Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,435 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-107146 | 6.3 Medium | Insufficient session expiration in twofactor_gauthenticator | Oct 27, 2026 |
| CVE-2026-107145 | 6.3 Medium | Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator | Oct 27, 2026 |
| CVE-2026-102787 | 5.3 Medium | Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5 | Oct 27, 2026 |
| CVE-2026-102788 | 9.3 Critical | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 | Oct 27, 2026 |
| CVE-2026-102789 | 9.3 Critical | Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 | Oct 27, 2026 |
| CVE-2026-117494 | 8.3 High | Multiple vulnerabilities in Sisense’s Cloud BI Platform | Oct 27, 2026 |
| CVE-2026-117493 | 8.3 High | Multiple vulnerabilities in Sisense’s Cloud BI Platform | Oct 27, 2026 |
| CVE-2026-85299 | 8.3 High | Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration | Oct 27, 2026 |
| CVE-2026-92885 | 9.8 Critical | Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login | Oct 27, 2026 |
| CVE-2026-65213 | 6.6 Medium | Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerability | Oct 27, 2026 |
| CVE-2026-65211 | 7.2 High | Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability | Oct 27, 2026 |
| CVE-2026-65210 | 4.9 Medium | Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability | Oct 27, 2026 |
| CVE-2026-65220 | 8.8 High | Supermicro BMC IPMI feature contains a Privilege escalation vulnerability | Oct 27, 2026 |
| CVE-2026-65219 | 7.4 High | Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability | Oct 27, 2026 |
| CVE-2026-18451 | 3.1 Low | Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token | Oct 27, 2026 |
| CVE-2026-18450 | 9.8 Critical | Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability | Oct 27, 2026 |
| CVE-2026-10511 | 6.4 Medium | Jupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter | Oct 27, 2026 |
| CVE-2026-18449 | 7.5 High | Supermicro BMC contains a SMCRAKP Fixed Key vulnerability | Oct 27, 2026 |
| CVE-2026-107472 | 4.3 Medium | Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt | Oct 27, 2026 |
| CVE-2026-16521 | 7.2 High | Supermicro BMC's syslog feature contains a command injection vulnerability | Oct 27, 2026 |
| CVE-2026-111461 | 7.5 High | SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series | Oct 27, 2026 |
| CVE-2026-101034 | 6.8 Medium | Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentials | Oct 27, 2026 |
| CVE-2026-111460 | 7.7 High | Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series | Oct 27, 2026 |
| CVE-2026-111459 | 7.6 High | Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client) | Oct 27, 2026 |
| CVE-2026-106174 | 6.7 Medium | A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP… | Oct 27, 2026 |
| CVE-2026-105946 | 5.3 Medium | Out-of-bounds read vulnerability in NTLM authentication handling impacts Qt | Oct 27, 2026 |
| CVE-2026-103325 | 3.7 Low | TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass | Oct 27, 2026 |
| CVE-2026-103359 | 5.3 Medium | PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery | Oct 27, 2026 |
| CVE-2026-110910 | 6.3 Medium | qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection | Oct 27, 2026 |
| CVE-2026-75891 | 8.8 High | Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint | Oct 27, 2026 |
| CVE-2026-103312 | 5.3 Medium | Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback | Oct 27, 2026 |
| CVE-2026-103332 | 5.3 Medium | Payex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation Forgery via Empty-Default Secret Key | Oct 27, 2026 |
| CVE-2026-117472 | 4.3 Medium | URL prefix handling permits API key read-scope bypass in Psono Server | Oct 27, 2026 |
| CVE-2026-117471 | 5.4 Medium | User-controlled Duo host permits authenticated SSRF in Psono Server | Oct 27, 2026 |
| CVE-2026-117470 | 6.5 Medium | WebAuthn assertion replay permits second-factor bypass in Psono Server | Oct 27, 2026 |
| CVE-2026-117469 | 5.4 Medium | File-transfer type confusion permits unauthorized repository writes in Psono Server | Oct 27, 2026 |
| CVE-2026-117468 | 6.5 Medium | Device-code claim permits restricted token escalation in Psono Server | Oct 27, 2026 |
| CVE-2026-111820 | 7.2 High | Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title | Oct 27, 2026 |
| CVE-2026-88781 | 6.8 Medium | Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to subsequent system information being tampered with or causing a… | Oct 27, 2026 |
| CVE-2026-116640 | 5.1 Medium | Saruf-Ratul HR-Payroll-Management-System chat.php cross site scripting | Oct 27, 2026 |
| CVE-2026-116639 | 5.1 Medium | MD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting | Oct 27, 2026 |
| CVE-2026-116839 | 7.1 High | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on… | Oct 27, 2026 |
| CVE-2026-116838 | 8.8 High | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device. | Oct 27, 2026 |
| CVE-2026-116623 | 6.9 Medium | code-projects Simple Content Management System Admin welcome.php authorization | Oct 27, 2026 |
| CVE-2026-116837 | 8.8 High | A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device. | Oct 27, 2026 |
| CVE-2026-116844 | 6.3 Medium | Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P | Oct 27, 2026 |
| CVE-2026-116843 | 8.7 High | Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode | Oct 27, 2026 |
| CVE-2026-116842 | 6.9 Medium | DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup | Oct 27, 2026 |
| CVE-2026-116841 | 6.8 Medium | DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup | Oct 27, 2026 |
| CVE-2026-116840 | 6.9 Medium | llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader | Oct 27, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.