CVE Vulnerability Database
Search and browse 425,079 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-102091 | HIGH | 7.5 | 0.3% | Sep 30, 2026 | Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauth... |
| CVE-2026-102090 | MEDIUM | 4.3 | 0.2% | Sep 30, 2026 | Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficie... |
| CVE-2026-102089 | HIGH | 7.2 | 0.5% | Sep 30, 2026 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative ... |
| CVE-2026-101276 | CRITICAL | 9.2 | 0.4% | Sep 30, 2026 | iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_... |
| CVE-2024-58387 | HIGH | 7.5 | 0.6% | Sep 30, 2026 | Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint th... |
| CVE-2023-54403 | HIGH | 7.5 | 0.5% | Sep 30, 2026 | Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows u... |
| CVE-2023-54402 | HIGH | 7.5 | 0.4% | Sep 30, 2026 | iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthentic... |
| CVE-2026-103548 | MEDIUM | 5.3 | — | Sep 30, 2026 | Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and passwo... |
| CVE-2026-103547 | CRITICAL | 9.2 | 0.6% | Sep 30, 2026 | In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated... |
| CVE-2026-103387 | MEDIUM | 4.3 | — | Sep 30, 2026 | A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/sche... |
| CVE-2026-102994 | HIGH | 7.5 | 0.3% | Sep 30, 2026 | pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object ident... |
| CVE-2026-102993 | HIGH | 7.5 | 0.3% | Sep 30, 2026 | pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roma... |
| CVE-2026-102992 | CRITICAL | 9.2 | — | Sep 30, 2026 | piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.option... |
| CVE-2026-102991 | MEDIUM | 6.5 | — | Sep 30, 2026 | Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.p... |
| CVE-2026-102990 | HIGH | 8.2 | — | Sep 30, 2026 | basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP se... |
| CVE-2026-101885 | HIGH | 7.8 | — | Sep 30, 2026 | ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installa... |
| CVE-2026-101884 | HIGH | 7.5 | — | Sep 30, 2026 | OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to ... |
| CVE-2026-101883 | MEDIUM | 5.4 | 0.2% | Sep 30, 2026 | OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capabi... |
| CVE-2026-101882 | HIGH | 8.8 | 0.8% | Sep 30, 2026 | OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that a... |
| CVE-2026-101881 | MEDIUM | 6.5 | — | Sep 30, 2026 | OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway We... |
| CVE-2026-101880 | HIGH | 8.8 | — | Sep 30, 2026 | OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval ... |
| CVE-2026-101879 | MEDIUM | 6.5 | 0.3% | Sep 30, 2026 | OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers t... |
| CVE-2026-97291 | HIGH | 8.8 | — | Sep 30, 2026 | Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions. |
| CVE-2026-97290 | HIGH | 7.1 | — | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions. |
| CVE-2026-97265 | MEDIUM | 6.5 | — | Sep 30, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimp... |