CVE Vulnerability Database
Search and browse 420,383 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-13451 | HIGH | 7.7 | 0.2% | Oct 28, 2026 | A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources ... |
| CVE-2026-11854 | MEDIUM | 6.1 | 0.2% | Oct 28, 2026 | The authentication endpoint generates an error message that includes reflected data directly from the request without su... |
| CVE-2026-118655 | MEDIUM | 5.9 | 0.3% | Oct 28, 2026 | Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path ... |
| CVE-2026-118654 | MEDIUM | 5.9 | 0.3% | Oct 28, 2026 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after rout... |
| CVE-2026-118653 | MEDIUM | 5.3 | 0.4% | Oct 28, 2026 | Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Re... |
| CVE-2026-118652 | MEDIUM | 6.1 | 0.2% | Oct 28, 2026 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated ca... |
| CVE-2026-118651 | MEDIUM | 5.3 | 0.2% | Oct 28, 2026 | Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP hea... |
| CVE-2026-118650 | HIGH | 7.5 | 0.4% | Oct 28, 2026 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an en... |
| CVE-2026-118266 | MEDIUM | 5.3 | 0.2% | Oct 28, 2026 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as th... |
| CVE-2026-117574 | CRITICAL | 9.1 | 0.2% | Oct 28, 2026 | A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by su... |
| CVE-2026-115415 | MEDIUM | 6.5 | 0.3% | Oct 28, 2026 | Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 mig... |
| CVE-2026-109411 | HIGH | 8.1 | 0.6% | Oct 28, 2026 | An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated ... |
| CVE-2025-14260 | HIGH | 8.3 | 0.3% | Oct 28, 2026 | Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery... |
| CVE-2026-118688 | HIGH | 7.9 | 0.2% | Oct 28, 2026 | wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to ... |
| CVE-2026-118687 | MEDIUM | 6.5 | 0.2% | Oct 28, 2026 | Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does n... |
| CVE-2026-118686 | HIGH | 7.5 | 0.3% | Oct 28, 2026 | EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction ... |
| CVE-2026-118685 | MEDIUM | 6.5 | 0.2% | Oct 28, 2026 | ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the str... |
| CVE-2026-118684 | MEDIUM | 5.9 | 0.2% | Oct 28, 2026 | MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns T... |
| CVE-2026-118683 | HIGH | 8.8 | 0.5% | Oct 28, 2026 | MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a ... |
| CVE-2026-118681 | LOW | 3.7 | 0.2% | Oct 28, 2026 | go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live... |
| CVE-2026-118680 | MEDIUM | 4.4 | 0.5% | Oct 28, 2026 | SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath... |
| CVE-2026-118679 | HIGH | 7.5 | 0.3% | Oct 28, 2026 | n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhoo... |
| CVE-2026-118678 | HIGH | 7.1 | 0.3% | Oct 28, 2026 | n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users... |
| CVE-2026-118677 | MEDIUM | 5.9 | 0.2% | Oct 28, 2026 | n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop ap... |
| CVE-2026-118676 | HIGH | 7.1 | 0.2% | Oct 28, 2026 | n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use c... |