CVE Vulnerability Database
Search and browse 420,586 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-115482 | HIGH | 7.5 | — | Oct 22, 2026 | In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered h... |
| CVE-2026-115454 | MEDIUM | 5.3 | — | Oct 22, 2026 | An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to versio... |
| CVE-2026-115453 | HIGH | 7.1 | 0.2% | Oct 22, 2026 | Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecomm... |
| CVE-2026-115450 | HIGH | 7.1 | 0.2% | Oct 22, 2026 | External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce ... |
| CVE-2026-114603 | MEDIUM | 5.3 | 0.5% | Oct 22, 2026 | OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function ... |
| CVE-2026-114487 | MEDIUM | 4.3 | 0.1% | Oct 22, 2026 | Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 20... |
| CVE-2026-114486 | MEDIUM | 4.3 | 0.1% | Oct 22, 2026 | Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allow... |
| CVE-2026-114485 | MEDIUM | 4.3 | 0.1% | Oct 22, 2026 | Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlie... |
| CVE-2026-78846 | CRITICAL | 9.8 | 0.2% | Oct 22, 2026 | Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing. |
| CVE-2026-78801 | MEDIUM | 4.3 | 0.3% | Oct 22, 2026 | An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacke... |
| CVE-2026-61791 | HIGH | 7.4 | 0.3% | Oct 22, 2026 | OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile devi... |
| CVE-2026-16477 | HIGH | 8.4 | — | Oct 22, 2026 | CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot ... |
| CVE-2026-114515 | MEDIUM | 6.5 | 0.2% | Oct 22, 2026 | OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile devi... |
| CVE-2026-114510 | HIGH | 7.1 | 0.4% | Oct 22, 2026 | Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multip... |
| CVE-2026-113872 | HIGH | 7.5 | — | Oct 22, 2026 | multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, w... |
| CVE-2026-111181 | HIGH | 7.5 | — | Oct 22, 2026 | body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 bef... |
| CVE-2026-94502 | CRITICAL | 9.8 | 0.3% | Oct 22, 2026 | In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentiall... |
| CVE-2026-92709 | HIGH | 8.1 | 0.3% | Oct 22, 2026 | Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility... |
| CVE-2026-89410 | MEDIUM | 5.1 | — | Oct 22, 2026 | In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive informa... |
| CVE-2026-89409 | MEDIUM | 5.3 | — | Oct 22, 2026 | In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing c... |
| CVE-2026-85080 | CRITICAL | 9.1 | 0.5% | Oct 22, 2026 | In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a... |
| CVE-2026-85079 | CRITICAL | 9.8 | 0.3% | Oct 22, 2026 | In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially le... |
| CVE-2026-66282 | HIGH | 7.5 | 0.3% | Oct 22, 2026 | In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that ... |
| CVE-2026-66281 | HIGH | 7.5 | 0.3% | Oct 22, 2026 | In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condi... |
| CVE-2026-66279 | HIGH | 7.2 | — | Oct 22, 2026 | In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass aut... |