CVE Vulnerability Database
Search and browse 420,242 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-120448 | HIGH | 8.1 | — | Nov 2, 2026 | DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows... |
| CVE-2026-120447 | HIGH | 8.1 | 0.5% | Nov 2, 2026 | HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choo... |
| CVE-2026-120446 | CRITICAL | 9.4 | 1.0% | Nov 2, 2026 | madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API be... |
| CVE-2026-120445 | HIGH | 8.8 | — | Nov 2, 2026 | madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows a... |
| CVE-2026-120444 | HIGH | 8.1 | — | Nov 2, 2026 | GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary ... |
| CVE-2026-120443 | MEDIUM | 6.1 | 0.3% | Nov 2, 2026 | GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inje... |
| CVE-2026-120442 | CRITICAL | 9.8 | 0.5% | Nov 2, 2026 | ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to for... |
| CVE-2026-120441 | MEDIUM | 5.3 | — | Nov 2, 2026 | OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unaut... |
| CVE-2026-120440 | MEDIUM | 5.3 | — | Nov 2, 2026 | QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the ... |
| CVE-2026-120439 | HIGH | 7 | 0.3% | Nov 2, 2026 | QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cau... |
| CVE-2026-120438 | HIGH | 7.8 | 0.1% | Nov 2, 2026 | QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a he... |
| CVE-2026-120437 | MEDIUM | 6.1 | — | Nov 2, 2026 | Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in ... |
| CVE-2026-120436 | HIGH | 7.8 | — | Nov 2, 2026 | Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that c... |
| CVE-2026-120435 | HIGH | 7.8 | 0.1% | Nov 2, 2026 | Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caus... |
| CVE-2026-120434 | HIGH | 7.8 | 0.1% | Nov 2, 2026 | Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in pictto... |
| CVE-2026-120433 | HIGH | 7.8 | — | Nov 2, 2026 | Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the pi... |
| CVE-2026-120432 | HIGH | 7.8 | — | Nov 2, 2026 | Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows at... |
| CVE-2026-120431 | HIGH | 7.8 | 0.1% | Nov 2, 2026 | Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopn... |
| CVE-2026-120430 | MEDIUM | 5.4 | 0.3% | Nov 2, 2026 | Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that... |
| CVE-2026-120429 | HIGH | 7.1 | — | Nov 2, 2026 | Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privi... |
| CVE-2026-120428 | MEDIUM | 6.1 | — | Nov 2, 2026 | PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attacke... |
| CVE-2026-120427 | MEDIUM | 4.3 | 0.3% | Nov 2, 2026 | MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated use... |
| CVE-2026-120426 | HIGH | 7.5 | 0.4% | Nov 2, 2026 | OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve rout... |
| CVE-2026-120425 | MEDIUM | 6.5 | — | Nov 2, 2026 | Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that al... |
| CVE-2026-120318 | HIGH | 7.2 | — | Nov 2, 2026 | Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorizati... |