CVE Vulnerability Database
Search and browse 390,041 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-49147 | HIGH | 7.5 | — | Jul 8, 2026 | App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output m... |
| CVE-2026-49146 | HIGH | 7.5 | — | Jul 8, 2026 | App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ac... |
| CVE-2026-49145 | HIGH | 7.5 | — | Jul 8, 2026 | App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up th... |
| CVE-2026-24700 | HIGH | 7.2 | 1.0% | Jul 8, 2026 | An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W with ... |
| CVE-2026-24699 | HIGH | 7.2 | 1.0% | Jul 8, 2026 | An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W with f... |
| CVE-2026-24698 | HIGH | 7.2 | 1.0% | Jul 8, 2026 | An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" binary in Cisco RV130/... |
| CVE-2026-24697 | HIGH | 7.2 | 1.0% | Jul 8, 2026 | An OS command injection vulnerability exists in the start_bonjour() function of the "rc" binary in Cisco RV130/RV130W wi... |
| CVE-2026-15067 | HIGH | 8.8 | 0.4% | Jul 8, 2026 | Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection ... |
| CVE-2026-15062 | CRITICAL | 9.6 | 0.3% | Jul 8, 2026 | SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allo... |
| CVE-2026-15044 | MEDIUM | 6.3 | 0.3% | Jul 8, 2026 | A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardrails, if a specific s... |
| CVE-2026-15036 | MEDIUM | 4.3 | 0.4% | Jul 8, 2026 | A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of t... |
| CVE-2026-11903 | MEDIUM | 5.4 | 0.3% | Jul 8, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Tr... |
| CVE-2026-10708 | HIGH | 7.5 | 0.1% | Jul 8, 2026 | This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A single request to a min... |
| CVE-2026-10706 | HIGH | 7.5 | 0.1% | Jul 8, 2026 | In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavi... |
| CVE-2026-10699 | HIGH | 7.5 | 0.3% | Jul 8, 2026 | Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). ... |
| CVE-2026-10698 | HIGH | 7.2 | 0.4% | Jul 8, 2026 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Report... |
| CVE-2026-60125 | MEDIUM | 5.3 | 0.2% | Jul 8, 2026 | MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not en... |
| CVE-2026-60124 | MEDIUM | 5.3 | 0.2% | Jul 8, 2026 | An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys wit... |
| CVE-2026-60092 | MEDIUM | 6.1 | 0.2% | Jul 8, 2026 | AVideo (Meet plugin) through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 contains a stored cross-site scripting vuln... |
| CVE-2026-59257 | HIGH | 8.8 | 0.3% | Jul 8, 2026 | n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy My... |
| CVE-2026-59253 | MEDIUM | 5 | — | Jul 8, 2026 | n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to f... |
| CVE-2026-58657 | MEDIUM | 4.8 | — | Jul 8, 2026 | Grav before 2.0.0 (affected through 2.0.0-rc.9 and the 2.0 branch) contains a stored CSS injection vulnerability in the ... |
| CVE-2026-58656 | HIGH | 8.7 | — | Jul 8, 2026 | Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Cont... |
| CVE-2026-58654 | MEDIUM | 5.3 | — | Jul 8, 2026 | The Grav API plugin (getgrav/grav-plugin-api) 1.0.0 contains an unrestricted file upload vulnerability in the avatar upl... |
| CVE-2026-58480 | CRITICAL | 9.8 | — | Jul 8, 2026 | Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability... |