Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,743 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-114479 | 5.8 Medium | Not Failing Securely ('Failing Open') in hMailServer | Oct 21, 2026 |
| CVE-2026-114478 | 5.9 Medium | Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer | Oct 21, 2026 |
| CVE-2026-114477 | 4.3 Medium | Missing Authorization in hMailServer | Oct 21, 2026 |
| CVE-2026-114476 | 7.5 High | Incorrect Authorization in hMailServer | Oct 21, 2026 |
| CVE-2026-114475 | 6.5 Medium | Missing Authorization in hMailServer | Oct 21, 2026 |
| CVE-2026-114474 | 5.9 Medium | Use of Less Trusted Source in hMailServer | Oct 21, 2026 |
| CVE-2026-114473 | 5.0 Medium | Incorrect Authorization in hMailServer | Oct 21, 2026 |
| CVE-2026-114472 | 3.7 Low | Insufficient Resource Pool in hMailServer | Oct 21, 2026 |
| CVE-2026-114471 | 4.7 Medium | Insertion of Sensitive Information into Log File in hMailServer | Oct 21, 2026 |
| CVE-2026-114470 | 5.3 Medium | Cross-Site Request Forgery (CSRF) in hMailServer | Oct 21, 2026 |
| CVE-2026-102486 | 7.5 High | Out-of-bounds Read in ntpsec | Oct 21, 2026 |
| CVE-2026-102485 | 5.2 Medium | Out-of-bounds Read in ntpsec | Oct 21, 2026 |
| CVE-2026-102484 | 6.4 Medium | Heap-based Buffer Overflow in ntpsec | Oct 21, 2026 |
| CVE-2026-102483 | 7.5 High | Reachable Assertion in ntpsec | Oct 21, 2026 |
| CVE-2026-114462 | 6.0 Medium | Arbitrary File Read via Symlink in Velneo vServer HTTP Server | Oct 21, 2026 |
| CVE-2026-114370 | 3.7 Low | Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal | Oct 21, 2026 |
| CVE-2026-114463 | 7.5 High | CVE-2026-114463 | Oct 21, 2026 |
| CVE-2026-114253 | 5.3 Medium | oretnom23 file-management-system-php index.php include file inclusion | Oct 21, 2026 |
| CVE-2023-7356 | 8.8 High | Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID | Oct 21, 2026 |
| CVE-2026-98869 | 7.8 High | bpf: Infer zext_dst based on static register liveness analysis | Oct 21, 2026 |
| CVE-2026-114252 | 5.3 Medium | itsourcecode Sales-and-Inventory-System cust_searchfrm.php sql injection | Oct 21, 2026 |
| CVE-2026-113786 | 2.3 Low | pypdf: Unvalidated JPEG image data loading | Oct 21, 2026 |
| CVE-2026-114251 | 5.3 Medium | itsourcecode Sales-and-Inventory-System cust_del.php sql injection | Oct 21, 2026 |
| CVE-2026-114250 | 5.3 Medium | itsourcecode Sales-and-Inventory-System cust_edit.php sql injection | Oct 21, 2026 |
| CVE-2026-113779 | 8.8 High | pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission | Oct 21, 2026 |
| CVE-2026-111832 | 10.0 Critical | WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability | Oct 21, 2026 |
| CVE-2026-111834 | 9.9 Critical | WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability | Oct 21, 2026 |
| CVE-2026-111835 | 6.5 Medium | WordPress BjornTech Swish for WooCommerce plugin <= 3.7.8 - Broken Access Control vulnerability | Oct 21, 2026 |
| CVE-2026-111848 | 7.1 High | WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability | Oct 21, 2026 |
| CVE-2026-112221 | 7.1 High | WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability | Oct 21, 2026 |
| CVE-2026-111833 | 7.5 High | WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability | Oct 21, 2026 |
| CVE-2026-111837 | 6.5 Medium | WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scripting (XSS) vulnerability | Oct 21, 2026 |
| CVE-2026-111838 | 7.1 High | WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability | Oct 21, 2026 |
| CVE-2026-111840 | 7.1 High | WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerability | Oct 21, 2026 |
| CVE-2026-111852 | 9.3 Critical | WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability | Oct 21, 2026 |
| CVE-2024-6423 | 4.0 Medium | Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage | Oct 21, 2026 |
| CVE-2026-109619 | 9.2 Critical | RCE via stale global state | Oct 21, 2026 |
| CVE-2026-104949 | 2.3 Low | WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby(). The function is named gp_add_master_standby() in WHPG 6, and WHPG 7 keeps… | Oct 21, 2026 |
| CVE-2026-104948 | 7.1 High | WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any… | Oct 21, 2026 |
| CVE-2026-104947 | 5.3 Medium | WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authenticated database role can run this function without a GRANT. It also… | Oct 21, 2026 |
| CVE-2026-114437 | 6.3 Medium | Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For | Oct 21, 2026 |
| CVE-2025-0326 | 7.4 High | Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access | Oct 21, 2026 |
| CVE-2024-7478 | 5.8 Medium | Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery | Oct 21, 2026 |
| CVE-2026-109618 | 9.2 Critical | RCE via OOM corruption | Oct 21, 2026 |
| CVE-2024-5563 | 4.8 Medium | Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks | Oct 21, 2026 |
| CVE-2024-4989 | 5.4 Medium | Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks | Oct 21, 2026 |
| CVE-2024-5139 | 6.1 Medium | Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection | Oct 21, 2026 |
| CVE-2026-114249 | 6.9 Medium | dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization | Oct 21, 2026 |
| CVE-2026-111849 | 5.3 Medium | WordPress WpTravelly plugin <= 2.3.5 - Broken Access Control vulnerability | Oct 21, 2026 |
| CVE-2026-114248 | 6.9 Medium | dhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing authentication | Oct 21, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.