CVE Vulnerability Database
Search and browse 425,092 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-103046 | MEDIUM | 6.1 | — | Sep 29, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundati... |
| CVE-2026-103045 | MEDIUM | 6.1 | — | Sep 29, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun... |
| CVE-2026-103044 | CRITICAL | 9.8 | 0.2% | Sep 29, 2026 | XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension a... |
| CVE-2026-103043 | HIGH | 7.5 | 0.4% | Sep 29, 2026 | anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex d... |
| CVE-2026-103042 | HIGH | 7.5 | 0.5% | Sep 29, 2026 | LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pd_tra... |
| CVE-2026-103041 | CRITICAL | 9.8 | — | Sep 29, 2026 | LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization e... |
| CVE-2026-103040 | CRITICAL | 9.8 | — | Sep 29, 2026 | LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with -... |
| CVE-2026-102792 | CRITICAL | 9.1 | 3.0% | Sep 29, 2026 | A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of the file /api/ZRnetw... |
| CVE-2026-91191 | HIGH | 7.5 | — | Sep 29, 2026 | The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic.... |
| CVE-2026-84409 | HIGH | 7.5 | — | Sep 29, 2026 | The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores por... |
| CVE-2026-74225 | HIGH | 7.1 | — | Sep 29, 2026 | U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID ... |
| CVE-2026-74222 | HIGH | 8.2 | 0.3% | Sep 29, 2026 | U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget i... |
| CVE-2026-74221 | HIGH | 8.2 | — | Sep 29, 2026 | U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processin... |
| CVE-2026-74220 | HIGH | 8.2 | — | Sep 29, 2026 | U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attack... |
| CVE-2026-72510 | CRITICAL | 9 | — | Sep 29, 2026 | The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injecti... |
| CVE-2026-72507 | CRITICAL | 9 | — | Sep 29, 2026 | The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to ... |
| CVE-2026-71974 | MEDIUM | 4.8 | — | Sep 29, 2026 | U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails to valida... |
| CVE-2026-71973 | MEDIUM | 5.2 | 0.2% | Sep 29, 2026 | U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table() function when alloca... |
| CVE-2026-71972 | MEDIUM | 5.9 | 0.2% | Sep 29, 2026 | U-Boot before 2027.01-rc1 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in dri... |
| CVE-2026-71971 | HIGH | 8.2 | — | Sep 29, 2026 | U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defra... |
| CVE-2026-71379 | CRITICAL | 10 | — | Sep 29, 2026 | The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted PO... |
| CVE-2026-71302 | HIGH | 7.1 | — | Sep 29, 2026 | The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. T... |
| CVE-2026-71189 | LOW | 3.5 | — | Sep 29, 2026 | An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by ... |
| CVE-2026-70356 | CRITICAL | 9.1 | — | Sep 29, 2026 | The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and exe... |
| CVE-2026-69662 | LOW | 3.7 | — | Sep 29, 2026 | The application uses unsafe functions that allow execution of inline scripts and string evaluation functions. |