CVE Vulnerability Database
Search and browse 425,079 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-97256 | HIGH | 7.2 | — | Sep 30, 2026 | Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions. |
| CVE-2026-94171 | HIGH | 7.1 | 0.1% | Sep 30, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY w... |
| CVE-2026-87004 | HIGH | 8.1 | — | Sep 30, 2026 | Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login... |
| CVE-2026-55224 | HIGH | 8.7 | 1.2% | Sep 30, 2026 | MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platform... |
| CVE-2026-55107 | CRITICAL | 10 | — | Sep 30, 2026 | Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted ... |
| CVE-2026-55094 | HIGH | 8.7 | — | Sep 30, 2026 | Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior ... |
| CVE-2026-53605 | HIGH | 7.8 | 0.1% | Sep 30, 2026 | Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wi... |
| CVE-2026-103500 | MEDIUM | 6.1 | 0.2% | Sep 30, 2026 | An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB i... |
| CVE-2026-103476 | MEDIUM | 5.3 | 0.5% | Sep 30, 2026 | yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowin... |
| CVE-2026-103475 | CRITICAL | 9.1 | — | Sep 30, 2026 | yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] ... |
| CVE-2026-103474 | HIGH | 8.8 | — | Sep 30, 2026 | yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticate... |
| CVE-2026-103473 | HIGH | 8.1 | 1.5% | Sep 30, 2026 | Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell... |
| CVE-2026-103472 | HIGH | 7.5 | 0.8% | Sep 30, 2026 | restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload wi... |
| CVE-2026-103471 | HIGH | 7.5 | — | Sep 30, 2026 | restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticat... |
| CVE-2026-103446 | HIGH | 7.4 | 0.3% | Sep 30, 2026 | Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extensio... |
| CVE-2026-103445 | LOW | 1.2 | — | Sep 30, 2026 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation ... |
| CVE-2026-103440 | LOW | 1.2 | — | Sep 30, 2026 | Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage ex... |
| CVE-2026-103439 | LOW | 0.3 | — | Sep 30, 2026 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation ... |
| CVE-2026-103438 | LOW | 0.3 | — | Sep 30, 2026 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation ... |
| CVE-2026-103437 | LOW | 1.1 | — | Sep 30, 2026 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation ... |
| CVE-2026-103399 | MEDIUM | 5.3 | 0.2% | Sep 30, 2026 | A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a reques... |
| CVE-2026-102397 | MEDIUM | 6.5 | — | Sep 30, 2026 | Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions. |
| CVE-2026-102392 | HIGH | 7.2 | — | Sep 30, 2026 | Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 v... |
| CVE-2026-102391 | HIGH | 7.1 | — | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions. |
| CVE-2026-102377 | HIGH | 8.8 | — | Sep 30, 2026 | Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions. |