CVE Vulnerability Database
Search and browse 381,190 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-62959 | HIGH | 8.2 | — | Jul 31, 2026 | Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started w... |
| CVE-2026-62324 | MEDIUM | 5.4 | 0.2% | Jul 31, 2026 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElem... |
| CVE-2026-55825 | LOW | 3.1 | — | Jul 31, 2026 | Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can ... |
| CVE-2026-53599 | HIGH | 7.5 | — | Jul 31, 2026 | REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/s... |
| CVE-2026-53551 | MEDIUM | 6.9 | 0.4% | Jul 31, 2026 | free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server... |
| CVE-2026-53510 | HIGH | 8.1 | — | Jul 31, 2026 | Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL... |
| CVE-2026-38711 | CRITICAL | 9.8 | 1.2% | Jul 31, 2026 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2... |
| CVE-2026-18394 | HIGH | 7.4 | 0.3% | Jul 31, 2026 | Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to ob... |
| CVE-2026-57232 | LOW | 3.1 | 0.2% | Jul 31, 2026 | Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end mod... |
| CVE-2026-55824 | LOW | 2.6 | — | Jul 31, 2026 | Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth cre... |
| CVE-2026-53505 | HIGH | 7.5 | 0.3% | Jul 31, 2026 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) fi... |
| CVE-2026-53504 | HIGH | 7.5 | — | Jul 31, 2026 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expressio... |
| CVE-2026-53503 | HIGH | 7.5 | — | Jul 31, 2026 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, ... |
| CVE-2026-53502 | HIGH | 8.7 | — | Jul 31, 2026 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path... |
| CVE-2026-53501 | HIGH | 8.2 | — | Jul 31, 2026 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypasse... |
| CVE-2026-53500 | HIGH | 8.2 | — | Jul 31, 2026 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes... |
| CVE-2026-25552 | LOW | 3.7 | — | Jul 31, 2026 | Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rat... |
| CVE-2026-18481 | HIGH | 7.3 | 0.3% | Jul 31, 2026 | Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticate... |
| CVE-2026-18321 | MEDIUM | 4.7 | — | Jul 31, 2026 | Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd |
| CVE-2026-55100 | HIGH | 8.7 | — | Jul 31, 2026 | hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenat... |
| CVE-2026-54737 | HIGH | 7.3 | — | Jul 31, 2026 | @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to ... |
| CVE-2026-54729 | HIGH | 8.7 | — | Jul 31, 2026 | DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, is_... |
| CVE-2026-54725 | CRITICAL | 9.6 | — | Jul 31, 2026 | vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1... |
| CVE-2026-34497 | MEDIUM | 5.4 | 0.4% | Jul 31, 2026 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Syste... |
| CVE-2026-34495 | MEDIUM | 5.4 | 0.4% | Jul 31, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls F... |