CVE Vulnerability Database
Search and browse 420,818 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-93003 | MEDIUM | 6.9 | — | Oct 20, 2026 | The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the ... |
| CVE-2026-92853 | HIGH | 8.7 | — | Oct 20, 2026 | The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first... |
| CVE-2026-92843 | HIGH | 8.7 | — | Oct 20, 2026 | A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger ... |
| CVE-2026-91057 | MEDIUM | 4.6 | — | Oct 20, 2026 | `_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the stri... |
| CVE-2026-90800 | HIGH | 8.1 | — | Oct 20, 2026 | Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the... |
| CVE-2026-90799 | LOW | 1.3 | — | Oct 20, 2026 | Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user ... |
| CVE-2026-90798 | LOW | 0.6 | — | Oct 20, 2026 | A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a rep... |
| CVE-2026-90797 | HIGH | 7.7 | — | Oct 20, 2026 | An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote c... |
| CVE-2026-86471 | CRITICAL | 9.3 | — | Oct 20, 2026 | An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server ad... |
| CVE-2026-113703 | CRITICAL | 9.3 | — | Oct 20, 2026 | SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where en... |
| CVE-2026-113683 | MEDIUM | 6.1 | 0.3% | Oct 20, 2026 | VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allow... |
| CVE-2026-113682 | HIGH | 7.4 | 0.5% | Oct 20, 2026 | Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allo... |
| CVE-2026-113681 | MEDIUM | 5.5 | — | Oct 20, 2026 | OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineo... |
| CVE-2026-113680 | MEDIUM | 5.5 | 0.1% | Oct 20, 2026 | HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly sha... |
| CVE-2026-113679 | HIGH | 7 | — | Oct 20, 2026 | HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper becau... |
| CVE-2026-113678 | CRITICAL | 9.9 | 0.4% | Oct 20, 2026 | Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authen... |
| CVE-2026-113677 | MEDIUM | 5.4 | — | Oct 20, 2026 | Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command th... |
| CVE-2026-113676 | MEDIUM | 4.3 | — | Oct 20, 2026 | Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allo... |
| CVE-2026-113613 | HIGH | 8.1 | 0.8% | Oct 20, 2026 | FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to w... |
| CVE-2026-113612 | MEDIUM | 5.4 | — | Oct 20, 2026 | SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete oth... |
| CVE-2026-113611 | MEDIUM | 4.9 | 0.4% | Oct 20, 2026 | Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep rec... |
| CVE-2026-113610 | MEDIUM | 5.4 | — | Oct 20, 2026 | Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allo... |
| CVE-2026-113609 | LOW | 3.3 | — | Oct 20, 2026 | Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers ... |
| CVE-2026-113608 | MEDIUM | 5.3 | 0.3% | Oct 20, 2026 | Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerab... |
| CVE-2026-113607 | MEDIUM | 6.5 | — | Oct 20, 2026 | Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authentica... |