CVE Vulnerability Database
Search and browse 425,091 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-102395 | HIGH | 7.1 | — | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions. |
| CVE-2026-102386 | MEDIUM | 6.5 | — | Sep 30, 2026 | Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions. |
| CVE-2026-102385 | HIGH | 7.1 | — | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. |
| CVE-2026-102384 | MEDIUM | 5.9 | — | Sep 30, 2026 | Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions. |
| CVE-2026-100513 | MEDIUM | 6.5 | — | Sep 30, 2026 | Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versio... |
| CVE-2026-100508 | MEDIUM | 5.3 | — | Sep 30, 2026 | Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions. |
| CVE-2026-100507 | HIGH | 7.1 | 0.2% | Sep 30, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Cont... |
| CVE-2026-88920 | CRITICAL | 9.8 | 0.5% | Sep 30, 2026 | An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge ... |
| CVE-2026-87830 | CRITICAL | 9.1 | 0.2% | Sep 30, 2026 | In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted in... |
| CVE-2026-85532 | HIGH | 7.5 | 0.4% | Sep 30, 2026 | Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cry... |
| CVE-2026-62146 | HIGH | 7.8 | 0.2% | Sep 30, 2026 | A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's ... |
| CVE-2026-10739 | HIGH | 8.5 | — | Sep 30, 2026 | Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges ... |
| CVE-2026-10726 | MEDIUM | 6.8 | — | Sep 30, 2026 | Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged loca... |
| CVE-2026-103242 | HIGH | 7.1 | 0.1% | Sep 30, 2026 | A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main head... |
| CVE-2026-103114 | MEDIUM | 6.3 | — | Sep 30, 2026 | A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignme... |
| CVE-2026-103012 | LOW | 2 | — | Sep 30, 2026 | Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its c... |
| CVE-2026-96342 | MEDIUM | 6.9 | — | Sep 30, 2026 | Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This is... |
| CVE-2026-76992 | HIGH | 7.5 | — | Sep 30, 2026 | The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate... |
| CVE-2026-13720 | MEDIUM | 5.4 | — | Sep 30, 2026 | An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePat... |
| CVE-2026-13719 | MEDIUM | 4.3 | — | Sep 30, 2026 | An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API li... |
| CVE-2026-103239 | HIGH | 8.6 | — | Sep 30, 2026 | MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affecte... |
| CVE-2026-103113 | MEDIUM | 4.7 | 0.3% | Sep 30, 2026 | A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of t... |
| CVE-2026-94053 | CRITICAL | 9.1 | — | Sep 30, 2026 | Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M... |
| CVE-2026-94052 | CRITICAL | 9.1 | — | Sep 30, 2026 | A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.... |
| CVE-2026-94029 | MEDIUM | 6.5 | — | Sep 30, 2026 | Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the ... |