Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,619 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-116228 | 4.8 Medium | 777genius agent-teams-ai Local HTTP Service HttpServer.ts doStart missing authentication | Oct 26, 2026 |
| CVE-2026-116227 | 4.8 Medium | Edimax BR-6208AC Virtual Server cross site scripting | Oct 26, 2026 |
| CVE-2026-116224 | 5.3 Medium | fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery | Oct 26, 2026 |
| CVE-2026-107900 | 8.4 High | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | Oct 26, 2026 |
| CVE-2026-107899 | 8.4 High | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the… | Oct 26, 2026 |
| CVE-2026-107898 | 8.4 High | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the… | Oct 26, 2026 |
| CVE-2026-107897 | 8.4 High | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | Oct 26, 2026 |
| CVE-2026-107896 | 8.4 High | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | Oct 26, 2026 |
| CVE-2026-107895 | 8.4 High | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds write vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | Oct 26, 2026 |
| CVE-2026-107894 | 8.4 High | V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | Oct 26, 2026 |
| CVE-2026-116223 | 6.9 Medium | icret EasyImage del.php privileges management | Oct 26, 2026 |
| CVE-2026-103299 | 5.3 Medium | nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret | Oct 26, 2026 |
| CVE-2026-103319 | 5.3 Medium | OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key | Oct 26, 2026 |
| CVE-2026-103381 | 6.5 Medium | Mintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation via Callback Forgery | Oct 26, 2026 |
| CVE-2026-103306 | 5.3 Medium | iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback | Oct 26, 2026 |
| CVE-2026-103298 | 5.3 Medium | CCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook Forgery | Oct 26, 2026 |
| CVE-2026-116124 | 5.3 Medium | GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow | Oct 26, 2026 |
| CVE-2026-116123 | 6.3 Medium | NocoDB signup validatePassword excessive authentication | Oct 26, 2026 |
| CVE-2026-116122 | 6.3 Medium | NocoDB Sign-in Endpoint AuthService.validateUser information disclosure | Oct 26, 2026 |
| CVE-2026-116121 | 6.3 Medium | NocoDB Registration users.service.ts race condition | Oct 26, 2026 |
| CVE-2026-116120 | 6.3 Medium | NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources | Oct 26, 2026 |
| CVE-2026-116119 | 5.1 Medium | NocoDB Password-Reset Flow users.service.ts race condition | Oct 26, 2026 |
| CVE-2026-113345 | 8.5 High | Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application… | Oct 26, 2026 |
| CVE-2026-116118 | 5.3 Medium | Z.ai Zcode Sed Command Filter os command injection | Oct 26, 2026 |
| CVE-2026-116117 | 6.9 Medium | halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal | Oct 26, 2026 |
| CVE-2026-116116 | 9.3 Critical | Yoosee GM8135S Camera Secure Boot signature verification | Oct 26, 2026 |
| CVE-2026-116115 | 2.3 Low | Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization | Oct 26, 2026 |
| CVE-2026-116114 | 6.3 Medium | Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission | Oct 26, 2026 |
| CVE-2026-116113 | 5.3 Medium | GouGuOA Api.php chunkUpload unrestricted upload | Oct 26, 2026 |
| CVE-2026-116112 | 6.9 Medium | HashenUdara edoc-doctor-appointment-system add-new.php sql injection | Oct 26, 2026 |
| CVE-2026-116111 | 5.3 Medium | 2K Games Civilization V Lua Sandbox loadstring type confusion | Oct 26, 2026 |
| CVE-2026-116110 | 6.9 Medium | GiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication | Oct 26, 2026 |
| CVE-2026-116109 | 5.3 Medium | continuedev Continue MCP Server Transport ConfigHandler.ts MCPManagerSingleton.setConnections os command injection | Oct 26, 2026 |
| CVE-2026-116108 | 5.3 Medium | openbq-org OpenBB Local API Server api_settings.py access control | Oct 26, 2026 |
| CVE-2026-116107 | 5.3 Medium | Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization | Oct 26, 2026 |
| CVE-2026-116106 | 6.9 Medium | HeyCyan App FileProvider access control | Oct 26, 2026 |
| CVE-2026-116105 | 6.3 Medium | HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission | Oct 26, 2026 |
| CVE-2026-116104 | 5.3 Medium | Sony Neural Network Libraries NNP Converter utils.py func_set_nnabla_version_decorate code injection | Oct 26, 2026 |
| CVE-2026-116103 | 5.3 Medium | Sony Neural Network Libraries Encode Param encode_decode_param.py load_param_in_txt code injection | Oct 26, 2026 |
| CVE-2026-116102 | 5.3 Medium | QuantGeekDev docker-mcp docker_executor.py _build_windows_command os command injection | Oct 26, 2026 |
| CVE-2026-116101 | 5.3 Medium | itsourcecode Online Cake Ordering System deletetransac.php sql injection | Oct 26, 2026 |
| CVE-2026-116100 | 4.8 Medium | gougucms User Level Level.php add cross site scripting | Oct 26, 2026 |
| CVE-2026-36698 | Not scored | Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and… | Oct 26, 2026 |
| CVE-2026-31158 | 9.8 Critical | SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Login Page | Oct 26, 2026 |
| CVE-2026-116638 | 7.5 High | The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a… | Oct 26, 2026 |
| CVE-2026-107092 | 9.8 Critical | NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. | Oct 26, 2026 |
| CVE-2026-107091 | 7.8 High | An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver installer DLL-loading logic | Oct 26, 2026 |
| CVE-2026-107090 | Not scored | An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary code via the Maltego Windows installer executable-resolution logic | Oct 26, 2026 |
| CVE-2026-107080 | 6.5 Medium | OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service. | Oct 26, 2026 |
| CVE-2026-106781 | 7.8 High | An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges. | Oct 26, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.