CVE Vulnerability Database
Search and browse 378,081 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-59648 | MEDIUM | 6.9 | 0.3% | Aug 3, 2026 | In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also aff... |
| CVE-2026-59647 | MEDIUM | 6.9 | 0.3% | Aug 3, 2026 | In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects ... |
| CVE-2026-59646 | HIGH | 8.7 | 0.3% | Aug 3, 2026 | In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This is... |
| CVE-2026-59645 | HIGH | 8.7 | 0.3% | Aug 3, 2026 | In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. T... |
| CVE-2026-59644 | HIGH | 8.7 | 0.3% | Aug 3, 2026 | In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender. |
| CVE-2026-59643 | HIGH | 8.7 | 0.2% | Aug 3, 2026 | In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affect... |
| CVE-2026-59642 | HIGH | 8.7 | 0.2% | Aug 3, 2026 | In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue... |
| CVE-2026-59641 | HIGH | 8.7 | 0.2% | Aug 3, 2026 | In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This iss... |
| CVE-2026-59640 | HIGH | 8.7 | 0.3% | Aug 3, 2026 | In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue ... |
| CVE-2026-59639 | HIGH | 8.7 | 0.2% | Aug 3, 2026 | In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue al... |
| CVE-2026-59638 | CRITICAL | 9.3 | 0.3% | Aug 3, 2026 | In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. ... |
| CVE-2026-18581 | LOW | 3.3 | 0.1% | Aug 3, 2026 | A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of th... |
| CVE-2026-15055 | MEDIUM | 5.3 | 0.3% | Aug 3, 2026 | In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also a... |
| CVE-2026-12185 | HIGH | 7.1 | 0.3% | Aug 3, 2026 | In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This i... |
| CVE-2026-3245 | HIGH | 7.7 | 0.2% | Aug 3, 2026 | A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution. |
| CVE-2026-18577 | HIGH | 8.1 | 2.5% | Aug 2, 2026 | An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions throu... |
| CVE-2026-10848 | HIGH | 8.6 | 0.2% | Aug 2, 2026 | The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j... |
| CVE-2026-9856 | HIGH | 7.1 | 0.3% | Aug 2, 2026 | A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes vi... |
| CVE-2026-65321 | CRITICAL | 9.8 | 0.4% | Aug 2, 2026 | PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrar... |
| CVE-2026-10774 | MEDIUM | 6.5 | 0.2% | Aug 2, 2026 | Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/blue... |
| CVE-2026-68583 | MEDIUM | 5.4 | 0.1% | Aug 2, 2026 | luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field th... |
| CVE-2026-68582 | CRITICAL | 9.3 | 0.2% | Aug 2, 2026 | Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-col... |
| CVE-2026-68581 | HIGH | 8.6 | 0.3% | Aug 2, 2026 | Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and ... |
| CVE-2026-68580 | HIGH | 7.7 | 0.2% | Aug 2, 2026 | FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across AL... |
| CVE-2026-68579 | CRITICAL | 9.6 | 0.3% | Aug 2, 2026 | FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_... |