Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,726 vulnerabilities match.

CVESeveritySummary
CVE-2026-662797.2 HighDis-connect vulnerability in Connect Stack
CVE-2026-1114979.2 CriticalOut-of-Bounds Write in Google Brotli Decoder
CVE-2026-927098.1 HighRsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE
CVE-2026-1152485.3 Mediumsubhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow
CVE-2026-1135828.7 HighApache Abdera: XML external entity expansion in Atom document parsing
CVE-2026-1154006.7 Mediumcrawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens
CVE-2026-1154115.3 Mediumcrawlseo before 0.2.4 Server-Side Request Forgery via Crawler
CVE-2026-1152475.3 Mediumsubhajitkhan online-clinic-management-system patientregistration.php missing encryption
CVE-2026-1152465.1 Mediumsubhajitkhan online-clinic-management-system patdocmsg.php cross site scripting
CVE-2026-10278510.0 CriticalJoomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52
CVE-2026-1128329.8 CriticalWordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability
CVE-2026-1128426.5 MediumWordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability
CVE-2026-1128228.5 HighWordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability
CVE-2026-1153347.6 HighLotus through 0.10.2 Authorization Bypass via switch_organization Endpoint
CVE-2026-1153338.2 HighLotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix
CVE-2026-1153328.7 HighLotus through 0.10.2 SQL Injection via Subscription Filter Keys
CVE-2026-1153318.7 HighLotus through 0.10.2 SQL Injection via Metric Property Names and Filters
CVE-2026-1153308.7 HighLotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics
CVE-2026-1153296.0 MediumLotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet
CVE-2026-1153288.7 HighJSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API
CVE-2026-1153276.0 Mediumlibyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser
CVE-2026-1153265.3 MediumQloApps through 1.7.0 IDOR via OrderDetailController Refund Request
CVE-2026-1153258.7 HighNetmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup
CVE-2026-1153249.2 Criticalmem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store
CVE-2026-1153236.9 MediumEverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
CVE-2026-1153225.3 MediumBytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers
CVE-2026-1153215.3 MediumBytebase before 3.16.0 Authorization Bypass via UpdateIssueComment
CVE-2026-1153192.0 Lowfzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents
CVE-2026-1146657.1 HighGoploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare
CVE-2025-714348.8 HighWeaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list
CVE-2024-583968.7 HighYouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId
CVE-2024-583945.1 MediumRetool < 3.88.0 XSS via /api/imageProxy SVG Proxying
CVE-2024-583938.8 Highi-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php
CVE-2023-544135.1 MediumWPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang
CVE-2022-510257.1 HighPenta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer
CVE-2022-510248.7 HighKavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint
CVE-2022-510238.8 HighPHPOK < 5.4.081 SQL Injection via api.php sort Parameter
CVE-2022-510228.8 HighYiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint
CVE-2022-510218.8 HighNotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint
CVE-2021-480178.7 HighOrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi
CVE-2021-480169.3 CriticalDedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php
CVE-2021-480158.7 HighJeeWMS Path Traversal via showOrDownByurl.do
CVE-2021-480149.3 CriticalFineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer
CVE-2021-480138.7 HighWeaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload
CVE-2020-372845.1 MediumSickbeard build-507 Reflected XSS via testNaming pattern Parameter
CVE-2019-257798.7 HighWooThemes Diarise 1.5.9 Local File Disclosure via download.php
CVE-2019-257788.8 HighSeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter
CVE-2018-254398.7 HighMetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter
CVE-2018-254388.7 HighIntermesh Group-Office < 3.5.5 Path Traversal via compress.php
CVE-2017-202905.1 MediumDiscourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.