CVE Vulnerability Database
Search and browse 420,251 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-119330 | LOW | 3.5 | 0.2% | Oct 30, 2026 | Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation A... |
| CVE-2026-119329 | MEDIUM | 4.3 | 0.3% | Oct 30, 2026 | Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used ... |
| CVE-2026-119328 | MEDIUM | 6.5 | 0.4% | Oct 30, 2026 | Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machin... |
| CVE-2026-116252 | MEDIUM | 6.5 | 0.2% | Oct 30, 2026 | pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq tre... |
| CVE-2026-116251 | MEDIUM | 5.4 | 0.1% | Oct 30, 2026 | pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own chang... |
| CVE-2026-116250 | MEDIUM | 6.5 | 0.1% | Oct 30, 2026 | In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permissio... |
| CVE-2026-116249 | HIGH | 8.4 | 0.2% | Oct 30, 2026 | In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relat... |
| CVE-2026-116248 | MEDIUM | 6.8 | 0.2% | Oct 30, 2026 | In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Sha... |
| CVE-2026-116247 | CRITICAL | 9.6 | 0.1% | Oct 30, 2026 | When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one coul... |
| CVE-2026-116246 | HIGH | 7.6 | 0.2% | Oct 30, 2026 | To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrot... |
| CVE-2026-116245 | CRITICAL | 9.6 | 0.2% | Oct 30, 2026 | libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry ... |
| CVE-2026-116244 | CRITICAL | 9.6 | 0.3% | Oct 30, 2026 | When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME fro... |
| CVE-2026-116243 | HIGH | 8.8 | 0.3% | Oct 30, 2026 | pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server... |
| CVE-2026-116242 | CRITICAL | 9.6 | 0.2% | Oct 30, 2026 | pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so... |
| CVE-2026-116241 | HIGH | 8.8 | 0.3% | Oct 30, 2026 | pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the que... |
| CVE-2026-116240 | MEDIUM | 6.5 | 0.3% | Oct 30, 2026 | In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds... |
| CVE-2026-116239 | HIGH | 8.8 | 0.4% | Oct 30, 2026 | In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an ... |
| CVE-2026-116238 | HIGH | 8.1 | 0.4% | Oct 30, 2026 | In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit coul... |
| CVE-2026-115830 | HIGH | 8.7 | 0.3% | Oct 30, 2026 | In Secret Server on-prem versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and ... |
| CVE-2026-115829 | CRITICAL | 9.9 | 0.3% | Oct 30, 2026 | In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any ... |
| CVE-2026-115828 | CRITICAL | 9.4 | 0.4% | Oct 30, 2026 | In Secret Server on-prem versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check ... |
| CVE-2026-94175 | HIGH | 7.1 | — | Oct 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions. |
| CVE-2026-90888 | CRITICAL | 9.8 | — | Oct 30, 2026 | Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. |
| CVE-2026-7005 | MEDIUM | 6.1 | — | Oct 30, 2026 | WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows at... |
| CVE-2026-7004 | MEDIUM | 6.1 | — | Oct 30, 2026 | WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allow... |