CVE Vulnerability Database
Search and browse 395,431 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-5497 | HIGH | 7.5 | 0.5% | Jun 11, 2026 | vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded f... |
| CVE-2026-53911 | MEDIUM | 6.3 | 0.2% | Jun 11, 2026 | Cerebrate before version 1.37 allowed the id primary key field to be supplied through request input during CRUD edit ope... |
| CVE-2026-11850 | MEDIUM | 5 | 0.3% | Jun 11, 2026 | An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_lda... |
| CVE-2025-7064 | MEDIUM | 6.6 | 0.1% | Jun 11, 2026 | Authentication bypass by primary weakness vulnerability in ABB Freelance. This issue affects Freelance: through 2013, 2... |
| CVE-2022-44630 | MEDIUM | 4.6 | 0.1% | Jun 11, 2026 | Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Reque... |
| CVE-2022-42479 | MEDIUM | 5.4 | 0.2% | Jun 11, 2026 | Missing Authorization vulnerability in TemplateHouse Soledad allows Accessing Functionality Not Properly Constrained by ... |
| CVE-2026-53901 | HIGH | 8.7 | 0.3% | Jun 11, 2026 | Cerebrate before version 1.37 contains a mass-assignment vulnerability in the generic CRUD add path. The add() handler a... |
| CVE-2024-32110 | MEDIUM | 4.3 | 0.1% | Jun 11, 2026 | Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. WpEvently allows Cross Site Request Forgery. This is... |
| CVE-2023-40200 | MEDIUM | 5.3 | 0.2% | Jun 11, 2026 | Authorization bypass through User-Controlled key vulnerability in Essential Plugin WP Logo Showcase Responsive Slider an... |
| CVE-2023-33999 | HIGH | 7.1 | 0.3% | Jun 11, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Lo... |
| CVE-2026-41856 | HIGH | 7.5 | 0.4% | Jun 11, 2026 | The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on... |
| CVE-2026-41700 | HIGH | 8.1 | 0.2% | Jun 11, 2026 | Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacki... |
| CVE-2026-41699 | CRITICAL | 9.8 | 0.4% | Jun 11, 2026 | Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An a... |
| CVE-2026-41001 | MEDIUM | 5.3 | 0.1% | Jun 11, 2026 | Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's da... |
| CVE-2026-41000 | LOW | 3.7 | 0.2% | Jun 11, 2026 | Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-ti... |
| CVE-2026-40999 | HIGH | 8.6 | 0.4% | Jun 11, 2026 | When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections ... |
| CVE-2026-40998 | HIGH | 8.2 | 0.4% | Jun 11, 2026 | Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed atta... |
| CVE-2026-40997 | MEDIUM | 5.3 | 0.4% | Jun 11, 2026 | Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or dis... |
| CVE-2026-40996 | MEDIUM | 4.8 | 0.1% | Jun 11, 2026 | Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for ... |
| CVE-2026-40995 | MEDIUM | 5.4 | 0.1% | Jun 11, 2026 | X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped... |
| CVE-2026-40994 | HIGH | 8.2 | 0.2% | Jun 11, 2026 | Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation di... |
| CVE-2026-40992 | MEDIUM | 5 | 0.1% | Jun 11, 2026 | Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail... |
| CVE-2026-40987 | HIGH | 7.1 | 0.2% | Jun 11, 2026 | A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the ... |
| CVE-2026-40986 | MEDIUM | 4.8 | 0.2% | Jun 11, 2026 | Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not... |
| CVE-2026-10795 | HIGH | 8.1 | 3.6% | Jun 11, 2026 | The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all version... |