CVE Vulnerability Database
Search and browse 420,251 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-61586 | HIGH | 8.2 | 0.4% | Oct 30, 2026 | Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory doe... |
| CVE-2026-59978 | HIGH | 7.5 | — | Oct 30, 2026 | AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?scrip... |
| CVE-2026-54855 | HIGH | 7.1 | — | Oct 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. |
| CVE-2026-54854 | MEDIUM | 6.3 | — | Oct 30, 2026 | Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. |
| CVE-2026-54850 | MEDIUM | 6.5 | — | Oct 30, 2026 | Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions. |
| CVE-2026-52710 | MEDIUM | 5.3 | — | Oct 30, 2026 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT ̵... |
| CVE-2026-48201 | HIGH | 7.1 | — | Oct 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions. |
| CVE-2026-46560 | HIGH | 7.5 | 0.2% | Oct 30, 2026 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module op... |
| CVE-2026-39786 | HIGH | 7.1 | — | Oct 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions. |
| CVE-2026-39739 | MEDIUM | 6.5 | — | Oct 30, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force U... |
| CVE-2026-39738 | CRITICAL | 9.8 | 0.4% | Oct 30, 2026 | Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Inj... |
| CVE-2026-39734 | HIGH | 7.5 | — | Oct 30, 2026 | Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions. |
| CVE-2026-39732 | CRITICAL | 9.3 | — | Oct 30, 2026 | Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. |
| CVE-2026-28160 | HIGH | 7.1 | 0.2% | Oct 30, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCa... |
| CVE-2026-27061 | MEDIUM | 6.5 | — | Oct 30, 2026 | Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions. |
| CVE-2026-120046 | MEDIUM | 5.3 | 0.3% | Oct 30, 2026 | Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows... |
| CVE-2026-120007 | MEDIUM | 6.5 | — | Oct 30, 2026 | NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act ... |
| CVE-2026-119842 | MEDIUM | 6.5 | 0.3% | Oct 30, 2026 | A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle ... |
| CVE-2026-119729 | MEDIUM | 6.5 | 0.4% | Oct 30, 2026 | A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows... |
| CVE-2026-119728 | MEDIUM | 6.5 | 0.3% | Oct 30, 2026 | A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or n... |
| CVE-2026-119727 | MEDIUM | 6.5 | 0.3% | Oct 30, 2026 | A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream con... |
| CVE-2026-119526 | CRITICAL | 9.8 | — | Oct 30, 2026 | Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Roy... |
| CVE-2026-119117 | MEDIUM | 6.5 | — | Oct 30, 2026 | Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the li... |
| CVE-2026-118090 | HIGH | 8.8 | — | Oct 30, 2026 | Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. |
| CVE-2026-118089 | HIGH | 7.2 | — | Oct 30, 2026 | Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. |