Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,680 vulnerabilities match.

CVESeveritySummary
CVE-2026-1160045.1 Mediumonyx-dot-app Onyx PreviewTab.tsx cross site scripting
CVE-2026-1160006.9 MediumZylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery
CVE-2026-1159996.9 Mediummansi-k Restaurant_IMS lsmodal.php mysqli_connect sql injection
CVE-2026-1159975.3 Mediumpig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection
CVE-2026-1159966.3 MediumUnitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation
CVE-2026-1159959.4 CriticalUnitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection
CVE-2026-1159825.3 MediumphpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting
CVE-2026-1159814.8 MediumphpIPAM index.php cross site scripting
CVE-2026-1148209.1 CriticalVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2,…
CVE-2026-1159736.9 MediumFaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery
CVE-2026-1159726.9 MediumFaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization
CVE-2026-1159716.9 MediumTravisun Opptrix preParsing handler webhook Buffer.concat denial of service
CVE-2026-1159706.9 MediumTravisun Opptrix Import Endpoint import code injection
CVE-2026-1159696.9 MediumTravisun Opptrix Schedule API setup command injection
CVE-2026-1159339.9 CriticalForged signed tokens let any registered user take over other users and organizations
CVE-2026-1155579.4 CriticalDistrust compromised intermediate certificates in ssl module
CVE-2026-1141917.5 HighWordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability
CVE-2026-1147047.2 HighWordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability
CVE-2026-1141926.5 MediumWordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability
CVE-2026-114629Not scoredWeb::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters
CVE-2026-1159329.6 CriticalPath traversal in post media lets any registered user read server files
CVE-2026-1160205.3 MediumBookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages
CVE-2026-1160198.7 HighGrav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives
CVE-2026-1160185.3 MediumONEARMY community-platform before 2.165.2 IDOR via notification read endpoint
CVE-2026-1160175.3 MediumXiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint
CVE-2026-1160167.1 Highyudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header
CVE-2026-1160155.3 Mediumyudao-cloud through 2026.09 IDOR via after-sale-log list endpoint
CVE-2026-1160149.2 Criticalopen62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType
CVE-2026-1160136.3 MediumOpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing
CVE-2026-1160122.0 LowGhidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser
CVE-2026-1160118.7 HighCrow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
CVE-2026-1160105.3 MediumRosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers
CVE-2026-1160098.7 HighCamaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action
CVE-2026-1160085.3 MediumDaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign
CVE-2026-1100188.8 HighaBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute
CVE-2026-1147056.5 MediumWordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability
CVE-2026-1159984.3 MediumIDOR: User reads and modifies findings from other people's projects
CVE-2026-1141946.5 MediumWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1159945.4 MediumBOLA Allows Cross-Project Target Tampering
CVE-2026-1159936.8 MediumStored XSS in the “Notes” field of project checklists
CVE-2026-1141969.8 CriticalWordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability
CVE-2026-1146957.1 HighWordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1146947.1 HighWordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1146936.5 MediumWordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1108926.5 MediumWordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability
CVE-2026-1146977.1 HighWordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1141787.1 HighWordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1141905.9 MediumWordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability
CVE-2026-1128669.3 CriticalWordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability
CVE-2026-940759.8 CriticalWordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.