Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,187 vulnerabilities match.

CVESeveritySummary
CVE-2026-1191298.6 HighZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval
CVE-2026-1191289.1 CriticalZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie
CVE-2026-1191278.6 HighZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection
CVE-2026-1191262.3 LowParse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys
CVE-2026-1191252.3 LowParse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields
CVE-2026-1191244.8 MediumImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph Option
CVE-2026-1191236.3 MediumImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder
CVE-2026-1191226.9 MediumCrawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check
CVE-2026-1191215.3 MediumCrawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for
CVE-2026-1191207.7 HighCrawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name
CVE-2026-1191198.7 HighCrawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields
CVE-2026-1191188.3 HighCrawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags
CVE-2026-908726.6 MediumServer-Side Script Injection in Manager Web UI in Progress WS_FTP Server
CVE-2026-908715.3 MediumPath Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server
CVE-2026-908705.3 MediumUnauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server
CVE-2026-908697.5 HighPre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server
CVE-2026-908689.9 CriticalOS Command Injection in Progress WS_FTP Server
CVE-2026-908678.1 HighImproper Access Control of Web Admin Console in Progress WS_FTP Server
CVE-2026-908669.1 CriticalVirtual Folder Path Confinement Bypass in Progress WS_FTP Server
CVE-2026-908659.0 CriticalCommand Injection via FTP Notification Variables in Progress WS_FTP Server
CVE-2026-908649.1 CriticalHost Administrator Path Containment Bypass in Progress WS_FTP Server
CVE-2026-908639.1 CriticalPrivilege Escalation via Missing Authorization in WS_FTP Manager
CVE-2026-908624.3 MediumWeb Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server
CVE-2026-908616.6 MediumPassword Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server
CVE-2026-842966.8 MediumSSH Multi-Factor Authentication Bypass in Progress WS_FTP Server
CVE-2026-8429510.0 CriticalImproper Authentication in Progress WS_FTP Server
CVE-2026-1157938.7 HighResource exhaustion from RPC sessions kept for requests to unknown interface
CVE-2026-1157942.3 LowAlarm data length not validated against received frame length
CVE-2026-1157955.3 MediumOut-of-bounds read of DCP block header in DCP Set and Identify request parsing
CVE-2026-1117368.7 HighNULL pointer dereference on implicit read of user specific record index
CVE-2026-1122008.7 HighResource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness
CVE-2026-842947.7 HighInformation Disclosure in Ad Hoc Transfer in Progress WS_FTP Server
CVE-2026-1117357.1 HighInteger underflow leads to out-of-bounds read in pf_cpm_c_data_ind()
CVE-2026-1117347.1 HighMissing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()
CVE-2026-1117338.7 HighNULL pointer dereference on implicit read of AR specific record index
CVE-2026-1117329.3 CriticalOut-of-bounds write when parsing AR Vendor Block requests
CVE-2026-1117318.7 HighInfinite loop when reading PDPortDataCheck record of subslot 0
CVE-2026-1117307.2 HighOut-of-bounds write in CheckPeers block parser due to unvalidated peer station name length
CVE-2026-1122569.2 CriticalLogon bypass (trust of attacker-controlled completed-methods list)
CVE-2026-1122552.9 LowEndpoint credential minting (insecure default allow-list)
CVE-2026-1180846.5 MediumWordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability
CVE-2026-1180837.5 HighWordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability
CVE-2026-1180828.8 HighWordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability
CVE-2026-1180818.8 HighWordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability
CVE-2026-1180808.8 HighWordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability
CVE-2026-1180797.2 HighWordPress FV Flowplayer Video Player plugin <= 8.3.4 - PHP Object Injection vulnerability
CVE-2026-1180787.2 HighWordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability
CVE-2026-1180777.2 HighWordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability
CVE-2026-1180768.8 HighWordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability
CVE-2026-1180758.8 HighWordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.