Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,680 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-116153 | 2.0 Low | ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit | Oct 25, 2026 |
| CVE-2026-116152 | 6.9 Medium | ImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error Path | Oct 25, 2026 |
| CVE-2026-116151 | 6.3 Medium | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder | Oct 25, 2026 |
| CVE-2026-116150 | 2.3 Low | ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder | Oct 25, 2026 |
| CVE-2026-116149 | 7.2 High | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images | Oct 25, 2026 |
| CVE-2026-116148 | 4.8 Medium | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options | Oct 25, 2026 |
| CVE-2026-116147 | 6.3 Medium | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder | Oct 25, 2026 |
| CVE-2026-116146 | 6.3 Medium | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder | Oct 25, 2026 |
| CVE-2026-116145 | 1.8 Low | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix | Oct 25, 2026 |
| CVE-2026-116144 | 4.8 Medium | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder | Oct 25, 2026 |
| CVE-2026-116143 | 4.8 Medium | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders | Oct 25, 2026 |
| CVE-2026-116142 | 4.8 Medium | ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box | Oct 25, 2026 |
| CVE-2026-116141 | 6.9 Medium | ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder | Oct 25, 2026 |
| CVE-2026-116140 | 4.8 Medium | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing | Oct 25, 2026 |
| CVE-2026-116139 | 5.1 Medium | WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering | Oct 25, 2026 |
| CVE-2026-116052 | 5.3 Medium | LinkStackOrg LinkStack cross-site request forgery | Oct 25, 2026 |
| CVE-2026-116137 | 6.3 Medium | adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names | Oct 25, 2026 |
| CVE-2026-116136 | 6.0 Medium | ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking | Oct 25, 2026 |
| CVE-2026-116073 | 6.9 Medium | Leon before commit 50df142 Path Traversal via /download model Command | Oct 25, 2026 |
| CVE-2026-116072 | 5.3 Medium | Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity | Oct 25, 2026 |
| CVE-2026-116071 | 8.2 High | rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption | Oct 25, 2026 |
| CVE-2026-116070 | 6.9 Medium | Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config | Oct 25, 2026 |
| CVE-2026-116069 | 6.9 Medium | NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field | Oct 25, 2026 |
| CVE-2026-116068 | 8.7 High | Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router | Oct 25, 2026 |
| CVE-2026-116067 | 8.8 High | Paisa before 0.7.8 Path Traversal via Editor and Sheet API | Oct 25, 2026 |
| CVE-2026-116066 | 7.0 High | Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service | Oct 25, 2026 |
| CVE-2026-116050 | 6.9 Medium | krupalshah Employee Recruitment System Registration registerform3.php sql injection | Oct 25, 2026 |
| CVE-2026-116049 | 6.9 Medium | krupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql_query sql injection | Oct 25, 2026 |
| CVE-2026-116048 | 6.9 Medium | krupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql injection | Oct 25, 2026 |
| CVE-2026-116047 | 5.3 Medium | Privoce Vocechat Query Parameter widget.html cross site scripting | Oct 25, 2026 |
| CVE-2026-116046 | 4.8 Medium | eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal | Oct 25, 2026 |
| CVE-2026-116045 | 5.3 Medium | 1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal | Oct 25, 2026 |
| CVE-2026-115251 | 7.2 High | Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade | Oct 25, 2026 |
| CVE-2026-115214 | 9.8 Critical | Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers | Oct 25, 2026 |
| CVE-2026-115183 | 2.4 Low | Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget | Oct 25, 2026 |
| CVE-2026-114743 | 3.1 Low | InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings | Oct 25, 2026 |
| CVE-2026-114742 | 2.7 Low | WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR | Oct 25, 2026 |
| CVE-2026-114741 | 3.8 Low | WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR | Oct 25, 2026 |
| CVE-2026-114740 | 4.9 Medium | WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard | Oct 25, 2026 |
| CVE-2026-111981 | 2.7 Low | GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses | Oct 25, 2026 |
| CVE-2026-111980 | 5.5 Medium | GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant | Oct 25, 2026 |
| CVE-2026-111979 | 6.8 Medium | GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color | Oct 25, 2026 |
| CVE-2026-111978 | 6.0 Medium | GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import | Oct 25, 2026 |
| CVE-2026-111976 | 5.3 Medium | GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route | Oct 25, 2026 |
| CVE-2026-110285 | 5.3 Medium | WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret | Oct 25, 2026 |
| CVE-2025-15705 | 3.5 Low | Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS | Oct 25, 2026 |
| CVE-2026-94295 | 5.3 Medium | Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature | Oct 25, 2026 |
| CVE-2026-116044 | 5.3 Medium | prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload | Oct 25, 2026 |
| CVE-2026-116007 | 6.3 Medium | YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication | Oct 25, 2026 |
| CVE-2026-116006 | 6.9 Medium | YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication | Oct 25, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.