CVE Vulnerability Database
Search and browse 420,586 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-114611 | CRITICAL | 9.1 | 0.2% | Oct 22, 2026 | OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile devi... |
| CVE-2026-114610 | MEDIUM | 6.5 | 0.3% | Oct 22, 2026 | fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <us... |
| CVE-2026-114609 | MEDIUM | 5.8 | 0.3% | Oct 22, 2026 | fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attac... |
| CVE-2026-113874 | HIGH | 8.1 | 0.3% | Oct 22, 2026 | SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted s... |
| CVE-2026-113873 | HIGH | 7.5 | 0.5% | Oct 22, 2026 | SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compres... |
| CVE-2026-108360 | MEDIUM | 6.4 | 0.2% | Oct 22, 2026 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, ... |
| CVE-2026-108359 | HIGH | 8.7 | 0.4% | Oct 22, 2026 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, ... |
| CVE-2026-108358 | HIGH | 8.8 | 0.4% | Oct 22, 2026 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, ... |
| CVE-2026-108357 | HIGH | 8.8 | 0.3% | Oct 22, 2026 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Read... |
| CVE-2026-97631 | CRITICAL | 9.5 | 0.6% | Oct 22, 2026 | EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorr... |
| CVE-2026-75508 | HIGH | 7.5 | 0.6% | Oct 22, 2026 | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the pars... |
| CVE-2026-75507 | HIGH | 7.5 | 0.6% | Oct 22, 2026 | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the Over... |
| CVE-2026-67597 | — | — | — | Oct 22, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-115513 | HIGH | 8.7 | 0.3% | Oct 22, 2026 | OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated u... |
| CVE-2026-115502 | MEDIUM | 6.3 | — | Oct 22, 2026 | A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentiall... |
| CVE-2026-115416 | HIGH | 7.7 | 0.3% | Oct 22, 2026 | Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated us... |
| CVE-2026-114608 | MEDIUM | 5.4 | 0.1% | Oct 22, 2026 | Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable fil... |
| CVE-2026-114607 | CRITICAL | 9.1 | 0.3% | Oct 22, 2026 | Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments t... |
| CVE-2026-114606 | MEDIUM | 5.6 | 0.2% | Oct 22, 2026 | draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary l... |
| CVE-2026-114605 | HIGH | 7.5 | 0.3% | Oct 22, 2026 | dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compres... |
| CVE-2026-104068 | HIGH | 7.2 | 0.6% | Oct 22, 2026 | JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows ... |
| CVE-2026-94482 | HIGH | 8.2 | 0.4% | Oct 22, 2026 | Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted req... |
| CVE-2026-51954 | HIGH | 8.1 | 0.5% | Oct 22, 2026 | An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth a... |
| CVE-2026-115496 | MEDIUM | 6.9 | — | Oct 22, 2026 | Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow a... |
| CVE-2026-115494 | MEDIUM | 5.3 | — | Oct 22, 2026 | A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authe... |