CVEs
Browse the synced catalog, newest first.
- CVE-2026-55458Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak throughcaddyserver caddy · github.com/caddyserver/caddy/v2
- CVE-2026-87008Code Graph RAG structural tools follow out-of-root symlinksvitali87 code-graph-rag · code-graph-rag
- CVE-2026-77604Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readvitali87 code-graph-rag · code-graph-rag
- CVE-2026-102940OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignmentopenemr
- CVE-2026-103021OpenEMR: Username Enumeration via Pre-Authentication User Settings Loadingopenemr
- CVE-2026-103020OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versionsopenemr
- CVE-2026-103019OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpointopenemr
- CVE-2026-104134OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)openemr
- CVE-2026-103939OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directoryopenemr
- CVE-2026-104138OpenEMR: Missing authorization on QRDA Category I/III download endpointsopenemr
- CVE-2026-115573OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumerationopenemr
- CVE-2026-104133OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstallopenemr
- CVE-2026-103935OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attributeopenemr
- CVE-2026-104135OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birthopenemr
- CVE-2026-104136OpenEMR: Arbitrary Patient Recall and Contact Detail Readopenemr
- CVE-2026-76181Heap buffer overflow in dBASE index importThe Document Foundation LibreOffice
- CVE-2026-103938OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operationsopenemr
- CVE-2026-104137OpenEMR: Patient Data Search Without Sufficient ACLopenemr
- CVE-2026-110930Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer.OpenAI Codex Desktop for Windows
- CVE-2026-104139OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHIopenemr
- CVE-2026-65983OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webrootopenemr
- CVE-2026-18159A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking.OpenText Directory Services
- CVE-2026-116782FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handlingsignalwire freeswitch
- CVE-2026-116783FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery datasignalwire freeswitch
- CVE-2026-116790FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITYsignalwire freeswitch
- CVE-2026-76580Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText OpenText Directory Services…OpenText Directory Services
- CVE-2026-19134A vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse Engineering.OpenText Directory Services
- CVE-2026-116788FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decodingsignalwire freeswitch
- CVE-2026-116780FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicingsignalwire freeswitch
- CVE-2026-116784FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsingsignalwire freeswitch