CVE Vulnerability Database
Search and browse 425,131 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-88771 | CRITICAL | 9.8 | — | Sep 27, 2026 | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: b... |
| CVE-2026-101050 | MEDIUM | 6.5 | — | Sep 27, 2026 | Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credent... |
| CVE-2026-101049 | MEDIUM | 6.5 | — | Sep 27, 2026 | Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing... |
| CVE-2026-101042 | MEDIUM | 6.4 | 0.2% | Sep 27, 2026 | Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-ba... |
| CVE-2026-101041 | MEDIUM | 6.3 | 0.2% | Sep 27, 2026 | The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check... |
| CVE-2026-101033 | MEDIUM | 4.3 | 0.2% | Sep 27, 2026 | KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operati... |
| CVE-2026-101032 | HIGH | 7 | 0.1% | Sep 27, 2026 | navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Atta... |
| CVE-2026-100872 | HIGH | 7.5 | — | Sep 27, 2026 | Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthentic... |
| CVE-2026-100871 | HIGH | 8.8 | 0.3% | Sep 27, 2026 | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT token... |
| CVE-2026-100870 | HIGH | 8.8 | 0.3% | Sep 27, 2026 | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the r... |
| CVE-2026-100869 | MEDIUM | 5.9 | — | Sep 27, 2026 | Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing cust... |
| CVE-2026-100868 | MEDIUM | 6.3 | 0.3% | Sep 27, 2026 | Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in si... |
| CVE-2026-100867 | LOW | 3.3 | 0.1% | Sep 27, 2026 | spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before renderi... |
| CVE-2026-100866 | LOW | 3.3 | 0.1% | Sep 27, 2026 | onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, ... |
| CVE-2026-97165 | MEDIUM | 6.1 | 0.2% | Sep 27, 2026 | Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” par... |
| CVE-2026-97164 | HIGH | 8.1 | 0.3% | Sep 27, 2026 | Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extensio... |
| CVE-2026-100749 | MEDIUM | 4.3 | 0.1% | Sep 27, 2026 | Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned fi... |
| CVE-2026-100748 | HIGH | 8.8 | 0.2% | Sep 27, 2026 | Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0 |
| CVE-2026-100747 | MEDIUM | 6.5 | 0.1% | Sep 27, 2026 | Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF toke... |
| CVE-2026-94417 | MEDIUM | 5.3 | 0.2% | Sep 27, 2026 | When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL ski... |
| CVE-2026-93304 | LOW | 3.7 | 0.2% | Sep 27, 2026 | A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has... |
| CVE-2026-93302 | HIGH | 8.2 | 0.3% | Sep 27, 2026 | MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any ... |
| CVE-2026-89136 | HIGH | 8.3 | 0.6% | Sep 27, 2026 | When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited s... |
| CVE-2026-89135 | MEDIUM | 6.5 | 0.2% | Sep 27, 2026 | A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certifi... |
| CVE-2026-89134 | CRITICAL | 9.1 | 0.1% | Sep 27, 2026 | A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN ... |