Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,738 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-110264 | 10.0 Critical | Integer Overflow or Wraparound in GitLab | Oct 22, 2026 |
| CVE-2026-78846 | 9.8 Critical | Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing. | Oct 22, 2026 |
| CVE-2026-78801 | 4.3 Medium | An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive information via the hidden_factory_switch.gch | Oct 22, 2026 |
| CVE-2026-51954 | Not scored | An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri. | Oct 22, 2026 |
| CVE-2026-107079 | Not scored | An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcode_auth.html component | Oct 22, 2026 |
| CVE-2025-69723 | 6.1 Medium | A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL. | Oct 22, 2026 |
| CVE-2025-65200 | 9.6 Critical | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the _localstack/cloudformation/deploy endpoint,… | Oct 22, 2026 |
| CVE-2026-114574 | 5.3 Medium | massCodeIO massCode Local HTTP Service index.ts information disclosure | Oct 21, 2026 |
| CVE-2026-12664 | 6.8 Medium | Incorrect Authorization in GitLab | Oct 21, 2026 |
| CVE-2026-13319 | 4.3 Medium | Authorization Bypass Through User-Controlled Key in GitLab | Oct 21, 2026 |
| CVE-2026-14288 | 3.1 Low | Use of Incorrectly-Resolved Name or Reference in GitLab | Oct 21, 2026 |
| CVE-2026-15723 | 8.2 High | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab | Oct 21, 2026 |
| CVE-2026-16255 | 5.9 Medium | Incorrect Authorization in GitLab | Oct 21, 2026 |
| CVE-2026-103515 | 2.7 Low | Incorrect Authorization in GitLab | Oct 21, 2026 |
| CVE-2026-105711 | 3.5 Low | Use of Cache Containing Sensitive Information in GitLab | Oct 21, 2026 |
| CVE-2026-105777 | 4.3 Medium | Insertion of Sensitive Information Into Sent Data in GitLab | Oct 21, 2026 |
| CVE-2026-112378 | 4.3 Medium | Use of Less Trusted Source in GitLab | Oct 21, 2026 |
| CVE-2026-112212 | 7.5 High | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab | Oct 21, 2026 |
| CVE-2026-112326 | 3.1 Low | Improper Cleanup on Thrown Exception in GitLab | Oct 21, 2026 |
| CVE-2026-100420 | 6.8 Medium | Information disclosure vulnerability in the cloud-client daemon of Deco BE63 | Oct 21, 2026 |
| CVE-2026-76531 | 9.9 Critical | Files or Directories Accessible to External Parties in Splunk SOAR | Oct 21, 2026 |
| CVE-2026-76530 | 8.8 High | Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOAR | Oct 21, 2026 |
| CVE-2026-76529 | 9.8 Critical | Improper Protection of Alternate Path in Splunk SOAR | Oct 21, 2026 |
| CVE-2026-76528 | Not scored | Protection Mechanism Failure in Splunk SOAR | Oct 21, 2026 |
| CVE-2026-76527 | 9.8 Critical | Improper Check or Handling of Exceptional Conditions in Splunk SOAR | Oct 21, 2026 |
| CVE-2026-76526 | 8.8 High | Improper Neutralization in Splunk SOAR | Oct 21, 2026 |
| CVE-2026-76408 | 9.8 Critical | Improper Control of a Resource Through its Lifetime in Splunk SOAR | Oct 21, 2026 |
| CVE-2026-76407 | Not scored | Improper Access Control in Splunk SOAR | Oct 21, 2026 |
| CVE-2026-76406 | 5.9 Medium | Information Disclosure through REST API Authentication in Splunk SOAR | Oct 21, 2026 |
| CVE-2026-76308 | 6.5 Medium | Missing Authorization through the REST API in Splunk SOAR | Oct 21, 2026 |
| CVE-2026-76307 | 7.2 High | Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR | Oct 21, 2026 |
| CVE-2026-76306 | 7.5 High | Information Disclosure through REST API Query Filters in Splunk SOAR | Oct 21, 2026 |
| CVE-2026-76305 | 6.5 Medium | Improper Access Control during App Downloads in Splunk SOAR | Oct 21, 2026 |
| CVE-2026-76304 | 4.3 Medium | Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR | Oct 21, 2026 |
| CVE-2026-76303 | 5.7 Medium | Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR | Oct 21, 2026 |
| CVE-2026-76302 | 9.9 Critical | Security Hardening in Splunk Enterprise - October 2026 | Oct 21, 2026 |
| CVE-2026-76301 | 9.8 Critical | Security Hardening in Splunk Enterprise - October 2026 | Oct 21, 2026 |
| CVE-2026-76300 | 8.8 High | Security Hardening in Splunk Enterprise - October 2026 | Oct 21, 2026 |
| CVE-2026-76299 | 9.9 Critical | Security Hardening in Splunk Enterprise - October 2026 | Oct 21, 2026 |
| CVE-2026-76298 | 8.8 High | Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise | Oct 21, 2026 |
| CVE-2026-76297 | 4.2 Medium | Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise | Oct 21, 2026 |
| CVE-2026-76296 | 4.3 Medium | Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise | Oct 21, 2026 |
| CVE-2026-76295 | 4.3 Medium | SPL Injection through the REST API in Splunk Secure Gateway | Oct 21, 2026 |
| CVE-2026-76294 | 4.3 Medium | Improper Access Control in Field Extraction Management in Splunk Enterprise | Oct 21, 2026 |
| CVE-2026-76293 | 7.2 High | Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise | Oct 21, 2026 |
| CVE-2026-76292 | 6.5 Medium | Missing Authorization through REST API Endpoints in Splunk Secure Gateway | Oct 21, 2026 |
| CVE-2026-76291 | 8.8 High | Improper Access Control through Scheduled Search Safeguards in Splunk Enterprise | Oct 21, 2026 |
| CVE-2026-76290 | 7.5 High | Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise | Oct 21, 2026 |
| CVE-2026-76289 | 6.5 Medium | Denial of Service (DoS) through the REST API in Splunk Enterprise | Oct 21, 2026 |
| CVE-2026-76288 | 7.5 High | Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise | Oct 21, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.