CVE Vulnerability Database
Search and browse 420,383 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-118036 | HIGH | 7.5 | 0.4% | Oct 28, 2026 | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop,... |
| CVE-2026-118035 | HIGH | 7.5 | 0.3% | Oct 28, 2026 | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient al... |
| CVE-2026-116404 | MEDIUM | 6.5 | — | Oct 28, 2026 | Missing Authorization vulnerability in David Anderson Redux Framework redux-framework allows Lifting Sensitive Data Embe... |
| CVE-2026-116393 | HIGH | 7.5 | — | Oct 28, 2026 | Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploiting Incorrectly Con... |
| CVE-2026-116392 | HIGH | 7.2 | — | Oct 28, 2026 | Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue a... |
| CVE-2026-116391 | HIGH | 8.8 | — | Oct 28, 2026 | Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This... |
| CVE-2026-115957 | MEDIUM | 6.5 | — | Oct 28, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Discussion Boar... |
| CVE-2026-115904 | CRITICAL | 9.6 | 0.7% | Oct 28, 2026 | Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.241... |
| CVE-2026-115612 | HIGH | 7.1 | — | Oct 28, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP... |
| CVE-2026-115609 | HIGH | 7.1 | — | Oct 28, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid in... |
| CVE-2026-115607 | CRITICAL | 9.3 | — | Oct 28, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP... |
| CVE-2026-115606 | HIGH | 7.1 | — | Oct 28, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crowd Favorite DXP... |
| CVE-2026-115596 | HIGH | 7.1 | — | Oct 28, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerc... |
| CVE-2026-115593 | HIGH | 7.1 | — | Oct 28, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements... |
| CVE-2026-115591 | HIGH | 7.5 | — | Oct 28, 2026 | Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-s... |
| CVE-2026-111850 | HIGH | 8.5 | — | Oct 28, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPr... |
| CVE-2026-111411 | CRITICAL | 9.3 | — | Oct 28, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Aut... |
| CVE-2026-81472 | MEDIUM | 4.2 | — | Oct 28, 2026 | Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (i... |
| CVE-2026-118485 | HIGH | 8.1 | 0.6% | Oct 28, 2026 | Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after... |
| CVE-2026-118477 | CRITICAL | 9.8 | 1.1% | Oct 28, 2026 | The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection... |
| CVE-2026-116855 | MEDIUM | 5.4 | — | Oct 28, 2026 | Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting In... |
| CVE-2026-114278 | CRITICAL | 9.8 | 0.9% | Oct 28, 2026 | The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespa... |
| CVE-2026-102799 | MEDIUM | 5.3 | 0.3% | Oct 28, 2026 | Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16 |
| CVE-2026-102790 | HIGH | 8.6 | 0.3% | Oct 28, 2026 | Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16 |
| CVE-2026-99216 | HIGH | 8.4 | 0.2% | Oct 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on ... |