Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,740 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-85518 | 6.1 Medium | Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition | Oct 21, 2026 |
| CVE-2026-112408 | 9.4 Critical | Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket() | Oct 21, 2026 |
| CVE-2026-114438 | 4.2 Medium | Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering | Oct 21, 2026 |
| CVE-2026-114374 | 5.3 Medium | leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery | Oct 21, 2026 |
| CVE-2026-112381 | 8.2 High | Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response | Oct 21, 2026 |
| CVE-2026-111817 | 6.9 Medium | Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout | Oct 21, 2026 |
| CVE-2026-111812 | 7.0 High | Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials | Oct 21, 2026 |
| CVE-2026-111811 | 9.4 Critical | Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication | Oct 21, 2026 |
| CVE-2026-111809 | 6.9 Medium | Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling | Oct 21, 2026 |
| CVE-2026-114362 | 5.3 Medium | HarnessRouter Targets Test Endpoint app.py server-side request forgery | Oct 21, 2026 |
| CVE-2026-111810 | 8.7 High | Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service | Oct 21, 2026 |
| CVE-2026-111815 | 7.8 High | Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement | Oct 21, 2026 |
| CVE-2026-111814 | 7.8 High | Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin | Oct 21, 2026 |
| CVE-2026-111808 | 7.7 High | Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion | Oct 21, 2026 |
| CVE-2026-111805 | 7.7 High | Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion | Oct 21, 2026 |
| CVE-2026-114361 | 6.3 Medium | HarnessRouter Identity Mode app.py improper authorization | Oct 21, 2026 |
| CVE-2026-114268 | 9.4 Critical | Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow | Oct 21, 2026 |
| CVE-2026-114267 | 6.9 Medium | SourceCodester Food Order Management System Admin Endpoint authorization | Oct 21, 2026 |
| CVE-2026-111816 | 9.2 Critical | Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out | Oct 21, 2026 |
| CVE-2025-55702 | 7.0 High | Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request | Oct 21, 2026 |
| CVE-2026-110803 | 8.7 High | Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8 | Oct 21, 2026 |
| CVE-2026-107588 | 8.4 High | Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts | Oct 21, 2026 |
| CVE-2025-31699 | 9.1 Critical | Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling | Oct 21, 2026 |
| CVE-2026-111804 | 8.8 High | Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs | Oct 21, 2026 |
| CVE-2026-111813 | 10.0 Critical | Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration | Oct 21, 2026 |
| CVE-2026-19947 | 5.3 Medium | Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer | Oct 21, 2026 |
| CVE-2026-79976 | 7.1 High | NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller | Oct 21, 2026 |
| CVE-2026-78119 | 6.3 Medium | Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length | Oct 21, 2026 |
| CVE-2026-78118 | 7.0 High | Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP | Oct 21, 2026 |
| CVE-2026-78117 | 4.2 Medium | Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air | Oct 21, 2026 |
| CVE-2026-18748 | 3.5 Low | Out-of-bounds read in Bluetooth Classic A2DP codec information element handling | Oct 21, 2026 |
| CVE-2026-78116 | 5.2 Medium | Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path | Oct 21, 2026 |
| CVE-2026-19676 | 7.8 High | PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode | Oct 21, 2026 |
| CVE-2026-105945 | 7.7 High | Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage | Oct 21, 2026 |
| CVE-2026-105944 | 10.0 Critical | Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life | Oct 21, 2026 |
| CVE-2026-114266 | 5.3 Medium | ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection | Oct 21, 2026 |
| CVE-2026-105942 | 7.7 High | Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation | Oct 21, 2026 |
| CVE-2026-105938 | 2.3 Low | Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all | Oct 21, 2026 |
| CVE-2026-105937 | 8.7 High | Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data | Oct 21, 2026 |
| CVE-2026-113461 | 5.2 Medium | mk-oracle: Local privilege escalation via insecure Oracle Home library loading | Oct 21, 2026 |
| CVE-2026-105936 | 5.3 Medium | Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint | Oct 21, 2026 |
| CVE-2026-105935 | 4.9 Medium | Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission | Oct 21, 2026 |
| CVE-2026-105934 | 7.2 High | Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic | Oct 21, 2026 |
| CVE-2026-105933 | 2.3 Low | Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization | Oct 21, 2026 |
| CVE-2026-105932 | 2.3 Low | Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints | Oct 21, 2026 |
| CVE-2026-113870 | 8.6 High | Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing | Oct 21, 2026 |
| CVE-2026-111401 | 6.5 Medium | WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability | Oct 21, 2026 |
| CVE-2026-105931 | 2.3 Low | Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants | Oct 21, 2026 |
| CVE-2026-105930 | 6.0 Medium | Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download | Oct 21, 2026 |
| CVE-2026-112868 | 4.3 Medium | WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability | Oct 21, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.