Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,728 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-96361 | 4.6 Medium | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155 | Oct 22, 2026 |
| CVE-2026-96358 | 4.6 Medium | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158 | Oct 22, 2026 |
| CVE-2026-96359 | 4.6 Medium | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159 | Oct 22, 2026 |
| CVE-2026-96362 | 4.2 Medium | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160 | Oct 22, 2026 |
| CVE-2026-96363 | 3.1 Low | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161 | Oct 22, 2026 |
| CVE-2026-96367 | 4.6 Medium | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162 | Oct 22, 2026 |
| CVE-2026-96368 | 4.6 Medium | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163 | Oct 22, 2026 |
| CVE-2026-96370 | 5.4 Medium | Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164 | Oct 22, 2026 |
| CVE-2026-96369 | 3.1 Low | Webform - Less critical - Access bypass - SA-CONTRIB-2026-165 | Oct 22, 2026 |
| CVE-2026-96371 | 5.4 Medium | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166 | Oct 22, 2026 |
| CVE-2026-96372 | 5.4 Medium | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167 | Oct 22, 2026 |
| CVE-2026-96373 | 3.3 Low | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168 | Oct 22, 2026 |
| CVE-2026-96366 | 5.3 Medium | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169 | Oct 22, 2026 |
| CVE-2026-96365 | 7.5 High | Webform - Less critical - Denial of service - SA-CONTRIB-2026-170 | Oct 22, 2026 |
| CVE-2026-96364 | 5.3 Medium | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171 | Oct 22, 2026 |
| CVE-2026-96357 | 4.6 Medium | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172 | Oct 22, 2026 |
| CVE-2026-96398 | 4.3 Medium | Webform - Less critical - Access bypass - SA-CONTRIB-2026-173 | Oct 22, 2026 |
| CVE-2026-96356 | 5.3 Medium | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174 | Oct 22, 2026 |
| CVE-2026-96355 | 9.1 Critical | Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175 | Oct 22, 2026 |
| CVE-2026-96375 | 4.8 Medium | Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176 | Oct 22, 2026 |
| CVE-2026-96376 | 6.4 Medium | Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177 | Oct 22, 2026 |
| CVE-2026-96374 | 4.2 Medium | Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178 | Oct 22, 2026 |
| CVE-2026-96378 | 4.3 Medium | Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179 | Oct 22, 2026 |
| CVE-2026-96384 | 3.5 Low | Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180 | Oct 22, 2026 |
| CVE-2026-96379 | 3.5 Low | CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181 | Oct 22, 2026 |
| CVE-2026-96385 | 6.5 Medium | REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182 | Oct 22, 2026 |
| CVE-2026-96387 | 3.8 Low | Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183 | Oct 22, 2026 |
| CVE-2026-96388 | 5.4 Medium | Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184 | Oct 22, 2026 |
| CVE-2026-96390 | 4.3 Medium | Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185 | Oct 22, 2026 |
| CVE-2026-96391 | 4.3 Medium | Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186 | Oct 22, 2026 |
| CVE-2026-96392 | 3.5 Low | AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187 | Oct 22, 2026 |
| CVE-2026-96377 | 5.3 Medium | Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188 | Oct 22, 2026 |
| CVE-2026-96380 | 6.5 Medium | CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189 | Oct 22, 2026 |
| CVE-2026-96386 | 6.5 Medium | Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190 | Oct 22, 2026 |
| CVE-2026-96382 | 4.6 Medium | Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191 | Oct 22, 2026 |
| CVE-2026-114717 | 4.0 Medium | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment… | Oct 22, 2026 |
| CVE-2026-114716 | 8.5 High | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a… | Oct 22, 2026 |
| CVE-2026-114715 | 6.8 Medium | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the… | Oct 22, 2026 |
| CVE-2026-114714 | 5.3 Medium | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path… | Oct 22, 2026 |
| CVE-2026-114575 | 10.0 Critical | TOTOLINK A950RG product.so UploadCustomModule command injection | Oct 22, 2026 |
| CVE-2026-110264 | 10.0 Critical | Integer Overflow or Wraparound in GitLab | Oct 22, 2026 |
| CVE-2026-78846 | 9.8 Critical | Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing. | Oct 22, 2026 |
| CVE-2026-78801 | 4.3 Medium | An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive information via the hidden_factory_switch.gch | Oct 22, 2026 |
| CVE-2026-51954 | Not scored | An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri. | Oct 22, 2026 |
| CVE-2026-107079 | Not scored | An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcode_auth.html component | Oct 22, 2026 |
| CVE-2025-69723 | 6.1 Medium | A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL. | Oct 22, 2026 |
| CVE-2025-65200 | 9.6 Critical | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the _localstack/cloudformation/deploy endpoint,… | Oct 22, 2026 |
| CVE-2026-114574 | 5.3 Medium | massCodeIO massCode Local HTTP Service index.ts information disclosure | Oct 21, 2026 |
| CVE-2026-12664 | 6.8 Medium | Incorrect Authorization in GitLab | Oct 21, 2026 |
| CVE-2026-13319 | 4.3 Medium | Authorization Bypass Through User-Controlled Key in GitLab | Oct 21, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.