CVE Vulnerability Database
Search and browse 420,515 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-93849 | MEDIUM | 6.5 | 0.5% | Oct 26, 2026 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply a... |
| CVE-2026-93848 | LOW | 2.7 | 0.3% | Oct 26, 2026 | Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpo... |
| CVE-2026-93847 | LOW | 3.5 | 0.2% | Oct 26, 2026 | Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and pub... |
| CVE-2026-93328 | CRITICAL | 9.3 | — | Oct 26, 2026 | Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/m... |
| CVE-2026-92171 | MEDIUM | 6.5 | 0.3% | Oct 26, 2026 | A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator ... |
| CVE-2026-90885 | HIGH | 7.5 | — | Oct 26, 2026 | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affec... |
| CVE-2026-77062 | MEDIUM | 6.9 | — | Oct 26, 2026 | The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in a... |
| CVE-2026-77061 | MEDIUM | 5.3 | — | Oct 26, 2026 | boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the ... |
| CVE-2026-77060 | MEDIUM | 6.8 | — | Oct 26, 2026 | boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable p... |
| CVE-2026-77059 | HIGH | 8.8 | — | Oct 26, 2026 | boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/t... |
| CVE-2026-77058 | MEDIUM | 5.1 | — | Oct 26, 2026 | boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSR... |
| CVE-2026-77057 | LOW | 2.3 | 0.3% | Oct 26, 2026 | boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not ... |
| CVE-2026-77056 | HIGH | 7.1 | — | Oct 26, 2026 | boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. The... |
| CVE-2026-77055 | CRITICAL | 9.3 | 0.1% | Oct 26, 2026 | boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo acces... |
| CVE-2026-77054 | MEDIUM | 6.9 | — | Oct 26, 2026 | boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endp... |
| CVE-2026-77053 | HIGH | 8.7 | 0.3% | Oct 26, 2026 | boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network inter... |
| CVE-2026-77052 | HIGH | 8.7 | 0.3% | Oct 26, 2026 | boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The... |
| CVE-2026-65184 | CRITICAL | 9.8 | — | Oct 26, 2026 | The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and p... |
| CVE-2026-3322 | MEDIUM | 5.6 | — | Oct 26, 2026 | Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require admi... |
| CVE-2026-36698 | HIGH | 8.8 | 0.5% | Oct 26, 2026 | Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection ... |
| CVE-2026-31158 | CRITICAL | 9.8 | 0.4% | Oct 26, 2026 | SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbit... |
| CVE-2026-116497 | MEDIUM | 5.5 | 0.1% | Oct 26, 2026 | A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with th... |
| CVE-2026-116340 | MEDIUM | 4.3 | 0.3% | Oct 26, 2026 | A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnow... |
| CVE-2026-116339 | HIGH | 7.3 | — | Oct 26, 2026 | A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/me... |
| CVE-2026-116284 | MEDIUM | 4.3 | 0.3% | Oct 26, 2026 | A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /... |