Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,118 vulnerabilities match.

CVESeveritySummary
CVE-2026-1187648.7 Highminimatch: potential denial of service via globparts amplification
CVE-2026-1187637.4 High@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
CVE-2026-1187629.3 CriticalMonkeytype: fork PR can execute code with elevated GITHUB_TOKEN
CVE-2026-1158057.8 HighRapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Path
CVE-2026-115877.2 HighAuthenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0
CVE-2023-73578.6 HighFlexNet Publisher lmadmin Rogue Vendor Daemon Vulnerability
CVE-2026-1187617.5 HighKubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory
CVE-2026-1191158.4 HighIncorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes
CVE-2026-1187606.5 MediumKubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads
CVE-2026-1187597.5 HighKubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant
CVE-2025-125236.5 MediumBroken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure
CVE-2026-623747.1 HighSD JWT JS: Tampered disclosures silently dropped instead of rejected
CVE-2026-1187587.5 HighKubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source
CVE-2026-1186734.1 MediumKeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses
CVE-2025-130505.4 MediumBroken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users
CVE-2026-1191459.4 CriticalFrappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload
CVE-2026-1191448.7 HighFrappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields
CVE-2026-1191435.9 MediumWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes
CVE-2026-1191425.9 MediumWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop
CVE-2026-1191416.9 MediumWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc
CVE-2026-1191405.9 MediumWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield
CVE-2026-1191395.9 MediumWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call
CVE-2026-1191385.9 MediumWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap
CVE-2026-1191376.9 MediumWasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry
CVE-2026-1191365.9 MediumWasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass
CVE-2026-1191355.9 MediumWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch
CVE-2026-1191346.9 MediumWasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles
CVE-2026-1191332.1 LowWasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags
CVE-2026-1191325.9 MediumWasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter
CVE-2026-1191316.9 MediumWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http
CVE-2026-1191302.1 LowWasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling
CVE-2026-1191298.6 HighZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval
CVE-2026-1191289.1 CriticalZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie
CVE-2026-1191278.6 HighZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection
CVE-2026-1191262.3 LowParse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys
CVE-2026-1191252.3 LowParse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields
CVE-2026-1191244.8 MediumImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph Option
CVE-2026-1191236.3 MediumImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder
CVE-2026-1191226.9 MediumCrawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check
CVE-2026-1191215.3 MediumCrawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for
CVE-2026-1191207.7 HighCrawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name
CVE-2026-1191198.7 HighCrawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields
CVE-2026-1191188.3 HighCrawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags
CVE-2026-908726.6 MediumServer-Side Script Injection in Manager Web UI in Progress WS_FTP Server
CVE-2026-908715.3 MediumPath Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server
CVE-2026-908705.3 MediumUnauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server
CVE-2026-908697.5 HighPre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server
CVE-2026-908689.9 CriticalOS Command Injection in Progress WS_FTP Server
CVE-2026-908678.1 HighImproper Access Control of Web Admin Console in Progress WS_FTP Server
CVE-2026-908669.1 CriticalVirtual Folder Path Confinement Bypass in Progress WS_FTP Server

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.