Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,726 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-114460 | 5.3 Medium | Mod_qos: query truncation during json body merging permits security-rule bypass | Oct 22, 2026 |
| CVE-2026-114459 | 3.7 Low | Mod_qos: out-of-bounds reads in response-body substring matching | Oct 22, 2026 |
| CVE-2026-114458 | 5.9 Medium | Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow | Oct 22, 2026 |
| CVE-2026-114457 | 3.7 Low | Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads | Oct 22, 2026 |
| CVE-2026-97328 | 7.5 High | WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser | Oct 22, 2026 |
| CVE-2026-88849 | 2.7 Low | MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment | Oct 22, 2026 |
| CVE-2026-78392 | 6.8 Medium | Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter | Oct 22, 2026 |
| CVE-2026-111972 | 4.9 Medium | Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR | Oct 22, 2026 |
| CVE-2026-111971 | 6.8 Medium | Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name | Oct 22, 2026 |
| CVE-2026-111958 | 7.5 High | Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token | Oct 22, 2026 |
| CVE-2026-110011 | 2.7 Low | MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure via Export | Oct 22, 2026 |
| CVE-2026-110010 | 4.8 Medium | MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' Parameter | Oct 22, 2026 |
| CVE-2026-109987 | 7.2 High | PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie | Oct 22, 2026 |
| CVE-2026-109931 | 3.7 Low | Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update | Oct 22, 2026 |
| CVE-2026-109927 | 7.2 High | CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role | Oct 22, 2026 |
| CVE-2026-103234 | 4.8 Medium | WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email | Oct 22, 2026 |
| CVE-2026-100142 | 5.3 Medium | FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR | Oct 22, 2026 |
| CVE-2026-114570 | 4.9 Medium | WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit | Oct 22, 2026 |
| CVE-2026-114223 | 6.7 Medium | NewType Infortech｜NT OneAPP - Exposure of Sensitive Information | Oct 22, 2026 |
| CVE-2026-114222 | 6.9 Medium | NewType Infortech｜NT OneAPP - Authentication Bypass | Oct 22, 2026 |
| CVE-2026-114221 | 5.9 Medium | NewType Infortech｜NT OneAPP - Credential Disclosure | Oct 22, 2026 |
| CVE-2026-114220 | 9.3 Critical | NewType Infortech｜NT OneAPP - Improper Certificate Validation | Oct 22, 2026 |
| CVE-2026-114219 | 9.1 Critical | NewType Infortech｜NT OneAPP - Hard-coded Credentials | Oct 22, 2026 |
| CVE-2026-110353 | 7.5 High | HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the… | Oct 22, 2026 |
| CVE-2026-110354 | 7.5 High | HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the… | Oct 22, 2026 |
| CVE-2026-114732 | 6.8 Medium | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity… | Oct 22, 2026 |
| CVE-2026-114731 | 5.3 Medium | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit… | Oct 22, 2026 |
| CVE-2026-114730 | 7.2 High | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC… | Oct 22, 2026 |
| CVE-2026-114729 | 5.3 Medium | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML… | Oct 22, 2026 |
| CVE-2026-114728 | 5.3 Medium | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its… | Oct 22, 2026 |
| CVE-2026-114577 | 6.9 Medium | oretnom23 php-travel-agency-system Insertion insert.php sql injection | Oct 22, 2026 |
| CVE-2026-114727 | 8.3 High | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can… | Oct 22, 2026 |
| CVE-2026-114726 | 5.8 Medium | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so… | Oct 22, 2026 |
| CVE-2026-114725 | 5.0 Medium | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from… | Oct 22, 2026 |
| CVE-2026-114724 | 7.4 High | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was… | Oct 22, 2026 |
| CVE-2026-114723 | 3.7 Low | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on… | Oct 22, 2026 |
| CVE-2026-114664 | 7.1 High | Frappe before 16.33.0 Blind SQL Injection via get_events | Oct 22, 2026 |
| CVE-2026-114663 | 8.6 High | Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments | Oct 22, 2026 |
| CVE-2026-114662 | 8.6 High | Obot before 0.26.0 API Key Theft via CLI Login Token Request | Oct 22, 2026 |
| CVE-2026-114661 | 9.0 Critical | OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints | Oct 22, 2026 |
| CVE-2026-114660 | 7.0 High | Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives | Oct 22, 2026 |
| CVE-2026-114659 | 7.1 High | Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes | Oct 22, 2026 |
| CVE-2026-114658 | 8.7 High | Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite | Oct 22, 2026 |
| CVE-2026-114657 | 6.9 Medium | Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri | Oct 22, 2026 |
| CVE-2026-114656 | 6.9 Medium | Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher | Oct 22, 2026 |
| CVE-2026-114642 | 7.0 High | Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper | Oct 22, 2026 |
| CVE-2026-114641 | 6.3 Medium | Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper | Oct 22, 2026 |
| CVE-2026-114640 | 7.0 High | Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router | Oct 22, 2026 |
| CVE-2026-114639 | 7.0 High | Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool | Oct 22, 2026 |
| CVE-2026-114638 | 7.0 High | Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision | Oct 22, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.