CVE Vulnerability Database
Search and browse 425,075 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-47360 | HIGH | 7.5 | 0.3% | Oct 1, 2026 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie modu... |
| CVE-2026-46729 | HIGH | 7.5 | 0.5% | Oct 1, 2026 | NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affe... |
| CVE-2026-42528 | MEDIUM | 4.3 | 0.4% | Oct 1, 2026 | A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebD... |
| CVE-2026-42356 | LOW | 3.7 | 0.5% | Oct 1, 2026 | Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI pr... |
| CVE-2026-18734 | — | — | — | Oct 1, 2026 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All r... |
| CVE-2026-17053 | MEDIUM | 4.4 | 0.1% | Oct 1, 2026 | The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls. Their veri... |
| CVE-2026-12627 | CRITICAL | 9.8 | — | Oct 1, 2026 | Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregister... |
| CVE-2026-103690 | MEDIUM | 6.3 | — | Oct 1, 2026 | A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /... |
| CVE-2026-103505 | MEDIUM | 6.5 | — | Oct 1, 2026 | Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-drive... |
| CVE-2026-101322 | HIGH | 8.3 | — | Oct 1, 2026 | In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached th... |
| CVE-2026-97297 | HIGH | 7.6 | — | Oct 1, 2026 | Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions. |
| CVE-2026-97284 | HIGH | 8.8 | — | Oct 1, 2026 | Contributor PHP Object Injection in Icegram <= 3.1.31 versions. |
| CVE-2026-97281 | MEDIUM | 6.3 | — | Oct 1, 2026 | Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions. |
| CVE-2026-97280 | MEDIUM | 6.5 | — | Oct 1, 2026 | Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configur... |
| CVE-2026-97277 | HIGH | 7.6 | — | Oct 1, 2026 | Subscriber Broken Access Control in Social Boost <= 3.6.2 versions. |
| CVE-2026-97273 | HIGH | 7.1 | 0.2% | Oct 1, 2026 | Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions. |
| CVE-2026-97269 | MEDIUM | 6.5 | — | Oct 1, 2026 | Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions. |
| CVE-2026-97268 | HIGH | 7.1 | — | Oct 1, 2026 | Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions. |
| CVE-2026-97260 | HIGH | 7.1 | — | Oct 1, 2026 | Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions. |
| CVE-2026-97258 | MEDIUM | 6.5 | 0.3% | Oct 1, 2026 | Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions. |
| CVE-2026-97251 | MEDIUM | 6.5 | — | Oct 1, 2026 | Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions. |
| CVE-2026-95588 | HIGH | 8.6 | — | Oct 1, 2026 | Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions. |
| CVE-2026-95137 | — | — | — | Oct 1, 2026 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Fu... |
| CVE-2026-94390 | HIGH | 7.2 | — | Oct 1, 2026 | Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions. |
| CVE-2026-79900 | MEDIUM | 6.5 | — | Oct 1, 2026 | boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases... |