CVE Vulnerability Database
Search and browse 425,147 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-100527 | MEDIUM | 5.3 | 0.3% | Sep 26, 2026 | OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthent... |
| CVE-2026-100526 | MEDIUM | 5.3 | 0.3% | Sep 26, 2026 | OpenClaw's Discord integration (npm package @openclaw/discord) before version 2026.9.3 could lose the sender-scoped medi... |
| CVE-2026-100525 | MEDIUM | 4.3 | 0.2% | Sep 26, 2026 | The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) before version 2026.9.3 does not enforce t... |
| CVE-2026-100524 | MEDIUM | 5.4 | 0.1% | Sep 26, 2026 | Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attacker... |
| CVE-2026-100523 | MEDIUM | 6.1 | 0.2% | Sep 26, 2026 | Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter ... |
| CVE-2026-100522 | MEDIUM | 6.1 | — | Sep 26, 2026 | Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is ... |
| CVE-2026-100521 | MEDIUM | 6.1 | 0.2% | Sep 26, 2026 | Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter t... |
| CVE-2026-100520 | HIGH | 8.8 | 0.9% | Sep 26, 2026 | Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that... |
| CVE-2026-100505 | MEDIUM | 4.4 | 0.1% | Sep 26, 2026 | Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when d... |
| CVE-2026-100504 | HIGH | 7 | 0.1% | Sep 26, 2026 | Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 ... |
| CVE-2026-100503 | MEDIUM | 5.5 | 0.1% | Sep 26, 2026 | Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter f... |
| CVE-2026-96795 | HIGH | 8.8 | — | Sep 25, 2026 | Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py acc... |
| CVE-2026-86066 | MEDIUM | 5.9 | 0.2% | Sep 25, 2026 | Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-a... |
| CVE-2026-57449 | HIGH | 7.1 | 0.2% | Sep 25, 2026 | Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authe... |
| CVE-2026-9655 | — | — | — | Sep 25, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-9652 | — | — | — | Sep 25, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-92842 | MEDIUM | 5.9 | 0.2% | Sep 25, 2026 | The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a l... |
| CVE-2026-91768 | MEDIUM | 6.5 | 0.4% | Sep 25, 2026 | The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen... |
| CVE-2026-88003 | HIGH | 7.5 | — | Sep 25, 2026 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, Invo... |
| CVE-2026-7800 | — | — | — | Sep 25, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-7799 | — | — | — | Sep 25, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-71483 | HIGH | 8.5 | 0.3% | Sep 25, 2026 | Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected b... |
| CVE-2026-63432 | MEDIUM | 6.5 | — | Sep 25, 2026 | Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the get_mail_preview handlers in recruitment/views/... |
| CVE-2026-63431 | MEDIUM | 6.5 | 0.2% | Sep 25, 2026 | Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/component_views.py does not consistently autho... |
| CVE-2026-53973 | — | — | — | Sep 25, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |