Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,749 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-79704 | 7.5 High | Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling | Oct 21, 2026 |
| CVE-2026-78334 | 9.1 Critical | Apache bRPC: Missing Authentication for Streaming RPC Frames | Oct 21, 2026 |
| CVE-2026-78066 | 7.5 High | Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes | Oct 21, 2026 |
| CVE-2026-78058 | 7.5 High | Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path | Oct 21, 2026 |
| CVE-2026-78048 | 7.5 High | Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder | Oct 21, 2026 |
| CVE-2026-74758 | 7.5 High | Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling | Oct 21, 2026 |
| CVE-2026-74757 | 7.5 High | Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count | Oct 21, 2026 |
| CVE-2026-74755 | 7.5 High | Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service | Oct 21, 2026 |
| CVE-2026-114242 | 6.9 Medium | dhikshitha29 Insurance-Management-System editPlan.php mysqli_query sql injection | Oct 21, 2026 |
| CVE-2026-66392 | 5.9 Medium | Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names | Oct 21, 2026 |
| CVE-2026-61916 | 7.5 High | Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms | Oct 21, 2026 |
| CVE-2026-61902 | 7.5 High | Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits | Oct 21, 2026 |
| CVE-2026-58064 | 7.5 High | Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation | Oct 21, 2026 |
| CVE-2026-56388 | 9.1 Critical | Apache bRPC: Out-of-Bounds Write in Redis Command Parser | Oct 21, 2026 |
| CVE-2026-56387 | 7.5 High | Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser | Oct 21, 2026 |
| CVE-2026-56386 | 7.5 High | Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser | Oct 21, 2026 |
| CVE-2026-54427 | 7.5 High | Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser | Oct 21, 2026 |
| CVE-2026-54426 | 7.5 High | Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser | Oct 21, 2026 |
| CVE-2026-54425 | 7.5 High | Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding | Oct 21, 2026 |
| CVE-2026-48830 | 9.1 Critical | Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests | Oct 21, 2026 |
| CVE-2026-59229 | 8.8 High | Apache IoTDB: Legacy Pipe Privilege Escalation | Oct 21, 2026 |
| CVE-2026-59562 | 9.8 Critical | Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC | Oct 21, 2026 |
| CVE-2026-41114 | 7.5 High | Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver | Oct 21, 2026 |
| CVE-2026-58663 | 9.8 Critical | Apache IoTDB: Auth Bypass in pipeTransfer() interface | Oct 21, 2026 |
| CVE-2026-87096 | 3.3 Low | Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build… | Oct 21, 2026 |
| CVE-2026-87095 | 9.1 Critical | Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build… | Oct 21, 2026 |
| CVE-2026-105923 | 4.0 Medium | Null-pointer dereference in QTriangulator reachable through VectorImage | Oct 21, 2026 |
| CVE-2026-110369 | 8.8 High | WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerability | Oct 21, 2026 |
| CVE-2026-110370 | 8.8 High | WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerability | Oct 21, 2026 |
| CVE-2026-110884 | 7.1 High | WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability | Oct 21, 2026 |
| CVE-2026-70387 | 8.4 High | OnePlus OxygenOS exposed dangerous method vulnerability | Oct 21, 2026 |
| CVE-2026-97206 | 7.5 High | DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments. | Oct 21, 2026 |
| CVE-2026-96405 | 5.3 Medium | Aggregate DNS name chained pointer decompression work leads to degradation of service. | Oct 21, 2026 |
| CVE-2026-50106 | 6.5 Medium | Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. | Oct 21, 2026 |
| CVE-2026-35501 | 3.7 Low | Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record. | Oct 21, 2026 |
| CVE-2026-109125 | 5.3 Medium | Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold' | Oct 21, 2026 |
| CVE-2026-70386 | 8.5 High | OnePlus OxygenOS improper neutralization of special elements vulnerability | Oct 21, 2026 |
| CVE-2026-85683 | 8.8 High | Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL | Oct 21, 2026 |
| CVE-2026-14556 | 5.4 Medium | HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer | Oct 21, 2026 |
| CVE-2026-107447 | 5.3 Medium | Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity | Oct 21, 2026 |
| CVE-2026-105256 | 5.3 Medium | LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter | Oct 21, 2026 |
| CVE-2026-104642 | 2.7 Low | Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass | Oct 21, 2026 |
| CVE-2026-104641 | 5.3 Medium | Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient | Oct 21, 2026 |
| CVE-2026-103301 | 5.3 Medium | Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret | Oct 21, 2026 |
| CVE-2026-101138 | 5.3 Medium | CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist | Oct 21, 2026 |
| CVE-2026-114236 | 3.3 Low | Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers | Oct 21, 2026 |
| CVE-2026-110938 | 8.7 High | JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing | Oct 21, 2026 |
| CVE-2026-111075 | 8.7 High | JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization | Oct 21, 2026 |
| CVE-2026-110899 | 7.1 High | WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability | Oct 21, 2026 |
| CVE-2026-107435 | 7.1 High | WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability | Oct 21, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.