Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,704 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-93640 | 7.8 High | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration | Oct 23, 2026 |
| CVE-2026-115481 | 8.5 High | baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload | Oct 23, 2026 |
| CVE-2026-114354 | 8.6 High | DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root | Oct 23, 2026 |
| CVE-2026-50057 | 7.8 High | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions | Oct 23, 2026 |
| CVE-2026-114353 | 7.0 High | DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution | Oct 23, 2026 |
| CVE-2026-50056 | 7.8 High | Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection | Oct 23, 2026 |
| CVE-2026-93639 | 8.7 High | Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation | Oct 23, 2026 |
| CVE-2026-93638 | 6.1 Medium | Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter | Oct 23, 2026 |
| CVE-2026-55826 | 8.7 High | Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin | Oct 23, 2026 |
| CVE-2026-93636 | 4.3 Medium | Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name | Oct 23, 2026 |
| CVE-2026-93634 | 4.3 Medium | Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records | Oct 23, 2026 |
| CVE-2026-93633 | 5.4 Medium | Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters | Oct 23, 2026 |
| CVE-2026-93631 | 7.1 High | Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking | Oct 23, 2026 |
| CVE-2026-93630 | 4.3 Medium | Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization | Oct 23, 2026 |
| CVE-2026-55606 | 6.5 Medium | odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp() | Oct 23, 2026 |
| CVE-2026-53918 | 8.8 High | odhcpd DHCPv6 IA dangling first pointer use-after-free | Oct 23, 2026 |
| CVE-2026-53920 | 8.7 High | odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure | Oct 23, 2026 |
| CVE-2026-115754 | 2.3 Low | serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body | Oct 23, 2026 |
| CVE-2026-53921 | 9.8 Critical | odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites) | Oct 23, 2026 |
| CVE-2026-93629 | 5.3 Medium | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity | Oct 23, 2026 |
| CVE-2026-93628 | 5.3 Medium | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response | Oct 23, 2026 |
| CVE-2026-93627 | 5.3 Medium | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer | Oct 23, 2026 |
| CVE-2026-50053 | 8.7 High | Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters | Oct 23, 2026 |
| CVE-2026-10632 | 8.7 High | Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter | Oct 23, 2026 |
| CVE-2026-115752 | 2.3 Low | Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon | Oct 23, 2026 |
| CVE-2026-115751 | 6.3 Medium | mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname | Oct 23, 2026 |
| CVE-2026-115750 | 6.3 Medium | mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects | Oct 23, 2026 |
| CVE-2026-115749 | 4.8 Medium | hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import | Oct 23, 2026 |
| CVE-2026-112848 | 9.8 Critical | WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability | Oct 23, 2026 |
| CVE-2026-112849 | 7.1 High | WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability | Oct 23, 2026 |
| CVE-2026-112850 | 8.1 High | WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability | Oct 23, 2026 |
| CVE-2026-112854 | 9.8 Critical | WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability | Oct 23, 2026 |
| CVE-2026-112847 | 9.8 Critical | WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability | Oct 23, 2026 |
| CVE-2026-112846 | 9.8 Critical | WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability | Oct 23, 2026 |
| CVE-2026-112851 | 9.8 Critical | WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability | Oct 23, 2026 |
| CVE-2026-112852 | 8.1 High | WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability | Oct 23, 2026 |
| CVE-2026-112853 | 9.8 Critical | WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability | Oct 23, 2026 |
| CVE-2026-112856 | 9.8 Critical | WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability | Oct 23, 2026 |
| CVE-2026-112857 | 9.8 Critical | WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability | Oct 23, 2026 |
| CVE-2026-112858 | 9.8 Critical | WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability | Oct 23, 2026 |
| CVE-2026-112859 | 9.8 Critical | WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability | Oct 23, 2026 |
| CVE-2026-112855 | 9.8 Critical | WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability | Oct 23, 2026 |
| CVE-2026-112863 | 7.1 High | WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability | Oct 23, 2026 |
| CVE-2026-115730 | 2.3 Low | i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl | Oct 23, 2026 |
| CVE-2026-115729 | 8.9 High | @pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass | Oct 23, 2026 |
| CVE-2026-115728 | 8.7 High | @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing | Oct 23, 2026 |
| CVE-2026-99087 | Not scored | dm-integrity: fix NULL pointer dereference when the 'R' flag is used | Oct 23, 2026 |
| CVE-2026-99086 | Not scored | dm-integrity: validate the superblock on resume | Oct 23, 2026 |
| CVE-2026-99085 | Not scored | sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler | Oct 23, 2026 |
| CVE-2026-99084 | Not scored | readdir: take no inode lock on an immutable directory | Oct 23, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.