AI Vulnerability Database
9,409 CVEs, explained.
One more column every day.
A comprehensive hub for tracking high-impact vulnerabilities across application code and third-party libraries, for security teams and developers.
CVE-2026-123655
Broken Access Control (CWE-862) in Moodle H5P Files
Unauthorized Information Disclosure
High
7.5
CVE-2026-107622
Privilege Escalation (CWE-269) in BuddyForms WordPress
Unauthenticated account creation with administrator-level privileges, potentially leading to full site takeover
Critical
9.8
CVE-2026-63774
SQL Injection (CWE-89) in PowerSYSTEM Center Report Designer
Unauthorized SQL command execution
Critical
9.0
CVE-2026-63017
Incorrect Authorization (CWE-863) in PowerSYSTEM Center
Unauthorized access to administrator-restricted resources
Critical
9.0
CVE-2025-71458
SQL Injection (CWE-89) in FTS3 Web Monitoring /linkinfo
Unauthorized access to sensitive database contents and credential exposure
High
7.5
CVE-2026-88981
Server-Side Request Forgery (CWE-918) in Kubeflow UI
Server-side network access and potential response-data or access-key-identifier disclosure
High
8.6
CVE-2026-88980
SSRF (CWE-918) in Kubeflow Pipelines Artifact Route
Unauthorized access to internal HTTP resources and potential response-data disclosure
High
8.6
CVE-2026-77596
Missing Authorization (CWE-862) in Kubeflow Pipelines
Unauthorized pipeline modification and potential cross-tenant workflow execution
Critical
9.6
CVE-2026-113663
Command Injection (CWE-78) in AG2 SandboxShellTool
Host command execution with the privileges of the agent process
High
8.8
CVE-2026-58273
Authorization Bypass (CWE-639) in Rucio Sign-URL API
Unauthorized access to cloud-backed data, including potential cross-tenant access
High
8.1
CVE-2026-33944
SQL Injection (CWE-89) in Dolibarr Third-Party Update
Sensitive data disclosure and database record modification
High
8.8
CVE-2026-87008
Symlink Following (CWE-59) in Code Graph RAG Tools
Sensitive Information Disclosure and Unauthorized File Modification
High
7.1
CVE-2026-49272
Authentication Bypass (CWE-287) in OAuthLib Device Flow
Unauthorized bearer token issuance
High
8.5
CVE-2026-48705
Improper Input Validation (CWE-20) in MONAI PydicomReader
Inference Availability and Data Integrity
Critical
9.3
CVE-2026-46350
Improper Input Validation (CWE-20) in dcmjs DICOM Values
Incorrect calculations and processing disruption
Critical
9.1
CVE-2026-77604
Path Traversal (CWE-22) in Code Graph RAG MCP Server
Arbitrary File Read and Sensitive Information Disclosure
High
7.5
CVE-2026-65983
Sensitive Data Exposure (CWE-200) in OpenEMR Fax Module
Unauthorized disclosure of patient documents
High
7.5
CVE-2026-116789
Missing Certificate Validation (CWE-295) in FreeSWITCH
SRTP media confidentiality and integrity compromise
High
7.4
CVE-2026-116786
Command Injection (CWE-77) in FreeSWITCH SIP REFER Handler
Operating-system command execution
High
8.8
CVE-2026-116779
Exposed API Command Execution (CWE-749) in FreeSWITCH
Arbitrary API command execution, potentially leading to operating-system command execution
Critical
9.8
CVE-2026-115573
Missing Authorization (CWE-862) in OpenEMR Controller
Unauthorized access to administrative functions and sensitive patient data
High
8.1
CVE-2026-104133
Missing Authorization (CWE-862) in OpenEMR DORN Module
Unauthorized modification and corruption of lab-ordering configuration
High
7.1
CVE-2026-103938
Cross-Site Request Forgery (CWE-352) in OpenEMR POS
Unauthorized changes to checkout and invoice state
High
7.1
CVE-2026-103935
Stored XSS (CWE-79) in OpenEMR Clinical Form Fields
Client-side script execution in a clinician's browser, with potential exposure of session data and protected health information or unauthorized patient-record actions
High
8.1
exploitable in your codebase.