Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,692 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-115886 | 6.5 Medium | MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints | Oct 23, 2026 |
| CVE-2026-115885 | 4.1 Medium | LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output | Oct 23, 2026 |
| CVE-2026-115883 | 6.0 Medium | LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores | Oct 23, 2026 |
| CVE-2026-113951 | Not scored | If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the… | Oct 23, 2026 |
| CVE-2026-75525 | 5.3 Medium | OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant | Oct 23, 2026 |
| CVE-2026-115800 | 4.8 Medium | UbiquitousLearning mllm Convertor __init__.py load_model path traversal | Oct 23, 2026 |
| CVE-2026-75524 | 5.4 Medium | OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent | Oct 23, 2026 |
| CVE-2026-65825 | 7.5 High | OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants | Oct 23, 2026 |
| CVE-2026-65824 | 7.4 High | OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie | Oct 23, 2026 |
| CVE-2026-58202 | 8.3 High | OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation` | Oct 23, 2026 |
| CVE-2026-115877 | 5.4 Medium | Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value | Oct 23, 2026 |
| CVE-2026-83813 | 3.1 Low | Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation | Oct 23, 2026 |
| CVE-2026-115778 | 7.5 High | Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer | Oct 23, 2026 |
| CVE-2026-115776 | 7.5 High | Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer | Oct 23, 2026 |
| CVE-2026-115775 | 8.7 High | Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree | Oct 23, 2026 |
| CVE-2026-115774 | 4.9 Medium | Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH | Oct 23, 2026 |
| CVE-2026-113877 | Not scored | HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions | Oct 23, 2026 |
| CVE-2026-115797 | 6.3 Medium | Tenda F6 Web Management cleartext transmission | Oct 23, 2026 |
| CVE-2026-79982 | 8.8 High | Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size | Oct 23, 2026 |
| CVE-2026-79981 | 6.5 Medium | DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing | Oct 23, 2026 |
| CVE-2026-79980 | 5.6 Medium | Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS | Oct 23, 2026 |
| CVE-2026-79979 | 7.8 High | Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames | Oct 23, 2026 |
| CVE-2026-79978 | 3.6 Low | Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path | Oct 23, 2026 |
| CVE-2026-79977 | 8.2 High | WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr | Oct 23, 2026 |
| CVE-2026-19741 | 7.5 High | OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd) | Oct 23, 2026 |
| CVE-2026-115796 | 5.3 Medium | Tenda F6 Web Management cross-site request forgery | Oct 23, 2026 |
| CVE-2026-115586 | 7.1 High | virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) | Oct 23, 2026 |
| CVE-2026-115585 | 7.1 High | pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) | Oct 23, 2026 |
| CVE-2026-115580 | 7.1 High | pypdf: Possible long runtimes for large xref table header limits | Oct 23, 2026 |
| CVE-2026-115572 | 7.1 High | pypdf: Possible long runtimes for repeated references to the same missing object | Oct 23, 2026 |
| CVE-2026-115845 | 5.3 Medium | Incomplete validation in the run_script Python sandbox in AWS MCP Server | Oct 23, 2026 |
| CVE-2026-91093 | 8.5 High | HP One Agent Software – Security Update | Oct 23, 2026 |
| CVE-2026-112342 | 7.1 High | Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning | Oct 23, 2026 |
| CVE-2026-115570 | 7.4 High | Electron: Mitigation for compromised eMudhra intermediate certificates | Oct 23, 2026 |
| CVE-2026-115569 | 3.3 Low | Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root | Oct 23, 2026 |
| CVE-2026-115863 | 7.6 High | ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack… | Oct 23, 2026 |
| CVE-2026-115813 | 6.9 Medium | Server-side request forgery in the model download path in Amazon Web Services Multi Model Server | Oct 23, 2026 |
| CVE-2026-115812 | 9.3 Critical | Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server | Oct 23, 2026 |
| CVE-2026-115567 | 5.8 Medium | Tokio: Race condition in `tokio::time::Interval` | Oct 23, 2026 |
| CVE-2026-110975 | 7.4 High | Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure | Oct 23, 2026 |
| CVE-2026-106069 | 7.4 High | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as… | Oct 23, 2026 |
| CVE-2026-105481 | 6.5 Medium | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive… | Oct 23, 2026 |
| CVE-2026-105482 | 7.4 High | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the… | Oct 23, 2026 |
| CVE-2026-106074 | 4.8 Medium | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable… | Oct 23, 2026 |
| CVE-2026-106071 | 3.6 Low | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the… | Oct 23, 2026 |
| CVE-2026-106072 | 6.7 Medium | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or… | Oct 23, 2026 |
| CVE-2026-87901 | 8.3 High | Improper sanitization in the registration module allows reflected Cross-Site Scripting. | Oct 23, 2026 |
| CVE-2026-105483 | 7.4 High | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits… | Oct 23, 2026 |
| CVE-2026-106070 | 3.7 Low | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does… | Oct 23, 2026 |
| CVE-2026-106073 | 3.3 Low | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result,… | Oct 23, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.