Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,619 vulnerabilities match.

CVESeveritySummary
CVE-2026-770559.3 CriticalImproper Privilege Assignment in boneIO
CVE-2026-770546.9 MediumCleartext Storage of Sensitive Information in boneIO
CVE-2026-770538.7 HighMissing Authentication in Default Configuration in boneIO
CVE-2026-770528.7 HighMissing Authentication for Node-RED in boneIO
CVE-2026-1163405.3 MediumiFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization
CVE-2026-1123458.6 HighTTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure
CVE-2026-33225.6 MediumPrivilege escalation via request replaying in Lobster_pro
CVE-2026-110748Not scoredApache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files
CVE-2026-921716.5 MediumInfinispan-operator: infinispan operator: sensitive information disclosure due pod args store
CVE-2026-1164975.5 MediumGssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon
CVE-2026-1163396.9 MediumiFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist
CVE-2026-938482.7 LowMattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator
CVE-2026-938506.5 MediumUnbounded memory consumption during PDF text extraction
CVE-2026-938496.5 MediumMattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames
CVE-2026-933289.3 CriticalMissing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
CVE-2026-1107335.4 MediumApache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store
CVE-2026-938473.5 LowImproper post type validation on scheduled post endpoints
CVE-2026-651849.8 CriticalAvocent ACS8000 wsserver command injection
CVE-2026-1159307.6 HighMongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs
CVE-2026-1162845.3 MediumKameleo Local API user-info information disclosure
CVE-2026-1165166.5 MediumInsufficient length validation when parsing Zoom chat transcriptions
CVE-2026-972008.2 HighUnbounded response body buffering and decompression in hackney
CVE-2026-1156939.1 CriticalCustom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
CVE-2026-1134406.0 MediumHTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
CVE-2026-1157006.9 MediumSSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
CVE-2026-1128802.1 LowCRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
CVE-2026-1162835.3 MediumKameleo Local API profiles information disclosure
CVE-2026-1076569.6 CriticalAn authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox…
CVE-2026-111590Not scoredSSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services
CVE-2026-1085298.7 HighSETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit
CVE-2026-591079.2 CriticalShared SSH Authentication Key in vSolution Matrix File Sharing
CVE-2026-1104998.7 HighClient-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit
CVE-2026-1095848.7 HighHTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit
CVE-2026-1111038.2 HighHTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit
CVE-2026-1111018.7 HighHTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
CVE-2026-1134368.7 HighQuadratic bignum parsing of Content-Length and Host port values in Bandit
CVE-2026-1103146.3 MediumWebSocket frames keep reaching the WebSock after a server-initiated close in Bandit
CVE-2026-1142138.7 HighWebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
CVE-2026-1142166.3 MediumChunk extensions accept bare LF and CR, enabling request smuggling in Bandit
CVE-2026-1152698.7 HighHTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
CVE-2026-1085258.7 HighHTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
CVE-2026-1162825.3 MediumKameleo Cookie Controller w.cs CookieController.ListCookies information disclosure
CVE-2026-591069.3 CriticalUnauthenticated RCE Vulnerability in WolfProt interface implementation
CVE-2026-1164887.0 HighNXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers
CVE-2026-1164875.1 MediumNXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read
CVE-2026-1164862.0 LowObjenesis before 3.6 Type Confusion via Class Name Instantiator Cache
CVE-2026-1164859.3 Criticaldanmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints
CVE-2026-1162198.6 HighDolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter
CVE-2026-1162187.2 HighDolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field
CVE-2026-1162175.3 MediumRosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.