CVE Vulnerability Database
Search and browse 425,104 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-90926 | HIGH | 8.8 | — | Sep 28, 2026 | Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Cons... |
| CVE-2026-90925 | HIGH | 7.1 | — | Sep 28, 2026 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Teleco... |
| CVE-2026-90924 | CRITICAL | 9.8 | — | Sep 28, 2026 | Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign ... |
| CVE-2026-87799 | CRITICAL | 9.9 | — | Sep 28, 2026 | Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10,... |
| CVE-2026-87798 | MEDIUM | 5.8 | — | Sep 28, 2026 | Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to ... |
| CVE-2026-86595 | HIGH | 8.8 | — | Sep 28, 2026 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Arch... |
| CVE-2026-86335 | MEDIUM | 6.3 | — | Sep 28, 2026 | Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restri... |
| CVE-2026-86334 | MEDIUM | 4.2 | — | Sep 28, 2026 | Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, ... |
| CVE-2026-85526 | CRITICAL | 9.9 | — | Sep 28, 2026 | Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with in... |
| CVE-2026-85185 | CRITICAL | 9.6 | — | Sep 28, 2026 | Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 an... |
| CVE-2026-73642 | CRITICAL | 9.2 | 0.4% | Sep 28, 2026 | Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can s... |
| CVE-2026-73641 | MEDIUM | 5.1 | 0.3% | Sep 28, 2026 | Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted ... |
| CVE-2026-73640 | CRITICAL | 9.3 | 0.3% | Sep 28, 2026 | Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenti... |
| CVE-2026-15953 | MEDIUM | 5 | — | Sep 28, 2026 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and contr... |
| CVE-2026-15952 | MEDIUM | 6.4 | — | Sep 28, 2026 | Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600). ... |
| CVE-2026-101072 | CRITICAL | 10 | — | Sep 28, 2026 | A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.c... |
| CVE-2026-101071 | MEDIUM | 6.3 | — | Sep 28, 2026 | A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown cod... |
| CVE-2026-101070 | MEDIUM | 5.3 | 0.7% | Sep 28, 2026 | A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is the function files o... |
| CVE-2026-86330 | HIGH | 7.2 | 2.2% | Sep 28, 2026 | An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This comp... |
| CVE-2026-82936 | MEDIUM | 5.9 | — | Sep 28, 2026 | mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express ... |
| CVE-2026-82935 | MEDIUM | 6.9 | — | Sep 28, 2026 | mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its produc... |
| CVE-2026-82933 | MEDIUM | 6 | — | Sep 28, 2026 | mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication ... |
| CVE-2026-82932 | MEDIUM | 5.3 | — | Sep 28, 2026 | mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, includin... |
| CVE-2026-82930 | MEDIUM | 6.4 | — | Sep 28, 2026 | mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocke... |
| CVE-2026-82929 | MEDIUM | 6.3 | — | Sep 28, 2026 | mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation... |