CVE Vulnerability Database
Search and browse 419,328 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-110931 | HIGH | 7.5 | — | Nov 5, 2026 | A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue... |
| CVE-2026-107602 | HIGH | 7.5 | — | Nov 5, 2026 | A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. ... |
| CVE-2026-107123 | HIGH | 7.5 | — | Nov 5, 2026 | A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solutio... |
| CVE-2026-104867 | MEDIUM | 4.3 | — | Nov 5, 2026 | Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin... |
| CVE-2026-103112 | HIGH | 7.5 | — | Nov 5, 2026 | A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs... |
| CVE-2026-102739 | HIGH | 7.8 | — | Nov 5, 2026 | ESPectre is a Wi-Fi motion sensing platform for ESP32. Prior to 3.0.0-rc1, Micro-ESPectre analysis tools, including tool... |
| CVE-2026-85286 | LOW | 3.7 | — | Nov 5, 2026 | HomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint performs pas... |
| CVE-2026-73856 | HIGH | 8.6 | — | Nov 5, 2026 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.... |
| CVE-2026-70660 | MEDIUM | 6.9 | — | Nov 5, 2026 | stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Ima... |
| CVE-2026-70659 | HIGH | 7.8 | — | Nov 5, 2026 | stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Ima... |
| CVE-2026-61813 | LOW | 3.7 | — | Nov 5, 2026 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to ... |
| CVE-2026-123158 | HIGH | 8.1 | — | Nov 5, 2026 | sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica... |
| CVE-2026-123125 | MEDIUM | 6.5 | — | Nov 5, 2026 | The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip c... |
| CVE-2026-123096 | MEDIUM | 6.5 | — | Nov 5, 2026 | anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows mali... |
| CVE-2026-123095 | HIGH | 7.5 | — | Nov 5, 2026 | mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote ... |
| CVE-2026-123094 | MEDIUM | 5.4 | — | Nov 5, 2026 | Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks une... |
| CVE-2026-122330 | MEDIUM | 5.5 | — | Nov 5, 2026 | Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.... |
| CVE-2026-122329 | HIGH | 7.8 | — | Nov 5, 2026 | SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder_aiff.c due to miscalc... |
| CVE-2026-122328 | HIGH | 7.8 | — | Nov 5, 2026 | SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c w... |
| CVE-2026-122327 | MEDIUM | 4.3 | — | Nov 5, 2026 | Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify ... |
| CVE-2026-122326 | MEDIUM | 5.3 | — | Nov 5, 2026 | Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json rout... |
| CVE-2026-122325 | LOW | 3.1 | — | Nov 5, 2026 | fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead... |
| CVE-2026-122324 | LOW | 3.1 | — | Nov 5, 2026 | SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other user... |
| CVE-2026-122317 | MEDIUM | 4.3 | — | Nov 5, 2026 | SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any ac... |
| CVE-2026-121139 | HIGH | 7.8 | — | Nov 5, 2026 | The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthen... |