CVE Vulnerability Database
Search and browse 420,244 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-63115 | MEDIUM | 5.3 | 0.1% | Oct 30, 2026 | ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handle... |
| CVE-2026-62347 | MEDIUM | 5.9 | 0.3% | Oct 30, 2026 | Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call `S... |
| CVE-2026-62277 | MEDIUM | 6.5 | 0.3% | Oct 30, 2026 | LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, `Print... |
| CVE-2026-55614 | MEDIUM | 6.9 | 0.4% | Oct 30, 2026 | uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases heade... |
| CVE-2026-55613 | MEDIUM | 6.9 | 0.4% | Oct 30, 2026 | uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HT... |
| CVE-2026-55612 | LOW | 3.7 | 0.3% | Oct 30, 2026 | uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an in... |
| CVE-2026-55147 | MEDIUM | 6.3 | 0.2% | Oct 30, 2026 | LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project... |
| CVE-2026-55146 | MEDIUM | 4.3 | 0.2% | Oct 30, 2026 | LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project... |
| CVE-2026-16760 | HIGH | 8.8 | 0.5% | Oct 30, 2026 | In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_... |
| CVE-2026-118938 | HIGH | 8.8 | 0.5% | Oct 30, 2026 | In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Val... |
| CVE-2026-111578 | HIGH | 7.5 | 0.3% | Oct 30, 2026 | The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape sev... |
| CVE-2026-62991 | MEDIUM | 6.5 | 0.2% | Oct 30, 2026 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show`... |
| CVE-2026-62990 | HIGH | 8.7 | 0.2% | Oct 30, 2026 | Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1... |
| CVE-2026-62989 | HIGH | 8.1 | 0.3% | Oct 30, 2026 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Li... |
| CVE-2026-62979 | HIGH | 8.4 | 0.4% | Oct 30, 2026 | jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handl... |
| CVE-2026-62968 | HIGH | 8.7 | 0.4% | Oct 30, 2026 | Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input... |
| CVE-2026-62967 | HIGH | 8.1 | 0.4% | Oct 30, 2026 | ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenti... |
| CVE-2026-62966 | HIGH | 7.5 | 0.4% | Oct 30, 2026 | ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to v... |
| CVE-2026-62965 | HIGH | 7 | 0.3% | Oct 30, 2026 | SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in `sabnzbd/api.py`... |
| CVE-2026-62958 | HIGH | 7.9 | 0.2% | Oct 30, 2026 | libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host... |
| CVE-2026-62864 | HIGH | 7.5 | 0.3% | Oct 30, 2026 | Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-para... |
| CVE-2026-62863 | CRITICAL | 9.6 | 0.3% | Oct 30, 2026 | MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its ... |
| CVE-2026-62860 | MEDIUM | 5.3 | 0.2% | Oct 30, 2026 | Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint... |
| CVE-2026-62853 | CRITICAL | 9.9 | 0.4% | Oct 30, 2026 | ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-s... |
| CVE-2026-62849 | CRITICAL | 9.1 | 0.5% | Oct 30, 2026 | ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengin... |