026-117534 | 5.1 Medium | REDAXO before 5.21.3 CSRF in Article History Plugin | Oct 27, 2026 |
| CVE-2026-117533 | 2.1 Low | REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads | Oct 27, 2026 |
| CVE-2026-117532 | 9.3 Critical | REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin | Oct 27, 2026 |
| CVE-2026-116900 | 5.1 Medium | REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets | Oct 27, 2026 |
| CVE-2026-116899 | 7.1 High | REDAXO before 5.21.4 Broken Access Control in Slice Operations | Oct 27, 2026 |
| CVE-2026-116898 | 7.1 High | REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move | Oct 27, 2026 |
| CVE-2026-116897 | 7.1 High | REDAXO before 5.21.4 Missing Authorization in Version and History Previews | Oct 27, 2026 |
| CVE-2026-116896 | 7.7 High | REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables | Oct 27, 2026 |
| CVE-2026-116895 | 5.1 Medium | REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter | Oct 27, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.