CVE Vulnerability Database
Search and browse 425,079 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-76570 | CRITICAL | 9.1 | 0.5% | Sep 30, 2026 | Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The fron... |
| CVE-2026-62097 | HIGH | 7.6 | — | Sep 30, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business D... |
| CVE-2026-62084 | MEDIUM | 6.5 | — | Sep 30, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Su... |
| CVE-2026-47097 | HIGH | 7.5 | — | Sep 30, 2026 | AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attacke... |
| CVE-2026-18783 | HIGH | 8.8 | — | Sep 30, 2026 | Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES all... |
| CVE-2026-18782 | CRITICAL | 9.8 | — | Sep 30, 2026 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart... |
| CVE-2026-103398 | HIGH | 8.1 | — | Sep 30, 2026 | OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. A... |
| CVE-2026-103397 | MEDIUM | 5.6 | 0.2% | Sep 30, 2026 | OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to ... |
| CVE-2026-103396 | MEDIUM | 4.3 | — | Sep 30, 2026 | bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the rea... |
| CVE-2026-103395 | CRITICAL | 9.8 | — | Sep 30, 2026 | LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that des... |
| CVE-2026-103389 | MEDIUM | 6.2 | — | Sep 30, 2026 | MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a ga... |
| CVE-2026-103388 | MEDIUM | 6.2 | — | Sep 30, 2026 | MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER... |
| CVE-2026-103270 | HIGH | 7.5 | — | Sep 30, 2026 | LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks... |
| CVE-2026-103243 | MEDIUM | 5.8 | 0.2% | Sep 30, 2026 | LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenti... |
| CVE-2026-103227 | MEDIUM | 6.3 | 0.5% | Sep 30, 2026 | A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the ... |
| CVE-2026-103226 | MEDIUM | 6.3 | 0.4% | Sep 30, 2026 | A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file... |
| CVE-2026-103222 | MEDIUM | 5.6 | — | Sep 30, 2026 | A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file b... |
| CVE-2026-102984 | HIGH | 8.2 | — | Sep 30, 2026 | Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL fr... |
| CVE-2026-102983 | MEDIUM | 6.3 | — | Sep 30, 2026 | Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates reg... |
| CVE-2026-102717 | HIGH | 7.5 | — | Sep 30, 2026 | MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash |
| CVE-2026-101295 | HIGH | 7.3 | 0.1% | Sep 30, 2026 | Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs... |
| CVE-2026-93903 | CRITICAL | 9.4 | 0.3% | Sep 30, 2026 | LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" ... |
| CVE-2026-93547 | MEDIUM | 5.3 | — | Sep 30, 2026 | A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that re... |
| CVE-2026-91860 | MEDIUM | 6.3 | — | Sep 30, 2026 | A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging... |
| CVE-2026-82307 | CRITICAL | 9.8 | — | Sep 30, 2026 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software ... |