Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,724 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-77156 | 6.3 Medium | ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory | Oct 22, 2026 |
| CVE-2026-108357 | 8.8 High | PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service | Oct 22, 2026 |
| CVE-2026-13599 | 5.8 Medium | ABB Ability Edgenius | Missing Authentication in Edgenius AuthDB | Oct 22, 2026 |
| CVE-2026-114611 | 9.1 Critical | OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack | Oct 22, 2026 |
| CVE-2026-108359 | 8.7 High | PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) | Oct 22, 2026 |
| CVE-2026-93336 | 7.1 High | Missing authorization in the unit resources download route in Juju controllers | Oct 22, 2026 |
| CVE-2026-108358 | 8.8 High | PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service | Oct 22, 2026 |
| CVE-2026-108360 | 6.4 Medium | PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading | Oct 22, 2026 |
| CVE-2026-54238 | 3.1 Low | Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization | Oct 22, 2026 |
| CVE-2026-114610 | 6.5 Medium | fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()' | Oct 22, 2026 |
| CVE-2026-114609 | 5.8 Medium | fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content | Oct 22, 2026 |
| CVE-2026-54532 | 6.9 Medium | CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theft | Oct 22, 2026 |
| CVE-2026-115513 | 6.3 Medium | OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel | Oct 22, 2026 |
| CVE-2026-115416 | 6.3 Medium | Incorrect authorization checks in Amazon Athena engine version 3 query processing | Oct 22, 2026 |
| CVE-2026-114608 | 5.4 Medium | Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME | Oct 22, 2026 |
| CVE-2026-114607 | 9.1 Critical | better-auth: OAuth state can be used as a Magic Link to sign in as another user | Oct 22, 2026 |
| CVE-2026-114606 | 5.6 Medium | draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate) | Oct 22, 2026 |
| CVE-2026-97631 | 9.5 Critical | Pre-boot RCE in EDK II PXE driver | Oct 22, 2026 |
| CVE-2026-115502 | 6.3 Medium | DataApp links without login expose job information to other user in KNIME Business Hub | Oct 22, 2026 |
| CVE-2026-104068 | 8.6 High | JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore | Oct 22, 2026 |
| CVE-2026-114605 | 7.5 High | dnspython dns.name.from_wire_parser() excessive CPU use | Oct 22, 2026 |
| CVE-2026-75507 | 7.5 High | GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule | Oct 22, 2026 |
| CVE-2026-75508 | 7.5 High | GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit | Oct 22, 2026 |
| CVE-2026-115496 | 6.9 Medium | Workflow names may be leaked to unauthenticated users in KNIME Business Hub | Oct 22, 2026 |
| CVE-2026-114487 | 4.3 Medium | Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers… | Oct 22, 2026 |
| CVE-2026-115494 | 5.3 Medium | CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub | Oct 22, 2026 |
| CVE-2026-114486 | 4.3 Medium | Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied… | Oct 22, 2026 |
| CVE-2026-114485 | 4.3 Medium | Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the… | Oct 22, 2026 |
| CVE-2026-114603 | 5.3 Medium | OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api | Oct 22, 2026 |
| CVE-2026-115454 | 5.3 Medium | Large tables in data apps can bring down execution services in KNIME Hub | Oct 22, 2026 |
| CVE-2026-94482 | 8.2 High | Next.js: Denial of Service in App Router using Server Actions | Oct 22, 2026 |
| CVE-2026-115453 | 7.1 High | Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries | Oct 22, 2026 |
| CVE-2026-115450 | 7.1 High | Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier | Oct 22, 2026 |
| CVE-2026-115482 | 7.5 High | In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry… | Oct 22, 2026 |
| CVE-2026-114515 | 6.5 Medium | OCO-Server: Self-Service Portal uninstall-job authorization bypass | Oct 22, 2026 |
| CVE-2026-61791 | 7.4 High | OCO-Server: Stored XSS through agent hostnames in command buttons | Oct 22, 2026 |
| CVE-2026-16477 | 8.4 High | Insecure Deserialization of .cleanshot Files in CleanShot X | Oct 22, 2026 |
| CVE-2026-114510 | 7.1 High | Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content | Oct 22, 2026 |
| CVE-2026-111181 | 7.5 High | body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body | Oct 22, 2026 |
| CVE-2026-113872 | 7.5 High | multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown | Oct 22, 2026 |
| CVE-2026-89410 | 5.1 Medium | Out-of-bounds read in Z-Wave NCP SPI Handler | Oct 22, 2026 |
| CVE-2026-89409 | 5.3 Medium | Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes | Oct 22, 2026 |
| CVE-2026-85079 | 7.5 High | Out-of-bounds write in Zigbee Simple_Desc_req handling | Oct 22, 2026 |
| CVE-2026-94502 | 7.5 High | Out-of-bounds write in Zigbee Publish Price Matrix handling | Oct 22, 2026 |
| CVE-2026-115249 | 5.1 Medium | subhajitkhan online-clinic-management-system Appointment Booking patappointtime.php input validation | Oct 22, 2026 |
| CVE-2026-66282 | 6.0 Medium | Authenticated Denial-of-Service in Zigbee Publish Billing Period | Oct 22, 2026 |
| CVE-2026-66281 | 6.0 Medium | Authenticated Denial-of-Service in Zigbee Discover Attributes Handling | Oct 22, 2026 |
| CVE-2026-85080 | 6.0 Medium | Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling | Oct 22, 2026 |
| CVE-2026-66279 | 7.2 High | Dis-connect vulnerability in Connect Stack | Oct 22, 2026 |
| CVE-2026-111497 | 9.2 Critical | Out-of-Bounds Write in Google Brotli Decoder | Oct 22, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.