CVE Vulnerability Database
Search and browse 420,253 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-119709 | MEDIUM | 5.8 | — | Oct 30, 2026 | Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata P... |
| CVE-2026-119708 | MEDIUM | 6.5 | 0.3% | Oct 30, 2026 | abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name... |
| CVE-2026-119707 | HIGH | 7.1 | 0.3% | Oct 30, 2026 | SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write rout... |
| CVE-2026-119706 | CRITICAL | 9.8 | — | Oct 30, 2026 | InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remot... |
| CVE-2026-119705 | MEDIUM | 5.3 | — | Oct 30, 2026 | SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthen... |
| CVE-2026-119704 | MEDIUM | 6.8 | 0.1% | Oct 30, 2026 | Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allow... |
| CVE-2026-119703 | MEDIUM | 4.8 | 0.3% | Oct 30, 2026 | xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that ... |
| CVE-2026-119702 | MEDIUM | 6.5 | — | Oct 30, 2026 | WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthe... |
| CVE-2026-119701 | MEDIUM | 5.3 | — | Oct 30, 2026 | WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood pa... |
| CVE-2026-119700 | MEDIUM | 5.3 | 0.4% | Oct 30, 2026 | WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determ... |
| CVE-2026-119699 | MEDIUM | 5.3 | 0.5% | Oct 30, 2026 | WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticat... |
| CVE-2026-119479 | MEDIUM | 5.3 | — | Oct 30, 2026 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder... |
| CVE-2026-119369 | MEDIUM | 6.5 | — | Oct 30, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / Stell... |
| CVE-2026-119291 | MEDIUM | 5.5 | 0.1% | Oct 30, 2026 | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect s... |
| CVE-2026-119290 | HIGH | 7.5 | — | Oct 30, 2026 | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered repor... |
| CVE-2026-119289 | HIGH | 7.1 | 0.2% | Oct 30, 2026 | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...)... |
| CVE-2026-119288 | HIGH | 7 | — | Oct 30, 2026 | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Win... |
| CVE-2026-119287 | HIGH | 8 | 0.2% | Oct 30, 2026 | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode... |
| CVE-2026-118238 | HIGH | 7.2 | — | Oct 30, 2026 | The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due... |
| CVE-2026-117184 | HIGH | 7.5 | 0.2% | Oct 30, 2026 | An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a craft... |
| CVE-2026-117183 | HIGH | 7.5 | 0.2% | Oct 30, 2026 | A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the... |
| CVE-2026-117182 | MEDIUM | 5.4 | 0.3% | Oct 30, 2026 | An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 all... |
| CVE-2026-116407 | MEDIUM | 5.4 | — | Oct 30, 2026 | Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Conf... |
| CVE-2026-105456 | MEDIUM | 5.3 | — | Oct 30, 2026 | RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link tha... |
| CVE-2026-105455 | MEDIUM | 5.3 | — | Oct 30, 2026 | RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an inciden... |