Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,740 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-105927 | 2.3 Low | Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission | Oct 21, 2026 |
| CVE-2026-114265 | 5.3 Medium | ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection | Oct 21, 2026 |
| CVE-2026-114176 | 4.3 Medium | WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability | Oct 21, 2026 |
| CVE-2026-105926 | 5.3 Medium | Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands | Oct 21, 2026 |
| CVE-2026-105869 | 9.2 Critical | Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role | Oct 21, 2026 |
| CVE-2026-114493 | 9.2 Critical | LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects | Oct 21, 2026 |
| CVE-2026-114492 | 7.0 High | gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint | Oct 21, 2026 |
| CVE-2026-114491 | 6.9 Medium | pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images | Oct 21, 2026 |
| CVE-2026-110744 | 7.2 High | Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide | Oct 21, 2026 |
| CVE-2026-114133 | 5.4 Medium | Nuxt server islands render `useHeadSafe` input without sanitisation | Oct 21, 2026 |
| CVE-2026-114132 | 6.3 Medium | Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive | Oct 21, 2026 |
| CVE-2026-114264 | 5.1 Medium | ProjectWorlds Advanced Library Management System edit_member.php sql injection | Oct 21, 2026 |
| CVE-2026-114131 | 6.5 Medium | Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes | Oct 21, 2026 |
| CVE-2026-114130 | 2.3 Low | Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled | Oct 21, 2026 |
| CVE-2026-114129 | 6.2 Medium | stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service | Oct 21, 2026 |
| CVE-2026-114128 | 6.5 Medium | Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering | Oct 21, 2026 |
| CVE-2026-114263 | 6.9 Medium | ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injection | Oct 21, 2026 |
| CVE-2026-114127 | 2.3 Low | Astro: Arbitrary CSS injection in Astro View Transitions | Oct 21, 2026 |
| CVE-2026-114126 | 8.7 High | Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files | Oct 21, 2026 |
| CVE-2026-92202 | 7.8 High | Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability | Oct 21, 2026 |
| CVE-2026-92183 | 7.8 High | GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability | Oct 21, 2026 |
| CVE-2026-92207 | 8.8 High | MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability | Oct 21, 2026 |
| CVE-2026-92206 | 8.8 High | CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability | Oct 21, 2026 |
| CVE-2026-92205 | 6.1 Medium | BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability | Oct 21, 2026 |
| CVE-2026-92204 | 7.7 High | Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability | Oct 21, 2026 |
| CVE-2026-92203 | 7.7 High | Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability | Oct 21, 2026 |
| CVE-2026-89035 | 9.1 Critical | MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass | Oct 21, 2026 |
| CVE-2026-92210 | 7.2 High | NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability | Oct 21, 2026 |
| CVE-2026-92209 | 7.8 High | NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability | Oct 21, 2026 |
| CVE-2026-92208 | 8.8 High | NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability | Oct 21, 2026 |
| CVE-2026-111184 | 7.8 High | NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability | Oct 21, 2026 |
| CVE-2026-111183 | 9.8 Critical | GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability | Oct 21, 2026 |
| CVE-2026-114262 | 6.9 Medium | file-management-system FileController.php store unrestricted upload | Oct 21, 2026 |
| CVE-2026-114125 | 8.6 High | Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites | Oct 21, 2026 |
| CVE-2026-114124 | 3.9 Low | Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry | Oct 21, 2026 |
| CVE-2026-114261 | 6.9 Medium | MomoTommy file-management-system Files API FileController.php destroy missing authentication | Oct 21, 2026 |
| CVE-2026-53986 | 6.9 Medium | Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure | Oct 21, 2026 |
| CVE-2026-114123 | 7.5 High | D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet | Oct 21, 2026 |
| CVE-2026-114260 | 6.9 Medium | oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication | Oct 21, 2026 |
| CVE-2026-114259 | 6.9 Medium | oretnom23 file-management-system-php admin_class.php save_files unrestricted upload | Oct 21, 2026 |
| CVE-2026-114122 | 3.9 Low | Electron: Frame subscription trusts GPU-supplied frame geometry | Oct 21, 2026 |
| CVE-2026-114121 | 5.4 Medium | Electron: openExternal permission requests can be attributed to the wrong origin | Oct 21, 2026 |
| CVE-2026-76497 | 6.6 Medium | Cisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File Vulnerabilities | Oct 21, 2026 |
| CVE-2026-76505 | 7.5 High | Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability | Oct 21, 2026 |
| CVE-2026-76524 | 7.8 High | Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability | Oct 21, 2026 |
| CVE-2026-76496 | 7.0 High | Cisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolution Vulnerabilities | Oct 21, 2026 |
| CVE-2026-76495 | 7.8 High | Cisco Expressway Series Software Hardening Release: October 2026 - Incorrect Permission Assignment Vulnerabilities | Oct 21, 2026 |
| CVE-2026-76494 | 7.8 High | Cisco Expressway Series Software Hardening Release: October 2026 - Code Injection Vulnerabilities | Oct 21, 2026 |
| CVE-2026-76493 | 7.5 High | Cisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception Vulnerabilities | Oct 21, 2026 |
| CVE-2026-76490 | 8.6 High | Cisco Expressway Series Software Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities | Oct 21, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.