CVE Vulnerability Database
Search and browse 425,147 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-6103 | LOW | 3.3 | 0.2% | Sep 25, 2026 | phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 oc... |
| CVE-2026-57864 | — | — | — | Sep 25, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-57443 | HIGH | 7.5 | 0.6% | Sep 25, 2026 | SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4... |
| CVE-2026-17545 | HIGH | 7.5 | 0.3% | Sep 25, 2026 | On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM... |
| CVE-2026-10758 | HIGH | 7.5 | 0.3% | Sep 25, 2026 | Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap... |
| CVE-2026-100417 | LOW | 3.1 | 0.2% | Sep 25, 2026 | RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests,... |
| CVE-2026-100391 | HIGH | 8.2 | 0.3% | Sep 25, 2026 | MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing a... |
| CVE-2026-100390 | HIGH | 7.4 | 0.3% | Sep 25, 2026 | Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded... |
| CVE-2026-100389 | HIGH | 8.1 | 0.6% | Sep 25, 2026 | GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment ha... |
| CVE-2026-100388 | MEDIUM | 5.4 | 0.2% | Sep 25, 2026 | RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages i... |
| CVE-2026-100387 | HIGH | 8.1 | 0.3% | Sep 25, 2026 | pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization tha... |
| CVE-2026-100380 | MEDIUM | 5.3 | — | Sep 25, 2026 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F... |
| CVE-2026-100379 | MEDIUM | 5.3 | — | Sep 25, 2026 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App a... |
| CVE-2026-100378 | MEDIUM | 5.3 | — | Sep 25, 2026 | Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionali... |
| CVE-2026-100377 | MEDIUM | 6.9 | — | Sep 25, 2026 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda ... |
| CVE-2026-100376 | MEDIUM | 4.8 | — | Sep 25, 2026 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F... |
| CVE-2026-100369 | HIGH | 8.4 | 0.4% | Sep 25, 2026 | CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libraries for invoking command-line programs... |
| CVE-2025-1218 | MEDIUM | 5.9 | 0.2% | Sep 25, 2026 | The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough b... |
| CVE-2025-14181 | MEDIUM | 6.5 | 0.3% | Sep 25, 2026 | The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is und... |
| CVE-2026-96878 | MEDIUM | 6.9 | 0.3% | Sep 25, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo ... |
| CVE-2026-96877 | MEDIUM | 6.9 | 0.3% | Sep 25, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo ... |
| CVE-2026-96876 | MEDIUM | 6.9 | 0.3% | Sep 25, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo ... |
| CVE-2026-96875 | MEDIUM | 6.9 | 0.3% | Sep 25, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo ... |
| CVE-2026-93682 | MEDIUM | 5.8 | 0.4% | Sep 25, 2026 | When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redi... |
| CVE-2026-5267 | HIGH | 7.5 | — | Sep 25, 2026 | Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API tha... |