CVE Vulnerability Database
Search and browse 420,610 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-114387 | HIGH | 8.8 | 0.3% | Oct 21, 2026 | Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding onl... |
| CVE-2026-114386 | MEDIUM | 4.8 | 0.3% | Oct 21, 2026 | Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run... |
| CVE-2026-114248 | MEDIUM | 5.3 | — | Oct 21, 2026 | A security vulnerability has been detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ce... |
| CVE-2026-114245 | HIGH | 7.3 | — | Oct 21, 2026 | A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/1253... |
| CVE-2026-114243 | HIGH | 7.3 | 0.3% | Oct 21, 2026 | A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183... |
| CVE-2026-114120 | MEDIUM | 5.4 | 0.3% | Oct 21, 2026 | SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level us... |
| CVE-2026-111849 | MEDIUM | 5.3 | — | Oct 21, 2026 | Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Con... |
| CVE-2026-81755 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attac... |
| CVE-2026-80463 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms a... |
| CVE-2026-79704 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0) ... |
| CVE-2026-78334 | CRITICAL | 9.1 | 0.3% | Oct 21, 2026 | Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote atta... |
| CVE-2026-78066 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled inp... |
| CVE-2026-78058 | HIGH | 7.5 | 0.3% | Oct 21, 2026 | Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms all... |
| CVE-2026-78048 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version... |
| CVE-2026-74758 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to cras... |
| CVE-2026-74757 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows re... |
| CVE-2026-74755 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attacke... |
| CVE-2026-66392 | MEDIUM | 5.9 | 0.1% | Oct 21, 2026 | Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, b... |
| CVE-2026-61916 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms ... |
| CVE-2026-61902 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTT... |
| CVE-2026-59562 | CRITICAL | 9.8 | 0.3% | Oct 21, 2026 | Missing authentication for critical function vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0... |
| CVE-2026-59229 | HIGH | 8.8 | 0.3% | Oct 21, 2026 | The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing ... |
| CVE-2026-58064 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection... |
| CVE-2026-56388 | CRITICAL | 9.1 | 0.3% | Oct 21, 2026 | The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated... |
| CVE-2026-56387 | HIGH | 7.5 | 0.3% | Oct 21, 2026 | The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote u... |