CVE Vulnerability Database
Search and browse 425,079 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-14157 | CRITICAL | 9.4 | — | Oct 1, 2026 | Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute ar... |
| CVE-2026-13313 | HIGH | 8.9 | — | Oct 1, 2026 | An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP ... |
| CVE-2026-103532 | MEDIUM | 5.3 | — | Oct 1, 2026 | A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the ... |
| CVE-2026-103531 | MEDIUM | 5.5 | 0.2% | Oct 1, 2026 | A flaw has been found in OpenSC up to 0.27.1. The impacted element is the function setcos_construct_fci_44 of the file s... |
| CVE-2026-103530 | HIGH | 7.3 | — | Oct 1, 2026 | A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src... |
| CVE-2026-103592 | MEDIUM | 6.5 | 0.2% | Sep 30, 2026 | simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware tha... |
| CVE-2026-103591 | HIGH | 7.5 | 0.4% | Sep 30, 2026 | DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/f... |
| CVE-2026-103590 | MEDIUM | 5.4 | — | Sep 30, 2026 | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's leng... |
| CVE-2026-103589 | MEDIUM | 5.4 | — | Sep 30, 2026 | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that f... |
| CVE-2026-103588 | MEDIUM | 5.4 | 0.2% | Sep 30, 2026 | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office... |
| CVE-2026-103587 | MEDIUM | 5.4 | — | Sep 30, 2026 | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation Syste... |
| CVE-2026-103585 | LOW | 1.2 | — | Sep 30, 2026 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation ... |
| CVE-2026-103584 | LOW | 1.1 | — | Sep 30, 2026 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation ... |
| CVE-2026-47096 | MEDIUM | 6.1 | 0.4% | Sep 30, 2026 | AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated att... |
| CVE-2026-103001 | MEDIUM | 6.5 | 0.2% | Sep 30, 2026 | PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options()... |
| CVE-2026-101283 | CRITICAL | 9.2 | 0.4% | Sep 30, 2026 | iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BI... |
| CVE-2026-92173 | CRITICAL | 9.1 | 0.2% | Sep 30, 2026 | Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent i... |
| CVE-2026-92172 | HIGH | 8.8 | 0.2% | Sep 30, 2026 | Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent includi... |
| CVE-2026-51872 | CRITICAL | 9.8 | 0.2% | Sep 30, 2026 | Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py. |
| CVE-2026-51871 | CRITICAL | 9.8 | 0.2% | Sep 30, 2026 | Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows a... |
| CVE-2026-51870 | CRITICAL | 9.8 | 0.2% | Sep 30, 2026 | DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute. |
| CVE-2026-51869 | CRITICAL | 9.8 | 0.1% | Sep 30, 2026 | DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host. |
| CVE-2026-51867 | CRITICAL | 9.8 | 0.2% | Sep 30, 2026 | agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally ... |
| CVE-2026-51866 | CRITICAL | 9.8 | 0.2% | Sep 30, 2026 | In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through t... |
| CVE-2026-51864 | CRITICAL | 9.1 | 0.5% | Sep 30, 2026 | DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/ap... |