Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,503 vulnerabilities match.

CVESeveritySummary
CVE-2026-1174724.3 MediumURL prefix handling permits API key read-scope bypass in Psono Server
CVE-2026-1174715.4 MediumUser-controlled Duo host permits authenticated SSRF in Psono Server
CVE-2026-1174706.5 MediumWebAuthn assertion replay permits second-factor bypass in Psono Server
CVE-2026-1174695.4 MediumFile-transfer type confusion permits unauthorized repository writes in Psono Server
CVE-2026-1174686.5 MediumDevice-code claim permits restricted token escalation in Psono Server
CVE-2026-1118207.2 HighAnalytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title
CVE-2026-887816.8 MediumUntrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to subsequent system information being tampered with or causing a…
CVE-2026-1166405.1 MediumSaruf-Ratul HR-Payroll-Management-System chat.php cross site scripting
CVE-2026-1166395.1 MediumMD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting
CVE-2026-1168397.1 HighA malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on…
CVE-2026-1168388.8 HighA malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
CVE-2026-1166236.9 Mediumcode-projects Simple Content Management System Admin welcome.php authorization
CVE-2026-1168378.8 HighA malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.
CVE-2026-1168446.3 MediumFclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P
CVE-2026-1168438.7 HighMistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode
CVE-2026-1168426.9 MediumDevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup
CVE-2026-1168416.8 MediumDevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup
CVE-2026-1168406.9 Mediumllama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader
CVE-2026-1168296.9 Mediumllama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader
CVE-2026-1168168.5 Highllama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer
CVE-2025-714396.8 Mediumllama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info
CVE-2024-584008.8 Highllama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs
CVE-2024-583996.9 Mediumllama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets
CVE-2026-1168368.8 HighA malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device.
CVE-2026-1166206.9 MediumTencent RapidJSON Regex stream.h Take out-of-bounds
CVE-2026-78845Not scoredAidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root description parsing.
CVE-2026-1070676.2 MediumAn issue in Shirt Pocket's SuperDuper! 4.0.9 and earlier allow a local attacker to obtain sensitive information
CVE-2026-1166046.9 MediumSourceCodester Online Food Ordering System delete_admin.php missing authentication
CVE-2026-1166035.1 MediumSourceCodester Online Food Ordering System add_food.php unrestricted upload
CVE-2026-1114228.8 HighApache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
CVE-2026-1168286.9 MediumYesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand
CVE-2026-1168278.2 HighYesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import
CVE-2026-1168268.2 HighYesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile
CVE-2026-1168258.3 HighYesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox
CVE-2026-1168245.3 MediumYesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler
CVE-2026-1168235.3 MediumYesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback
CVE-2026-1168226.9 MediumYesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter
CVE-2026-1168217.1 HighYesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames
CVE-2026-1168206.9 MediumYesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter
CVE-2026-1168198.4 HighOpenPanel before 3.0.0 Credential Disclosure via notification.rules Query
CVE-2026-1168188.8 HighOpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket
CVE-2026-1168176.9 MediumOpenPanel before 3.0.0 Missing Authentication on Worker Bull Board
CVE-2026-1168155.3 MediumOpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts
CVE-2026-1168147.1 HighOpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs
CVE-2026-1168137.1 HighOpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts
CVE-2026-1168127.1 HighOpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter
CVE-2026-1168118.7 HighOpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template
CVE-2026-1168106.9 MediumOpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences
CVE-2026-1168096.9 MediumOpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure
CVE-2026-1168088.6 HighOpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.