Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,703 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-110975 | 7.4 High | Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure | Oct 23, 2026 |
| CVE-2026-106069 | 7.4 High | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as… | Oct 23, 2026 |
| CVE-2026-105481 | 6.5 Medium | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive… | Oct 23, 2026 |
| CVE-2026-105482 | 7.4 High | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the… | Oct 23, 2026 |
| CVE-2026-106074 | 4.8 Medium | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable… | Oct 23, 2026 |
| CVE-2026-106071 | 3.6 Low | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the… | Oct 23, 2026 |
| CVE-2026-106072 | 6.7 Medium | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or… | Oct 23, 2026 |
| CVE-2026-87901 | 8.3 High | Improper sanitization in the registration module allows reflected Cross-Site Scripting. | Oct 23, 2026 |
| CVE-2026-105483 | 7.4 High | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits… | Oct 23, 2026 |
| CVE-2026-106070 | 3.7 Low | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does… | Oct 23, 2026 |
| CVE-2026-106073 | 3.3 Low | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result,… | Oct 23, 2026 |
| CVE-2026-115810 | 6.3 Medium | Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL | Oct 23, 2026 |
| CVE-2026-57845 | 8.7 High | Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder | Oct 23, 2026 |
| CVE-2026-54668 | 8.7 High | Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config) | Oct 23, 2026 |
| CVE-2026-58497 | 8.6 High | Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests | Oct 23, 2026 |
| CVE-2026-49442 | 5.3 Medium | Cacti: User Enumeration via Error Messages | Oct 23, 2026 |
| CVE-2026-39902 | 7.2 High | Cacti: Authenticated RCE on Data Input | Oct 23, 2026 |
| CVE-2026-46531 | 5.5 Medium | Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368) | Oct 23, 2026 |
| CVE-2026-102786 | 8.6 High | Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5 | Oct 23, 2026 |
| CVE-2026-55222 | 5.1 Medium | Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap | Oct 23, 2026 |
| CVE-2026-53942 | 9.9 Critical | Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN | Oct 23, 2026 |
| CVE-2026-55486 | 9.3 Critical | Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS | Oct 23, 2026 |
| CVE-2026-55465 | 5.3 Medium | Goobi viewer: Solr injection via unvalidated region parameter in spatial search | Oct 23, 2026 |
| CVE-2026-55463 | 6.5 Medium | Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation | Oct 23, 2026 |
| CVE-2026-112333 | 5.1 Medium | GFI Archiver < 15.14 Stored XSS via MailInsights.aspx | Oct 23, 2026 |
| CVE-2026-55459 | 7.4 High | Goobi viewer: OpenID JWT audience not enforced by the verifier | Oct 23, 2026 |
| CVE-2026-55457 | 7.4 High | Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass | Oct 23, 2026 |
| CVE-2026-55444 | 5.3 Medium | Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters | Oct 23, 2026 |
| CVE-2026-46652 | 9.8 Critical | Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer | Oct 23, 2026 |
| CVE-2026-46651 | 9.8 Critical | Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer | Oct 23, 2026 |
| CVE-2026-46347 | 6.8 Medium | Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset | Oct 23, 2026 |
| CVE-2026-46346 | 6.5 Medium | Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset | Oct 23, 2026 |
| CVE-2026-55442 | 5.3 Medium | Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection | Oct 23, 2026 |
| CVE-2026-115478 | 7.1 High | obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes | Oct 23, 2026 |
| CVE-2026-115477 | 7.1 High | obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP | Oct 23, 2026 |
| CVE-2026-115457 | 7.1 High | baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments | Oct 23, 2026 |
| CVE-2026-115786 | 6.5 Medium | Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion | Oct 23, 2026 |
| CVE-2026-115785 | 4.3 Medium | Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address | Oct 23, 2026 |
| CVE-2026-114624 | 7.2 High | baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity | Oct 23, 2026 |
| CVE-2026-114623 | 6.5 Medium | baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure | Oct 23, 2026 |
| CVE-2026-114622 | 7.2 High | baserCMS: Encoded path traversal bypass in the theme file API | Oct 23, 2026 |
| CVE-2026-57207 | 5.9 Medium | NetBox MCP Server: HTTP transport exposes all NetBox data without authentication | Oct 23, 2026 |
| CVE-2026-114621 | 8.8 High | baserCMS: SQL injection in the admin panel and admin API | Oct 23, 2026 |
| CVE-2026-114357 | 7.0 High | DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0) | Oct 23, 2026 |
| CVE-2026-57208 | 6.2 Medium | Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind | Oct 23, 2026 |
| CVE-2026-114356 | 7.0 High | DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization | Oct 23, 2026 |
| CVE-2026-115480 | 5.3 Medium | baserCMS: Public Web API mail-form submission bypasses image CAPTCHA | Oct 23, 2026 |
| CVE-2026-115479 | 5.3 Medium | baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients | Oct 23, 2026 |
| CVE-2026-114355 | 8.6 High | DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root | Oct 23, 2026 |
| CVE-2026-93640 | 7.8 High | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration | Oct 23, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.