Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,723 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-115504 | 8.5 High | CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c | Oct 22, 2026 |
| CVE-2026-115503 | 6.8 Medium | Ghidra before 12.2 Denial of Service via Compressed Extension Archive | Oct 22, 2026 |
| CVE-2026-115398 | 6.8 Medium | Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount | Oct 22, 2026 |
| CVE-2026-115397 | 6.8 Medium | Ghidra before 12.2 Denial of Service via Extension Archive Install | Oct 22, 2026 |
| CVE-2026-115396 | 6.8 Medium | Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive | Oct 22, 2026 |
| CVE-2026-115395 | 6.8 Medium | Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme() | Oct 22, 2026 |
| CVE-2026-114655 | 6.0 Medium | KMS request injection via unsanitized key vault and provider values in libmongocrypt | Oct 22, 2026 |
| CVE-2026-115394 | 6.8 Medium | Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation | Oct 22, 2026 |
| CVE-2026-114654 | 6.9 Medium | BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards | Oct 22, 2026 |
| CVE-2026-115393 | 1.0 Low | Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion | Oct 22, 2026 |
| CVE-2026-115392 | 8.8 High | Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes | Oct 22, 2026 |
| CVE-2026-114653 | 7.1 High | Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder | Oct 22, 2026 |
| CVE-2026-115391 | 6.9 Medium | Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams | Oct 22, 2026 |
| CVE-2026-114652 | 7.1 High | Update operator injection via single-element list rewriting in the update builder | Oct 22, 2026 |
| CVE-2026-114651 | 6.3 Medium | Cross-document data leak via malformed BSON array parsing in reused thread buffer | Oct 22, 2026 |
| CVE-2026-115390 | 6.9 Medium | Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS | Oct 22, 2026 |
| CVE-2026-115389 | 1.0 Low | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API | Oct 22, 2026 |
| CVE-2026-114650 | 6.9 Medium | Plaintext exposure of encrypted fields via ANSI code-page corruption of database name | Oct 22, 2026 |
| CVE-2026-115388 | 6.9 Medium | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write | Oct 22, 2026 |
| CVE-2026-114649 | 7.6 High | Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache | Oct 22, 2026 |
| CVE-2026-115387 | 6.9 Medium | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow | Oct 22, 2026 |
| CVE-2026-114648 | 7.2 High | NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys | Oct 22, 2026 |
| CVE-2026-115386 | 2.1 Low | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir | Oct 22, 2026 |
| CVE-2026-115385 | 6.9 Medium | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps | Oct 22, 2026 |
| CVE-2026-114647 | 5.3 Medium | NoSQL operator injection via unvalidated replacement document in findOneAndReplace | Oct 22, 2026 |
| CVE-2026-115384 | 9.4 Critical | Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow | Oct 22, 2026 |
| CVE-2026-114646 | 6.9 Medium | NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire | Oct 22, 2026 |
| CVE-2026-115383 | 5.9 Medium | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports | Oct 22, 2026 |
| CVE-2026-115382 | 5.9 Medium | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS | Oct 22, 2026 |
| CVE-2026-114645 | 5.7 Medium | Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping | Oct 22, 2026 |
| CVE-2026-115381 | 5.9 Medium | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes | Oct 22, 2026 |
| CVE-2026-114644 | 8.2 High | Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization | Oct 22, 2026 |
| CVE-2026-115380 | 5.1 Medium | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff | Oct 22, 2026 |
| CVE-2026-114643 | 5.3 Medium | Duplicate geometry fields via unvalidated GeoJSON extra members | Oct 22, 2026 |
| CVE-2026-115379 | 6.9 Medium | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call | Oct 22, 2026 |
| CVE-2026-115378 | 6.9 Medium | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull | Oct 22, 2026 |
| CVE-2026-115377 | 9.4 Critical | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream | Oct 22, 2026 |
| CVE-2026-115376 | 8.3 High | Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy | Oct 22, 2026 |
| CVE-2026-115375 | 9.4 Critical | Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes | Oct 22, 2026 |
| CVE-2026-115374 | 7.1 High | Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs | Oct 22, 2026 |
| CVE-2026-115373 | 7.0 High | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid} | Oct 22, 2026 |
| CVE-2026-115372 | 9.0 Critical | Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options | Oct 22, 2026 |
| CVE-2026-115371 | 7.1 High | LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints | Oct 22, 2026 |
| CVE-2026-115370 | 5.3 Medium | Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh | Oct 22, 2026 |
| CVE-2026-115369 | 2.1 Low | OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs | Oct 22, 2026 |
| CVE-2026-115366 | 2.0 Low | OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs | Oct 22, 2026 |
| CVE-2026-115365 | 7.5 High | OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal | Oct 22, 2026 |
| CVE-2026-115364 | 2.1 Low | OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints | Oct 22, 2026 |
| CVE-2026-115363 | 2.1 Low | OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration | Oct 22, 2026 |
| CVE-2026-115362 | 2.1 Low | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass | Oct 22, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.