Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,618 vulnerabilities match.

CVESeveritySummary
CVE-2026-1159226.2 MediumONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
CVE-2026-1164086.5 MediumWordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1114043.7 LowWordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability
CVE-2026-1159216.2 MediumONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute
CVE-2026-1128394.3 MediumWordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability
CVE-2026-1159666.5 MediumWordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1164006.5 MediumWordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1163986.5 MediumWordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1159206.2 MediumONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
CVE-2026-1159196.2 MediumONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
CVE-2026-1159186.5 MediumvLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
CVE-2026-1159173.4 LowvLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
CVE-2026-815096.1 Mediumnforwardauth: Unvalidated r parameter allows post-authentication open redirect
CVE-2026-1159166.5 MediumvLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
CVE-2026-1159158.1 HighvLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
CVE-2026-1163855.1 MediumBdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting
CVE-2026-1026499.9 CriticalBurrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset
CVE-2026-1159146.5 MediumvLLM DeepSeek-OCR image processing vulnerable to denial of service
CVE-2026-727587.5 HighRoutinator may exit on malformed ranges
CVE-2026-727575.3 MediumRoutinator HTTP server becomes unavailable with many unclosed connections
CVE-2026-727567.5 HighRoutinator exits on malformed rsync URIs
CVE-2026-727553.8 LowRoutinator stores TA certificate in cache without validation
CVE-2026-727547.5 HighRoutinator exits when parsing an incorrect or very large CRL file
CVE-2026-727538.2 HighRoutinator incorrectly handles delta updates
CVE-2026-727526.5 MediumRoutinator exits when requesting the output repeatedly
CVE-2026-1163845.3 MediumBdtask Garage 24 Garage Management Software Backend improper authorization
CVE-2026-1159136.5 MediumvLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine
CVE-2026-1159127.5 HighvLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
CVE-2026-1166127.8 HighA flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing…
CVE-2026-1159116.5 MediumvLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
CVE-2026-1163956.5 MediumWordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability
CVE-2013-100776.9 MediumOctoPrint API Key settings.py getSettings information disclosure
CVE-2026-1155985.3 MediumWordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
CVE-2026-1159106.8 MediumPython Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim
CVE-2026-1147106.5 MediumWordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1155975.4 MediumWordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
CVE-2026-1163885.3 MediumWordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability
CVE-2026-1163966.5 MediumWordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1154187.0 HighSQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha
CVE-2026-1159097.5 Highzip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
CVE-2026-1164035.9 MediumWordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerability
CVE-2026-1159087.4 Highzip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)
CVE-2026-1159077.5 Highzip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
CVE-2026-1159066.5 Mediumzip: AES Entry HMAC Authentication Bypass on Premature EOF
CVE-2026-1163715.3 MediumAkuvox Akubela HyPanel PS51 login improper authentication
CVE-2026-11590510.0 Criticalzip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
CVE-2026-714568.5 HighUse of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue affects Kantech Entrapass: before 9.20.
CVE-2026-714555.3 MediumCleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows Retrieve Embedded Sensitive Data. This issue affects Kantech Entrapass: before 9.20.
CVE-2026-116596Not scoredCVE-2026-116596
CVE-2026-1163705.3 Medium2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.