Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,727 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-114638 | 7.0 High | Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision | Oct 22, 2026 |
| CVE-2026-114637 | 7.0 High | Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak | Oct 22, 2026 |
| CVE-2026-114636 | 7.0 High | Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router | Oct 22, 2026 |
| CVE-2026-114635 | 7.0 High | Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme | Oct 22, 2026 |
| CVE-2026-114634 | 5.3 Medium | WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect | Oct 22, 2026 |
| CVE-2026-114633 | 7.0 High | WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php | Oct 22, 2026 |
| CVE-2026-114722 | 6.5 Medium | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle… | Oct 22, 2026 |
| CVE-2026-114721 | 3.1 Low | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed… | Oct 22, 2026 |
| CVE-2026-114720 | 7.1 High | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to… | Oct 22, 2026 |
| CVE-2026-114576 | 6.3 Medium | Linksys RE6250 Web Management strcmp random values | Oct 22, 2026 |
| CVE-2026-114719 | 3.7 Low | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids()… | Oct 22, 2026 |
| CVE-2026-114718 | 4.7 Medium | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without… | Oct 22, 2026 |
| CVE-2026-84910 | 4.2 Medium | Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118 | Oct 22, 2026 |
| CVE-2026-84911 | 3.1 Low | AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119 | Oct 22, 2026 |
| CVE-2026-84912 | 4.6 Medium | AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120 | Oct 22, 2026 |
| CVE-2026-84913 | 4.6 Medium | AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121 | Oct 22, 2026 |
| CVE-2026-84914 | 5.3 Medium | Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122 | Oct 22, 2026 |
| CVE-2026-84915 | 4.6 Medium | Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123 | Oct 22, 2026 |
| CVE-2026-84923 | 6.5 Medium | Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124 | Oct 22, 2026 |
| CVE-2026-84924 | 5.4 Medium | Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125 | Oct 22, 2026 |
| CVE-2026-84916 | 3.7 Low | Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126 | Oct 22, 2026 |
| CVE-2026-84917 | 6.5 Medium | Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127 | Oct 22, 2026 |
| CVE-2026-16648 | 3.8 Low | Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128 | Oct 22, 2026 |
| CVE-2026-81163 | 5.4 Medium | Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129 | Oct 22, 2026 |
| CVE-2026-84918 | 3.7 Low | Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130 | Oct 22, 2026 |
| CVE-2026-84919 | 4.6 Medium | PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131 | Oct 22, 2026 |
| CVE-2026-84920 | 5.3 Medium | Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132 | Oct 22, 2026 |
| CVE-2026-84921 | 5.3 Medium | Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133 | Oct 22, 2026 |
| CVE-2026-87936 | 6.5 Medium | amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134 | Oct 22, 2026 |
| CVE-2026-87937 | 6.5 Medium | Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135 | Oct 22, 2026 |
| CVE-2026-87938 | 6.5 Medium | CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136 | Oct 22, 2026 |
| CVE-2026-87939 | 4.2 Medium | Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137 | Oct 22, 2026 |
| CVE-2026-87940 | 5.4 Medium | Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138 | Oct 22, 2026 |
| CVE-2026-87941 | 5.9 Medium | Patreon - Critical - Unsupported - SA-CONTRIB-2026-139 | Oct 22, 2026 |
| CVE-2026-87942 | 4.6 Medium | SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140 | Oct 22, 2026 |
| CVE-2026-87943 | 6.5 Medium | SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141 | Oct 22, 2026 |
| CVE-2026-87944 | 4.8 Medium | SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142 | Oct 22, 2026 |
| CVE-2026-87945 | 5.4 Medium | SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143 | Oct 22, 2026 |
| CVE-2026-87946 | 4.8 Medium | SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144 | Oct 22, 2026 |
| CVE-2026-87947 | 4.8 Medium | SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145 | Oct 22, 2026 |
| CVE-2026-87948 | 3.5 Low | SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146 | Oct 22, 2026 |
| CVE-2026-87949 | 3.3 Low | SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147 | Oct 22, 2026 |
| CVE-2026-87950 | 5.3 Medium | SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148 | Oct 22, 2026 |
| CVE-2026-87951 | 3.8 Low | SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149 | Oct 22, 2026 |
| CVE-2026-87952 | 3.1 Low | SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150 | Oct 22, 2026 |
| CVE-2026-87953 | 3.3 Low | SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151 | Oct 22, 2026 |
| CVE-2026-87954 | 4.3 Medium | Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152 | Oct 22, 2026 |
| CVE-2026-87955 | 4.3 Medium | Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153 | Oct 22, 2026 |
| CVE-2026-96360 | 3.5 Low | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154 | Oct 22, 2026 |
| CVE-2026-96361 | 4.6 Medium | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155 | Oct 22, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.