CVE Vulnerability Database
Search and browse 420,635 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-114113 | HIGH | 8.4 | 0.1% | Oct 21, 2026 | Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, C... |
| CVE-2026-114112 | HIGH | 8.9 | 0.2% | Oct 21, 2026 | Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execut... |
| CVE-2026-114111 | HIGH | 8.9 | 0.1% | Oct 21, 2026 | sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under... |
| CVE-2026-114110 | MEDIUM | 5.3 | 0.3% | Oct 21, 2026 | Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by suppl... |
| CVE-2026-114109 | HIGH | 8.8 | 0.4% | Oct 21, 2026 | uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the script... |
| CVE-2026-114108 | CRITICAL | 9.8 | 0.4% | Oct 21, 2026 | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated a... |
| CVE-2026-114107 | HIGH | 8.8 | 0.5% | Oct 21, 2026 | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attack... |
| CVE-2026-114106 | HIGH | 7.5 | 0.4% | Oct 21, 2026 | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read ... |
| CVE-2026-114105 | MEDIUM | 6.2 | 0.1% | Oct 21, 2026 | Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setg... |
| CVE-2026-114104 | MEDIUM | 5.9 | 0.2% | Oct 21, 2026 | adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content val... |
| CVE-2026-114103 | MEDIUM | 5.3 | 0.3% | Oct 21, 2026 | adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard b... |
| CVE-2026-114102 | HIGH | 7.5 | 0.3% | Oct 21, 2026 | adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.... |
| CVE-2026-114101 | MEDIUM | 4 | 0.3% | Oct 21, 2026 | Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 f... |
| CVE-2026-114100 | MEDIUM | 5.8 | 0.2% | Oct 21, 2026 | Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compar... |
| CVE-2026-114099 | MEDIUM | 5.8 | 0.2% | Oct 21, 2026 | Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST na... |
| CVE-2026-114098 | HIGH | 7.8 | 0.2% | Oct 21, 2026 | Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to writ... |
| CVE-2026-114097 | HIGH | 7.8 | 0.2% | Oct 21, 2026 | Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allo... |
| CVE-2026-114096 | HIGH | 7.8 | 0.2% | Oct 21, 2026 | Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allo... |
| CVE-2026-114095 | MEDIUM | 6.5 | 0.3% | Oct 21, 2026 | Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause in... |
| CVE-2026-114094 | HIGH | 8.8 | 0.7% | Oct 21, 2026 | Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrar... |
| CVE-2026-114093 | MEDIUM | 4.3 | 0.1% | Oct 21, 2026 | Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out aut... |
| CVE-2026-114092 | MEDIUM | 6.5 | 0.4% | Oct 21, 2026 | Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run rep... |
| CVE-2026-114091 | MEDIUM | 5.3 | 0.2% | Oct 21, 2026 | Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the... |
| CVE-2026-114090 | HIGH | 7.1 | 0.2% | Oct 21, 2026 | Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp serv... |
| CVE-2026-114089 | HIGH | 8.8 | 0.1% | Oct 21, 2026 | Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because ... |