Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,503 vulnerabilities match.

CVESeveritySummary
CVE-2026-1168077.0 HighOpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query
CVE-2026-1168065.3 MediumOpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation
CVE-2026-1168055.3 MediumOpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list
CVE-2026-1168045.1 MediumDOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content
CVE-2026-1168035.1 MediumDOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees
CVE-2026-1168025.1 MediumDOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode
CVE-2026-1168015.3 MediumParse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query
CVE-2026-1168006.9 MediumWWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header
CVE-2026-1166026.9 MediumSourceCodester Online Food Ordering System delete.php unlink path traversal
CVE-2026-1165564.8 MediumArgilla TextField.vue cross site scripting
CVE-2026-1165554.8 MediumArgilla Sandbox.vue cross site scripting
CVE-2026-22705.9 MediumStatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
CVE-2026-766545.8 MediumSubpath symlinking on Windows nodes permits NTLM coercion
CVE-2026-1165545.1 MediumArgilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting
CVE-2026-1165155.3 Mediumitsourcecode Online Book Store book.php sql injection
CVE-2026-1165918.7 Highcompress zstd: Panic on two-block frames
CVE-2026-1167488.7 HighTransmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token
CVE-2026-1167479.2 CriticalKener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret
CVE-2026-1167466.9 MediumQloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview
CVE-2026-1167456.9 MediumQloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation
CVE-2026-1167446.9 Mediumntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector
CVE-2026-1167436.8 Mediumlibyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data
CVE-2026-1167424.8 MediumHTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count
CVE-2026-1167418.3 HighSpeex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes
CVE-2026-1167407.1 Highlibcss through 0.9.2 NULL Pointer Dereference via Media-Query Parser
CVE-2026-1167395.3 MediumVMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder
CVE-2026-1167388.7 HighVMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder
CVE-2026-1167376.9 Mediumlibphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path
CVE-2026-1167366.9 Mediumlibpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array
CVE-2026-1167356.9 Mediumlibpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_6c_record_entries
CVE-2026-1167346.3 Mediumflatcc through 0.6.4 Out-of-Bounds Read via verifier check_header
CVE-2026-1167336.3 Mediumflatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number
CVE-2026-1167324.8 Mediumlibdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table
CVE-2026-1167316.9 MediumFurnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import
CVE-2026-1167306.8 MediumFurnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import
CVE-2026-1167294.8 Mediumlibfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a
CVE-2026-1167286.8 Mediumlibfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x0024
CVE-2026-1167274.8 Mediumgbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c
CVE-2026-1167264.8 Mediumgbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title
CVE-2026-1167256.8 Mediumgbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index
CVE-2026-1167248.5 HighFLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow
CVE-2026-1167238.5 HighFLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field
CVE-2026-1165905.9 Mediumsnappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite
CVE-2026-1165145.3 Mediumitsourcecode Airline Reservation System book_flight.php cross site scripting
CVE-2026-11650810.0 CriticalTOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow
CVE-2026-1165898.2 HighDatadog dd-trace-py: IAST instrumentation can lead to application DOS
CVE-2026-1165888.7 HighDatadog dd-trace-py: ReDOS in URL query string obfuscation
CVE-2026-1165076.9 MediumTOTOLINK A950RG global.so getLanguageCfg information disclosure
CVE-2026-1165877.5 HighGo JOSE: DoS when parsing JWKs that contain RSA keys
CVE-2026-1165866.9 MediumGo JOSE: Panics in JSON parsing

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.