Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,744 vulnerabilities match.

CVESeveritySummary
CVE-2026-1142486.9 Mediumdhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing authentication
CVE-2026-973137.5 HighSpecific RPZ configurations and query patterns may result in an unexpected exit
CVE-2026-968887.5 HighNamed may terminate unexpectedly when a redirect zone is used with strict QNAME minimization
CVE-2026-943008.1 HighConcurrent GSS-TSIG messages corrupt memory
CVE-2026-1142456.9 Mediumdhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization
CVE-2026-196307.5 HighAmplified resource exhaustion in inbound message processing
CVE-2026-1144045.3 MediumPHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions
CVE-2026-1144039.2 CriticalPHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load
CVE-2026-1144025.3 MediumTrudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload
CVE-2026-1144016.9 MediumTrudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login
CVE-2026-1144008.2 HighTrudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
CVE-2026-1143997.0 HighTrudesk through 1.2.11 Path Traversal via Backup Delete and Restore API
CVE-2026-1143985.1 MediumTrudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo
CVE-2026-1143978.3 HighTrudesk through 1.2.11 Missing Authentication on Debug Routes
CVE-2026-1143967.1 HighTrudesk through 1.2.11 MongoDB $where Injection via tickets search API
CVE-2026-1143955.3 MediumTrudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send
CVE-2026-1143945.3 MediumTrudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs
CVE-2026-1143935.3 MediumTrudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints
CVE-2026-1143926.9 MediumTrudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid
CVE-2026-1143917.1 HighZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods
CVE-2026-1143906.9 MediumChamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers
CVE-2026-1143895.3 MediumChamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade
CVE-2026-1143886.9 MediumChamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController
CVE-2026-1143878.7 HighShopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components
CVE-2026-1143866.3 MediumPydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code
CVE-2026-1141205.3 MediumSchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action
CVE-2026-1144058.7 HighDenial of Service via Malformed VATP Packet in Velneo vServer
CVE-2026-904846.5 MediumApache bRPC: Null pointer dereference in MySQL reply parser leading to client crash
CVE-2026-878494.3 MediumApache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
CVE-2026-862499.1 CriticalApache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth
CVE-2026-861477.5 HighApache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof
CVE-2026-861467.5 HighApache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing
CVE-2026-1142436.9 Mediumdhikshitha29 Insurance-Management-System EditPolicyHolder.php mysqli_query sql injection
CVE-2026-847487.5 HighApache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration
CVE-2026-847477.5 HighApache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments
CVE-2026-847275.4 MediumApache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message
CVE-2026-829535.3 MediumApache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service
CVE-2026-829427.5 HighApache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service
CVE-2026-824257.5 HighApache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service
CVE-2026-822317.5 HighApache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client
CVE-2026-822307.5 HighApache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser
CVE-2026-822107.5 HighApache bRPC: Remote denial of service (crash) via malformed stream feedback frames
CVE-2026-1144075.1 Mediume107 CMS before 2.3.13 Reflected XSS via search.php author Parameter
CVE-2026-817557.5 HighApache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request
CVE-2026-804637.5 HighApache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly
CVE-2026-797047.5 HighApache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling
CVE-2026-783349.1 CriticalApache bRPC: Missing Authentication for Streaming RPC Frames
CVE-2026-780667.5 HighApache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes
CVE-2026-780587.5 HighApache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
CVE-2026-780487.5 HighApache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.