Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,617 vulnerabilities match.

CVESeveritySummary
CVE-2026-1165775.3 MediumTornado: Quadratic CPU usage when parsing HTTP headers with line folding
CVE-2026-1165767.8 Highsysteminformation: Windows command injection in services() through Unicode quotation marks
CVE-2026-1165024.8 Mediumturboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write
CVE-2026-1165756.3 MediumMem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
CVE-2026-1166712.1 LowInfinite loop in Xpdf due to missing validation in JPEG 2000 decoder
CVE-2026-1164825.1 Mediumsubhajitkhan online-clinic-management-system patientregistration.php cross site scripting
CVE-2026-703825.1 MediumStored Cross-Site Scripting in Web Interface
CVE-2026-656305.9 MediumTiming side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose
CVE-2026-656325.1 MediumECDSA signature length is not validated in jose, allowing signature malleability
CVE-2026-656316.9 Mediumerlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service
CVE-2026-656297.4 HighWeak PBKDF2 parameters for password-encrypted private-key export in jose
CVE-2026-656285.9 MediumInfinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types
CVE-2026-656276.9 MediumDecompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2
CVE-2026-571846.3 MediumAsterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
CVE-2026-656265.9 MediumBleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose
CVE-2026-656255.9 MediumAttacker-controlled AES-GCM authentication tag length allows tag forgery in jose
CVE-2026-703816.9 MediumUnauthorized Access to Internal Web Resources
CVE-2026-571936.9 MediumAsterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
CVE-2026-703806.9 MediumResource Exhaustion in MICE Service
CVE-2026-1164795.3 Mediuma2aproject a2a-java JSON-RPC Error getMessage information exposure
CVE-2026-115533Not scoredCVE-2026-115533
CVE-2026-1159275.3 MediumTornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
CVE-2026-571877.1 HighAsterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
CVE-2026-1164786.9 Mediuma2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure
CVE-2026-571962.3 LowAsterisk: Reflected XSS in Phone Provisioning HTTP Error Pages
CVE-2026-1159248.6 HighRembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
CVE-2026-1164775.3 Mediuma2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure
CVE-2014-1251356.9 MediumOctoPrint Flask Secret Key hard-coded key
CVE-2026-1164765.3 Mediuma2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race condition
CVE-2026-1107209.9 CriticalConsul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
CVE-2026-1166315.4 MediumExternal protocol handler (tel:) address bar spoof
CVE-2026-1166325.4 MediumFacetime protocol handler enabled spoofing
CVE-2026-1164715.3 MediumBKWLD Decoy Authorization Policy Policy.php privileges management
CVE-2026-1164676.9 Mediumggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion
CVE-2026-1158046.4 MediumConsul vulnerable to an authorization bypass in health check registration
CVE-2026-1166348.2 HighOmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens
CVE-2026-500966.1 MediumBUG-000187164 - ArcGIS Server has a security vulnerability.
CVE-2026-500956.1 MediumBUG-000187165 - ArcGIS Server has a security vulnerability.
CVE-2026-335225.3 MediumBUG-000182936 - ArcGIS Server has a security vulnerability.
CVE-2026-335217.5 HighBUG-000186514 - ArcGIS Server has a security vulnerability.
CVE-2026-335206.1 MediumBUG-000185167 - ArcGIS Server has a security vulnerability.
CVE-2026-107579.8 CriticalBUG-000187511 - ArcGIS Server has a security vulnerability.
CVE-2026-1056267.5 HighConsul vulnerable to a denial of service in HTTP APIs
CVE-2026-1164635.3 MediumFastStone Image Viewer Box-Average Downsampler FUN_0062d96c out-of-bounds
CVE-2026-1159236.5 MediumBackstage catalog rules can be bypassed for URL locations using encoded path segments
CVE-2026-1056088.8 HighConsul vulnerable to an authorization bypass in service mesh registration
CVE-2026-703797.1 HighUnauthorized Access to vSolution Matrix RTSP
CVE-2026-1164615.3 MediumOmega Solution Restro POS sale-invoice logic error
CVE-2026-1057657.5 HighConsul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API
CVE-2026-1159226.2 MediumONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.