Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,638 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-116054 | 2.1 Low | SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash | Oct 25, 2026 |
| CVE-2026-116053 | 4.8 Medium | dbcli mycli Whitelist source.py source_special_command_is_safe os command injection | Oct 25, 2026 |
| CVE-2026-116186 | 2.3 Low | OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId | Oct 25, 2026 |
| CVE-2026-116185 | 5.3 Medium | OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos | Oct 25, 2026 |
| CVE-2026-116184 | 2.1 Low | OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket | Oct 25, 2026 |
| CVE-2026-116211 | 8.8 High | YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create | Oct 25, 2026 |
| CVE-2026-116208 | 7.2 High | YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts | Oct 25, 2026 |
| CVE-2026-116207 | 8.8 High | YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API | Oct 25, 2026 |
| CVE-2026-116206 | 5.3 Medium | YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax | Oct 25, 2026 |
| CVE-2026-116205 | 6.9 Medium | YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax | Oct 25, 2026 |
| CVE-2026-116204 | 7.2 High | YesWiki before 4.7.0 CSRF via despam Admin Action | Oct 25, 2026 |
| CVE-2026-116203 | 5.3 Medium | YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters | Oct 25, 2026 |
| CVE-2026-116202 | 5.1 Medium | YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload | Oct 25, 2026 |
| CVE-2026-116201 | 8.7 High | Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition | Oct 25, 2026 |
| CVE-2026-116200 | 8.2 High | Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap() | Oct 25, 2026 |
| CVE-2026-116199 | 9.2 Critical | Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback | Oct 25, 2026 |
| CVE-2026-116198 | 5.3 Medium | Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store | Oct 25, 2026 |
| CVE-2026-116197 | 2.1 Low | Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection | Oct 25, 2026 |
| CVE-2026-116196 | 6.0 Medium | Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url | Oct 25, 2026 |
| CVE-2026-116195 | 7.0 High | Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim | Oct 25, 2026 |
| CVE-2026-116194 | 7.6 High | Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback | Oct 25, 2026 |
| CVE-2026-116193 | 6.9 Medium | Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests | Oct 25, 2026 |
| CVE-2026-116192 | 8.2 High | rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots | Oct 25, 2026 |
| CVE-2026-116191 | 8.7 High | Rclone before 1.75.2 Path Traversal via serve webdav MKCOL | Oct 25, 2026 |
| CVE-2026-116190 | 6.3 Medium | rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect | Oct 25, 2026 |
| CVE-2026-116189 | 7.7 High | rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS | Oct 25, 2026 |
| CVE-2026-116188 | 6.9 Medium | rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow | Oct 25, 2026 |
| CVE-2026-116187 | 6.1 Medium | Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads | Oct 25, 2026 |
| CVE-2026-116183 | 8.7 High | phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID | Oct 25, 2026 |
| CVE-2026-116182 | 5.3 Medium | phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching | Oct 25, 2026 |
| CVE-2026-116181 | 7.1 High | vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids | Oct 25, 2026 |
| CVE-2026-116180 | 8.3 High | vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors | Oct 25, 2026 |
| CVE-2026-116179 | 8.7 High | vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override | Oct 25, 2026 |
| CVE-2026-116178 | 8.2 High | vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders | Oct 25, 2026 |
| CVE-2026-116177 | 8.7 High | vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass | Oct 25, 2026 |
| CVE-2026-116176 | 8.8 High | vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector | Oct 25, 2026 |
| CVE-2026-116175 | 7.1 High | vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions | Oct 25, 2026 |
| CVE-2026-116174 | 8.2 High | vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate | Oct 25, 2026 |
| CVE-2026-116173 | 8.2 High | vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids | Oct 25, 2026 |
| CVE-2026-116172 | 8.2 High | vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n | Oct 25, 2026 |
| CVE-2026-116171 | 5.9 Medium | SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix | Oct 25, 2026 |
| CVE-2026-116170 | 6.9 Medium | SiYuan before v3.8.7 SQL Injection via History Search op and query | Oct 25, 2026 |
| CVE-2026-116169 | 5.1 Medium | SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks | Oct 25, 2026 |
| CVE-2026-116168 | 6.9 Medium | SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool | Oct 25, 2026 |
| CVE-2026-116167 | 7.6 High | SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter | Oct 25, 2026 |
| CVE-2026-116166 | 7.6 High | SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting | Oct 25, 2026 |
| CVE-2026-116165 | 8.8 High | Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB | Oct 25, 2026 |
| CVE-2026-116164 | 6.3 Medium | Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes | Oct 25, 2026 |
| CVE-2026-116163 | 9.1 Critical | Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses | Oct 25, 2026 |
| CVE-2026-116162 | 2.1 Low | Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login | Oct 25, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.