CVE Vulnerability Database
Search and browse 420,152 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-121391 | MEDIUM | 4.3 | — | Nov 3, 2026 | FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close prev... |
| CVE-2026-121390 | MEDIUM | 4.3 | 0.2% | Nov 3, 2026 | FreeRDP 3.0.0 before 3.32.2 built with WITH_AAD=ON contains a reachable assertion because its ARM gateway response parse... |
| CVE-2026-121389 | LOW | 3.1 | — | Nov 3, 2026 | FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious ... |
| CVE-2026-121388 | MEDIUM | 6.5 | — | Nov 3, 2026 | FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP se... |
| CVE-2026-121387 | MEDIUM | 4.3 | — | Nov 3, 2026 | FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows malici... |
| CVE-2026-121386 | HIGH | 7.5 | 0.3% | Nov 3, 2026 | FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_conve... |
| CVE-2026-118527 | MEDIUM | 4.3 | — | Nov 3, 2026 | Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticate... |
| CVE-2026-118489 | HIGH | 7.5 | — | Nov 3, 2026 | In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the doc... |
| CVE-2026-118488 | MEDIUM | 5.9 | — | Nov 3, 2026 | In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an EOL-term... |
| CVE-2026-110265 | MEDIUM | 6.5 | — | Nov 3, 2026 | A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZ... |
| CVE-2026-106991 | HIGH | 7.1 | 0.4% | Nov 3, 2026 | hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sti... |
| CVE-2026-100493 | MEDIUM | 6.9 | — | Nov 3, 2026 | An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS f... |
| CVE-2026-89295 | HIGH | 7.5 | 0.2% | Nov 3, 2026 | In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supp... |
| CVE-2026-85035 | HIGH | 8.8 | — | Nov 3, 2026 | The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in drivers/can/can_comm... |
| CVE-2026-85034 | MEDIUM | 6.7 | — | Nov 3, 2026 | The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Mu... |
| CVE-2026-85033 | MEDIUM | 4.6 | — | Nov 3, 2026 | The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a p... |
| CVE-2026-85032 | MEDIUM | 4.8 | — | Nov 3, 2026 | The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system workqueu... |
| CVE-2026-120572 | HIGH | 8.8 | — | Nov 3, 2026 | Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1... |
| CVE-2026-119742 | HIGH | 7.2 | — | Nov 3, 2026 | Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib()... |
| CVE-2026-119179 | HIGH | 7 | — | Nov 3, 2026 | A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the poo... |
| CVE-2026-99270 | HIGH | 8.1 | 0.3% | Nov 3, 2026 | In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). W... |
| CVE-2026-76124 | HIGH | 8.8 | 0.4% | Nov 3, 2026 | The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.... |
| CVE-2026-65160 | MEDIUM | 5.5 | — | Nov 3, 2026 | NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero. A successful exploit of this vuln... |
| CVE-2026-121458 | MEDIUM | 6.5 | — | Nov 3, 2026 | Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-p... |
| CVE-2026-108060 | MEDIUM | 5.1 | — | Nov 3, 2026 | A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient... |