CVE Vulnerability Database
Search and browse 420,610 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-109618 | CRITICAL | 9.8 | 100.0% | Oct 21, 2026 | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some co... |
| CVE-2026-104949 | MEDIUM | 5.4 | 0.2% | Oct 21, 2026 | WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (... |
| CVE-2026-104948 | HIGH | 7.1 | 0.2% | Oct 21, 2026 | WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (... |
| CVE-2026-104947 | MEDIUM | 5.3 | 0.2% | Oct 21, 2026 | WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in fu... |
| CVE-2025-71438 | MEDIUM | 5.5 | 0.2% | Oct 21, 2026 | An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attack... |
| CVE-2025-60489 | MEDIUM | 5.5 | 0.2% | Oct 21, 2026 | A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box befor... |
| CVE-2025-60479 | MEDIUM | 5.5 | 0.2% | Oct 21, 2026 | A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 ... |
| CVE-2025-0326 | HIGH | 7.4 | 0.1% | Oct 21, 2026 | The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account ma... |
| CVE-2024-7478 | MEDIUM | 5.8 | 0.2% | Oct 21, 2026 | When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or... |
| CVE-2024-6423 | MEDIUM | 4 | 0.1% | Oct 21, 2026 | The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data t... |
| CVE-2024-5563 | MEDIUM | 4.8 | 0.2% | Oct 21, 2026 | Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha op... |
| CVE-2024-5139 | MEDIUM | 6.1 | 0.2% | Oct 21, 2026 | The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malic... |
| CVE-2024-4989 | MEDIUM | 5.4 | 0.2% | Oct 21, 2026 | The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by ma... |
| CVE-2026-97313 | HIGH | 7.5 | 0.4% | Oct 21, 2026 | A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may... |
| CVE-2026-96888 | HIGH | 7.5 | 0.5% | Oct 21, 2026 | A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an asserti... |
| CVE-2026-94300 | HIGH | 8.1 | 1.0% | Oct 21, 2026 | Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a prev... |
| CVE-2026-90484 | MEDIUM | 6.5 | 0.2% | Oct 21, 2026 | The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-le... |
| CVE-2026-87849 | MEDIUM | 4.3 | 0.2% | Oct 21, 2026 | The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (Find... |
| CVE-2026-86249 | CRITICAL | 9.1 | 0.3% | Oct 21, 2026 | On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption... |
| CVE-2026-86147 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all pla... |
| CVE-2026-86146 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache ... |
| CVE-2026-84748 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin ser... |
| CVE-2026-84747 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows re... |
| CVE-2026-84727 | MEDIUM | 5.4 | 0.3% | Oct 21, 2026 | Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious... |
| CVE-2026-82953 | MEDIUM | 5.3 | 0.2% | Oct 21, 2026 | NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows r... |