CVE Vulnerability Database
Search and browse 420,948 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-94192 | HIGH | 8.5 | — | Oct 20, 2026 | A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask f... |
| CVE-2026-94024 | MEDIUM | 6.9 | — | Oct 20, 2026 | The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much... |
| CVE-2026-94023 | MEDIUM | 6.9 | — | Oct 20, 2026 | A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one q... |
| CVE-2026-94018 | HIGH | 8.8 | — | Oct 20, 2026 | The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` under... |
| CVE-2026-93475 | CRITICAL | 9.3 | — | Oct 20, 2026 | The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts in... |
| CVE-2026-93003 | MEDIUM | 6.9 | — | Oct 20, 2026 | The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the ... |
| CVE-2026-92853 | HIGH | 8.7 | — | Oct 20, 2026 | The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first... |
| CVE-2026-92843 | HIGH | 8.7 | — | Oct 20, 2026 | A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger ... |
| CVE-2026-91057 | MEDIUM | 4.6 | — | Oct 20, 2026 | `_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the stri... |
| CVE-2026-90800 | HIGH | 8.1 | — | Oct 20, 2026 | Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the... |
| CVE-2026-90799 | LOW | 1.3 | — | Oct 20, 2026 | Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user ... |
| CVE-2026-90798 | LOW | 0.6 | — | Oct 20, 2026 | A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a rep... |
| CVE-2026-90797 | HIGH | 7.7 | — | Oct 20, 2026 | An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote c... |
| CVE-2026-86471 | CRITICAL | 9.3 | — | Oct 20, 2026 | An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server ad... |
| CVE-2026-113703 | CRITICAL | 9.3 | — | Oct 20, 2026 | SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where en... |
| CVE-2026-113683 | MEDIUM | 6.1 | 0.3% | Oct 20, 2026 | VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allow... |
| CVE-2026-113682 | HIGH | 7.4 | 0.5% | Oct 20, 2026 | Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allo... |
| CVE-2026-113681 | MEDIUM | 5.5 | — | Oct 20, 2026 | OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineo... |
| CVE-2026-113680 | MEDIUM | 5.5 | 0.1% | Oct 20, 2026 | HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly sha... |
| CVE-2026-113679 | HIGH | 7 | — | Oct 20, 2026 | HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper becau... |
| CVE-2026-113678 | CRITICAL | 9.9 | 0.4% | Oct 20, 2026 | Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authen... |
| CVE-2026-113677 | MEDIUM | 5.4 | — | Oct 20, 2026 | Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command th... |
| CVE-2026-113676 | MEDIUM | 4.3 | — | Oct 20, 2026 | Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allo... |
| CVE-2026-113613 | HIGH | 8.1 | 0.8% | Oct 20, 2026 | FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to w... |
| CVE-2026-113612 | MEDIUM | 5.4 | — | Oct 20, 2026 | SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete oth... |