CVE Vulnerability Database
Search and browse 420,586 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-115369 | LOW | 2.2 | 0.1% | Oct 22, 2026 | OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a C... |
| CVE-2026-115366 | LOW | 2.6 | 0.2% | Oct 22, 2026 | OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace ... |
| CVE-2026-115365 | MEDIUM | 6.6 | 0.3% | Oct 22, 2026 | OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows to... |
| CVE-2026-115364 | LOW | 2.2 | 0.3% | Oct 22, 2026 | OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by om... |
| CVE-2026-115363 | LOW | 3.3 | 0.1% | Oct 22, 2026 | OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_... |
| CVE-2026-115362 | LOW | 2.2 | 0.2% | Oct 22, 2026 | OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leavi... |
| CVE-2026-115361 | MEDIUM | 4.1 | 0.2% | Oct 22, 2026 | OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden ide... |
| CVE-2026-115360 | MEDIUM | 4.7 | 0.2% | Oct 22, 2026 | OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not a... |
| CVE-2026-115359 | LOW | 3.7 | 0.2% | Oct 22, 2026 | OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fail... |
| CVE-2026-115358 | LOW | 2 | 0.2% | Oct 22, 2026 | OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into ... |
| CVE-2026-115357 | LOW | 2.2 | 0.2% | Oct 22, 2026 | OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-r... |
| CVE-2026-115356 | MEDIUM | 5.4 | 0.2% | Oct 22, 2026 | OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method,... |
| CVE-2026-115355 | HIGH | 7.5 | 0.5% | Oct 22, 2026 | Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbi... |
| CVE-2026-115354 | MEDIUM | 6.5 | 0.3% | Oct 22, 2026 | Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to re... |
| CVE-2026-115353 | HIGH | 8.6 | 0.4% | Oct 22, 2026 | Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read ... |
| CVE-2026-115352 | HIGH | 7.5 | 0.4% | Oct 22, 2026 | Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthentica... |
| CVE-2026-115351 | MEDIUM | 4.7 | 0.2% | Oct 22, 2026 | Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input ... |
| CVE-2026-115350 | MEDIUM | 6.1 | 0.2% | Oct 22, 2026 | Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .... |
| CVE-2026-115349 | HIGH | 7.5 | 0.3% | Oct 22, 2026 | Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_tex... |
| CVE-2026-115348 | HIGH | 7.5 | 0.4% | Oct 22, 2026 | Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_... |
| CVE-2026-115347 | HIGH | 7.5 | 0.4% | Oct 22, 2026 | Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote ... |
| CVE-2026-114655 | MEDIUM | 5.9 | 0.3% | Oct 22, 2026 | libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vaul... |
| CVE-2026-114654 | MEDIUM | 6.5 | 0.3% | Oct 22, 2026 | A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subty... |
| CVE-2026-114653 | MEDIUM | 6.5 | 0.2% | Oct 22, 2026 | A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers... |
| CVE-2026-114652 | MEDIUM | 6.5 | 0.3% | Oct 22, 2026 | A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can c... |