CVE Vulnerability Database
Search and browse 420,405 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-117610 | HIGH | 7.5 | 0.4% | Oct 28, 2026 | libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlpar... |
| CVE-2026-117609 | HIGH | 7.1 | 0.4% | Oct 28, 2026 | rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attacker... |
| CVE-2026-117608 | MEDIUM | 6.1 | 0.1% | Oct 28, 2026 | Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers t... |
| CVE-2026-117607 | HIGH | 7.2 | 0.7% | Oct 28, 2026 | Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with... |
| CVE-2026-117606 | MEDIUM | 5.4 | 0.3% | Oct 28, 2026 | NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate ot... |
| CVE-2026-117605 | MEDIUM | 4.3 | 0.3% | Oct 28, 2026 | nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAd... |
| CVE-2026-115624 | MEDIUM | 6.9 | 0.2% | Oct 28, 2026 | GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vuln... |
| CVE-2026-111314 | HIGH | 7.2 | 0.2% | Oct 28, 2026 | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cr... |
| CVE-2026-109999 | HIGH | 7.2 | 0.3% | Oct 28, 2026 | The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media &... |
| CVE-2026-109974 | MEDIUM | 6.4 | 0.2% | Oct 28, 2026 | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is ... |
| CVE-2026-109848 | LOW | 2.3 | 0.2% | Oct 28, 2026 | GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use o... |
| CVE-2026-109209 | MEDIUM | 6.4 | 0.2% | Oct 28, 2026 | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is ... |
| CVE-2026-107745 | MEDIUM | 4.2 | 0.3% | Oct 28, 2026 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file d... |
| CVE-2026-107625 | MEDIUM | 6.4 | 0.2% | Oct 28, 2026 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi... |
| CVE-2026-105272 | LOW | 2.3 | 0.2% | Oct 28, 2026 | GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper us... |
| CVE-2015-20129 | HIGH | 8.8 | 0.2% | Oct 28, 2026 | CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrativ... |
| CVE-2014-125138 | HIGH | 8.8 | 0.4% | Oct 28, 2026 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted ... |
| CVE-2014-125137 | MEDIUM | 6.5 | 0.7% | Oct 28, 2026 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inc... |
| CVE-2014-125136 | MEDIUM | 5.9 | 0.4% | Oct 28, 2026 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information d... |
| CVE-2013-20009 | MEDIUM | 4.8 | 0.2% | Oct 28, 2026 | Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers... |
| CVE-2013-20008 | MEDIUM | 6.8 | 0.3% | Oct 28, 2026 | Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administra... |
| CVE-2013-20007 | HIGH | 7.2 | 2.0% | Oct 28, 2026 | Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to ex... |
| CVE-2026-118272 | MEDIUM | 4.3 | 0.2% | Oct 28, 2026 | A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionE... |
| CVE-2026-118271 | MEDIUM | 4.3 | 0.3% | Oct 28, 2026 | A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the fi... |
| CVE-2026-106013 | CRITICAL | 9.8 | 0.6% | Oct 28, 2026 | The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in... |