CVE Vulnerability Database
Search and browse 425,092 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-68954 | CRITICAL | 9 | — | Sep 29, 2026 | The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blin... |
| CVE-2026-68068 | CRITICAL | 9 | — | Sep 29, 2026 | The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is su... |
| CVE-2026-63713 | CRITICAL | 9 | — | Sep 29, 2026 | The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind ... |
| CVE-2026-102771 | MEDIUM | 4.7 | — | Sep 29, 2026 | A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailC... |
| CVE-2026-102621 | LOW | 3.3 | — | Sep 29, 2026 | A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of ... |
| CVE-2026-96587 | CRITICAL | 10 | — | Sep 29, 2026 | The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These cr... |
| CVE-2026-94952 | CRITICAL | 9.8 | — | Sep 29, 2026 | A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware ... |
| CVE-2026-94204 | HIGH | 7.5 | — | Sep 29, 2026 | The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowin... |
| CVE-2026-93853 | HIGH | 7.2 | — | Sep 29, 2026 | Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Bar... |
| CVE-2026-81842 | MEDIUM | 4.3 | — | Sep 29, 2026 | An authenticated user with edit permission on one folder can move a library panel into another folder where they only ha... |
| CVE-2026-81841 | MEDIUM | 5.3 | — | Sep 29, 2026 | Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data... |
| CVE-2026-102938 | MEDIUM | 5.8 | — | Sep 29, 2026 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt... |
| CVE-2026-102937 | HIGH | 7.3 | 0.1% | Sep 29, 2026 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns... |
| CVE-2026-102930 | HIGH | 7.7 | — | Sep 29, 2026 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip a... |
| CVE-2026-102925 | HIGH | 7.8 | 0.2% | Sep 29, 2026 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash a... |
| CVE-2026-102904 | MEDIUM | 5.4 | — | Sep 29, 2026 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit... |
| CVE-2026-102620 | LOW | 3.3 | 0.1% | Sep 29, 2026 | A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::c... |
| CVE-2026-102253 | HIGH | 7.5 | — | Sep 29, 2026 | iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to... |
| CVE-2026-96274 | HIGH | 7.4 | — | Sep 29, 2026 | In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connectio... |
| CVE-2026-94953 | HIGH | 8.8 | — | Sep 29, 2026 | A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware ... |
| CVE-2026-79538 | CRITICAL | 9.8 | — | Sep 29, 2026 | metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpo... |
| CVE-2026-79537 | CRITICAL | 9.1 | — | Sep 29, 2026 | metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session disp... |
| CVE-2026-79536 | CRITICAL | 9.1 | — | Sep 29, 2026 | bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. Thi... |
| CVE-2026-79535 | MEDIUM | 6.3 | — | Sep 29, 2026 | mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool (and the "voicemode config... |
| CVE-2026-79534 | MEDIUM | 5.9 | — | Sep 29, 2026 | mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in valid... |