CVE Vulnerability Database
Search and browse 394,378 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-57281 | HIGH | 7.5 | 0.7% | Jun 24, 2026 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carr... |
| CVE-2026-57280 | HIGH | 8.8 | 0.4% | Jun 24, 2026 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the ... |
| CVE-2026-42450 | HIGH | 8.4 | 0.1% | Jun 24, 2026 | OpenColorIO is a color management framework for visual effects and animation. Prior to version 2.5.2, `FileFormatSpi3D.c... |
| CVE-2026-35025 | HIGH | 8.6 | 0.3% | Jun 24, 2026 | ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users... |
| CVE-2026-29034 | — | — | — | Jun 24, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-12537 | HIGH | 7.8 | 0.3% | Jun 24, 2026 | Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) ... |
| CVE-2026-56761 | MEDIUM | 4.3 | 0.2% | Jun 24, 2026 | hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to injec... |
| CVE-2026-56370 | HIGH | 7.8 | 0.1% | Jun 24, 2026 | ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing... |
| CVE-2026-56368 | HIGH | 7.5 | 0.2% | Jun 24, 2026 | ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allo... |
| CVE-2026-56358 | MEDIUM | 5.4 | 0.1% | Jun 24, 2026 | n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site sc... |
| CVE-2026-56351 | CRITICAL | 9.6 | 0.2% | Jun 24, 2026 | n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allow... |
| CVE-2026-56338 | MEDIUM | 6.9 | 0.3% | Jun 24, 2026 | Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verifi... |
| CVE-2026-56337 | MEDIUM | 5.3 | 0.3% | Jun 24, 2026 | Capgo before 12.128.2 contains an information disclosure vulnerability in the public.exist_app_v2 RPC function that allo... |
| CVE-2026-56310 | MEDIUM | 5.3 | 0.2% | Jun 24, 2026 | Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organization/members endpoint that all... |
| CVE-2026-56302 | MEDIUM | 6.9 | 0.2% | Jun 24, 2026 | Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthentica... |
| CVE-2026-56272 | MEDIUM | 5.6 | 0.1% | Jun 24, 2026 | Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recom... |
| CVE-2026-56270 | HIGH | 7.5 | 0.4% | Jun 24, 2026 | Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginm... |
| CVE-2026-56269 | MEDIUM | 4.6 | 0.1% | Jun 24, 2026 | Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' fo... |
| CVE-2026-56262 | MEDIUM | 6.5 | 0.4% | Jun 24, 2026 | Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauth... |
| CVE-2026-56257 | HIGH | 7.1 | 0.2% | Jun 24, 2026 | Capgo before 12.128.2 allows direct patching of public.apps.owner_org through PostgREST, bypassing the transfer_app() wo... |
| CVE-2026-56256 | HIGH | 7.1 | 0.2% | Jun 24, 2026 | Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) ma... |
| CVE-2026-56245 | HIGH | 8.8 | 0.3% | Jun 24, 2026 | Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time ... |
| CVE-2026-56244 | HIGH | 7.1 | 0.2% | Jun 24, 2026 | Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient ro... |
| CVE-2026-56237 | CRITICAL | 9.3 | 0.3% | Jun 24, 2026 | Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are e... |
| CVE-2026-56232 | HIGH | 8.8 | 0.3% | Jun 24, 2026 | Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via x-limited... |