CVE Vulnerability Database
Search and browse 425,069 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-71427 | MEDIUM | 6.8 | 0.3% | Oct 1, 2026 | Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and ... |
| CVE-2026-86344 | HIGH | 7.5 | 0.3% | Oct 1, 2026 | A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the f... |
| CVE-2026-71454 | MEDIUM | 5.8 | 0.2% | Oct 1, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-sit... |
| CVE-2026-71453 | MEDIUM | 5.6 | 0.1% | Oct 1, 2026 | - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This i... |
| CVE-2026-71452 | HIGH | 7.2 | 0.7% | Oct 1, 2026 | - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects Ea... |
| CVE-2026-71449 | CRITICAL | 9.3 | 0.3% | Oct 1, 2026 | : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive... |
| CVE-2026-71448 | MEDIUM | 5.6 | 0.1% | Oct 1, 2026 | : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abus... |
| CVE-2026-64893 | HIGH | 7.3 | 0.1% | Oct 1, 2026 | - Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middl... |
| CVE-2026-64892 | MEDIUM | 6.3 | 0.2% | Oct 1, 2026 | - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resour... |
| CVE-2026-51897 | CRITICAL | 9.8 | 0.3% | Oct 1, 2026 | RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry... |
| CVE-2026-51896 | MEDIUM | 6.5 | 0.1% | Oct 1, 2026 | infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the expos... |
| CVE-2026-51895 | MEDIUM | 6.5 | 0.1% | Oct 1, 2026 | Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on ... |
| CVE-2026-51894 | MEDIUM | 6.5 | 0.1% | Oct 1, 2026 | infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable path accepts a caller-s... |
| CVE-2026-51893 | CRITICAL | 9.8 | 0.1% | Oct 1, 2026 | infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path acce... |
| CVE-2026-51892 | MEDIUM | 6.5 | 0.2% | Oct 1, 2026 | infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>. |
| CVE-2026-51888 | HIGH | 7.5 | 0.2% | Oct 1, 2026 | langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intende... |
| CVE-2026-51886 | CRITICAL | 9.8 | 0.2% | Oct 1, 2026 | langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The componen... |
| CVE-2026-51884 | CRITICAL | 9.8 | 0.2% | Oct 1, 2026 | The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to pat... |
| CVE-2026-51883 | CRITICAL | 9.1 | 0.1% | Oct 1, 2026 | The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path trave... |
| CVE-2026-51882 | CRITICAL | 9.1 | 0.1% | Oct 1, 2026 | The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An a... |
| CVE-2026-51881 | CRITICAL | 9.8 | 0.2% | Oct 1, 2026 | deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote cal... |
| CVE-2026-51880 | CRITICAL | 9.8 | 0.1% | Oct 1, 2026 | deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, ... |
| CVE-2026-51879 | CRITICAL | 9.1 | 0.2% | Oct 1, 2026 | deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bo... |
| CVE-2026-51878 | MEDIUM | 4.3 | 0.2% | Oct 1, 2026 | deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regen... |
| CVE-2026-51876 | CRITICAL | 9.1 | 0.2% | Oct 1, 2026 | DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unau... |