CVE Vulnerability Database
Search and browse 420,383 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-118601 | MEDIUM | 6.3 | 0.3% | Oct 28, 2026 | Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. This vulnerability allows network-adjace... |
| CVE-2026-118581 | MEDIUM | 6.5 | 0.2% | Oct 28, 2026 | A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-dec... |
| CVE-2026-118510 | HIGH | 8.8 | 0.3% | Oct 28, 2026 | A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the ab... |
| CVE-2026-117626 | MEDIUM | 4.3 | 0.2% | Oct 28, 2026 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the fil... |
| CVE-2026-117625 | MEDIUM | 4.3 | 0.2% | Oct 28, 2026 | A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read perm... |
| CVE-2026-117624 | HIGH | 8.8 | 0.4% | Oct 28, 2026 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing object... |
| CVE-2026-117623 | MEDIUM | 5.4 | 0.3% | Oct 28, 2026 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar over... |
| CVE-2026-117622 | MEDIUM | 6.1 | 0.3% | Oct 28, 2026 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpRespons... |
| CVE-2026-117621 | MEDIUM | 6.1 | 0.3% | Oct 28, 2026 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace brow... |
| CVE-2026-117620 | HIGH | 8.8 | 0.4% | Oct 28, 2026 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in ... |
| CVE-2026-117619 | HIGH | 8.1 | 0.3% | Oct 28, 2026 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, includ... |
| CVE-2026-117618 | HIGH | 8.1 | 0.3% | Oct 28, 2026 | In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not ch... |
| CVE-2026-117617 | HIGH | 8.1 | 0.5% | Oct 28, 2026 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only befor... |
| CVE-2026-117616 | HIGH | 8.8 | 0.6% | Oct 28, 2026 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validatin... |
| CVE-2026-117615 | MEDIUM | 6.5 | 0.4% | Oct 28, 2026 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being re... |
| CVE-2026-117614 | HIGH | 8.8 | 0.4% | Oct 28, 2026 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launc... |
| CVE-2026-117613 | MEDIUM | 5.4 | 0.3% | Oct 28, 2026 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, al... |
| CVE-2026-117612 | HIGH | 8.8 | 0.4% | Oct 28, 2026 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by th... |
| CVE-2026-116593 | HIGH | 8.1 | 0.2% | Oct 28, 2026 | Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate co... |
| CVE-2026-115644 | HIGH | 8.8 | 0.3% | Oct 28, 2026 | Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners i... |
| CVE-2026-114349 | MEDIUM | 6.5 | 0.2% | Oct 28, 2026 | When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed... |
| CVE-2026-112375 | MEDIUM | 6.5 | 0.2% | Oct 28, 2026 | An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read a file or ... |
| CVE-2026-111551 | HIGH | 7.5 | 0.2% | Oct 28, 2026 | Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array,... |
| CVE-2026-111496 | CRITICAL | 9.1 | 0.2% | Oct 28, 2026 | Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctua... |
| CVE-2026-111115 | CRITICAL | 9.1 | 0.2% | Oct 28, 2026 | Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender an... |