CVE Vulnerability Database
Search and browse 420,229 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-77880 | HIGH | 7.8 | 0.8% | Nov 2, 2026 | Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API ... |
| CVE-2026-77879 | HIGH | 7.1 | 0.2% | Nov 2, 2026 | Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authenti... |
| CVE-2026-77878 | HIGH | 7.8 | 0.8% | Nov 2, 2026 | Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API ... |
| CVE-2026-77877 | HIGH | 7.8 | 0.2% | Nov 2, 2026 | Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attacke... |
| CVE-2026-77876 | HIGH | 8.8 | 2.2% | Nov 2, 2026 | Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_dir... |
| CVE-2026-2102 | MEDIUM | 6.1 | — | Nov 2, 2026 | wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The... |
| CVE-2026-16306 | CRITICAL | 9.8 | 0.2% | Nov 2, 2026 | Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote u... |
| CVE-2026-120501 | MEDIUM | 5.3 | 0.3% | Nov 2, 2026 | An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attac... |
| CVE-2026-120500 | MEDIUM | 6.1 | — | Nov 2, 2026 | An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code that ... |
| CVE-2026-115654 | MEDIUM | 6.9 | — | Nov 2, 2026 | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a... |
| CVE-2026-115653 | HIGH | 7 | — | Nov 2, 2026 | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempte... |
| CVE-2026-114408 | HIGH | 8.7 | 0.4% | Nov 2, 2026 | In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 ... |
| CVE-2026-109142 | HIGH | 8.4 | — | Nov 2, 2026 | When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the R... |
| CVE-2026-109141 | HIGH | 8.4 | — | Nov 2, 2026 | The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every reque... |
| CVE-2026-109140 | HIGH | 8.4 | — | Nov 2, 2026 | The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 ... |
| CVE-2026-104080 | HIGH | 7.8 | 1.2% | Nov 2, 2026 | Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API ... |
| CVE-2026-73697 | HIGH | 8.8 | — | Nov 2, 2026 | Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerabi... |
| CVE-2026-73696 | HIGH | 8.1 | 0.5% | Nov 2, 2026 | Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user pane... |
| CVE-2026-73695 | HIGH | 8.8 | — | Nov 2, 2026 | Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php... |
| CVE-2026-120492 | MEDIUM | 5.4 | 0.2% | Nov 2, 2026 | Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass pat... |
| CVE-2026-120491 | MEDIUM | 5.4 | — | Nov 2, 2026 | Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client u... |
| CVE-2026-120489 | MEDIUM | 4.3 | — | Nov 2, 2026 | Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authen... |
| CVE-2026-120488 | MEDIUM | 5.4 | — | Nov 2, 2026 | LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with pos... |
| CVE-2026-120487 | HIGH | 7.2 | 0.5% | Nov 2, 2026 | LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that... |
| CVE-2026-120461 | HIGH | 8.8 | — | Nov 2, 2026 | Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves comma... |