Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,711 vulnerabilities match.

CVESeveritySummary
CVE-2026-1108258.7 HighKiloview E3 NDI Encoder Missing Authentication for Critical Function
CVE-2026-924508.7 HighKiloview E3 NDI Encoder Use of Hard-coded Credentials
CVE-2026-1102439.4 CriticalKiloview E3 NDI Encoder OS Command Injection
CVE-2026-1078619.4 CriticalKiloview E3 NDI Encoder OS Command Injection
CVE-2026-1104916.9 MediumKiloview E3 NDI Encoder NULL Pointer Dereference
CVE-2026-1052656.0 MediumKiloview E3 NDI Encoder Path Traversal
CVE-2026-966168.3 HighKiloview E3 NDI Encoder Insufficient Session Expiration
CVE-2026-1111006.9 MediumKiloview E3 NDI Encoder Missing Authentication for Critical Function
CVE-2026-1091229.4 CriticalKiloview E3 NDI Encoder OS Command Injection
CVE-2026-11006310.0 CriticalVM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability
CVE-2026-8393810.0 CriticalAzure Kubernetes Configuration Service Elevation of Privilege Vulnerability
CVE-2026-961857.5 HighMicrosoft Exchange Online Remote Code Execution Vulnerability
CVE-2026-9778510.0 CriticalAAD App Proxy Elevation of Privilege Vulnerability
CVE-2026-1084567.7 HighAzure AI Foundry Elevation of Privilege Vulnerability
CVE-2026-1050149.1 CriticalAzure Pipelines Remote Code Execution Vulnerability
CVE-2026-1115949.2 CriticalInterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information
CVE-2026-1146205.4 MediumAuthlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
CVE-2026-1146194.6 MediumAuthlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
CVE-2026-1146186.8 MediumAuthlib: Default JWT bearer grant accepts assertions for the wrong audience
CVE-2026-1146174.2 MediumAuthlib: ID token can disable its own nonce validation via the nonce_supported claim
CVE-2026-1154493.5 LowLibslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest
CVE-2026-1146167.4 HighAuthlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
CVE-2026-1152215.4 MediumIpa: freeipa: freeipa uses subject cn as proof of certificate ownership
CVE-2026-1154245.5 MediumOc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination
CVE-2026-1146157.4 HighAuthlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
CVE-2026-1146142.6 LowAuthlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
CVE-2026-1145836.9 Mediumtar filter allows writing outside destination via empty-named symlink
CVE-2026-1146259.4 CriticalSecurity Advisory 0199
CVE-2026-1154178.2 HighMemory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
CVE-2026-1154198.6 HighUnintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
CVE-2026-1123328.7 HighMotor.NET < 0.19.0 Denial of Service via JsonNet Deserialization
CVE-2026-1123318.7 HighMotor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping
CVE-2026-1123308.7 HighMotor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers
CVE-2026-1155092.3 LowJitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API
CVE-2026-1155087.1 HighCrawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields
CVE-2026-1155075.1 MediumVikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header
CVE-2026-1155068.7 Highlibexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay
CVE-2026-1155057.2 Highlibsmb2 before 6.3 Integer Overflow in DCE/RPC NDR Decoder via NetrShareEnum
CVE-2026-1155048.5 HighCFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c
CVE-2026-1155036.8 MediumGhidra before 12.2 Denial of Service via Compressed Extension Archive
CVE-2026-1153986.8 MediumGhidra before 12.2 Denial of Service via TAR and ZIP File System Mount
CVE-2026-1153976.8 MediumGhidra before 12.2 Denial of Service via Extension Archive Install
CVE-2026-1153966.8 MediumGhidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive
CVE-2026-1153956.8 MediumGhidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()
CVE-2026-1146556.0 MediumKMS request injection via unsanitized key vault and provider values in libmongocrypt
CVE-2026-1153946.8 MediumGhidra through 12.2 Denial of Service via BinaryField Memory Allocation
CVE-2026-1146546.9 MediumBSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
CVE-2026-1153931.0 LowWasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion
CVE-2026-1153928.8 HighWasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes
CVE-2026-1146537.1 HighSilent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.