CVE Vulnerability Database
Search and browse 419,784 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-100228 | — | — | — | Nov 5, 2026 | Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user withou... |
| CVE-2026-100168 | — | — | — | Nov 5, 2026 | Direct Request ('Forced Browsing') in the Content Manager component in Apache OFBiz 24.09.07 on all platforms allows an ... |
| CVE-2026-95652 | MEDIUM | 6.6 | — | Nov 5, 2026 | Execution with unnecessary privileges vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-us... |
| CVE-2026-123119 | LOW | 2.3 | 0.2% | Nov 5, 2026 | The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowin... |
| CVE-2026-123047 | HIGH | 7.5 | — | Nov 5, 2026 | In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the `basyx` chart, deployments with the bundled Keycloak e... |
| CVE-2026-123020 | MEDIUM | 6.3 | — | Nov 5, 2026 | A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.1. The affected element is the function File... |
| CVE-2026-103866 | — | — | — | Nov 5, 2026 | Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. T... |
| CVE-2026-103864 | — | — | — | Nov 5, 2026 | Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4.... |
| CVE-2026-103863 | — | — | — | Nov 5, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engin... |
| CVE-2026-96677 | CRITICAL | 10 | — | Nov 5, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau. HT... |
| CVE-2026-73117 | CRITICAL | 10 | — | Nov 5, 2026 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau. T... |
| CVE-2026-73116 | CRITICAL | 10 | — | Nov 5, 2026 | Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirec... |
| CVE-2026-73101 | CRITICAL | 10 | — | Nov 5, 2026 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the ... |
| CVE-2026-73100 | CRITICAL | 10 | — | Nov 5, 2026 | Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger re... |
| CVE-2026-73099 | CRITICAL | 10 | — | Nov 5, 2026 | Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter t... |
| CVE-2026-73098 | CRITICAL | 10 | — | Nov 5, 2026 | Improper control of dynamically-loaded code vulnerability in Apache Juneau. When Apache Juneau parses a value into a pr... |
| CVE-2026-73095 | HIGH | 8.7 | — | Nov 5, 2026 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, which the ... |
| CVE-2026-123019 | HIGH | 7.3 | — | Nov 5, 2026 | A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function exec_module of the file hf_a... |
| CVE-2026-123018 | HIGH | 8.3 | — | Nov 5, 2026 | A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function execute_code of ... |
| CVE-2026-121489 | CRITICAL | 10 | — | Nov 5, 2026 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau. The micr... |
| CVE-2026-123036 | MEDIUM | 5.5 | — | Nov 5, 2026 | A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emit... |
| CVE-2026-118869 | HIGH | 8.7 | 1.1% | Nov 5, 2026 | An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrar... |
| CVE-2026-117679 | MEDIUM | 5.1 | 0.1% | Nov 5, 2026 | A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary... |
| CVE-2026-112072 | MEDIUM | 6.5 | 0.3% | Nov 5, 2026 | vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser ... |
| CVE-2026-109408 | HIGH | 7.4 | 0.2% | Nov 5, 2026 | vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in thr... |