CVE Vulnerability Database
Search and browse 420,973 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-112950 | MEDIUM | 5.9 | 0.5% | Oct 20, 2026 | Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, is... |
| CVE-2026-112949 | MEDIUM | 4.7 | 0.2% | Oct 20, 2026 | Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0... |
| CVE-2026-112948 | MEDIUM | 6.5 | — | Oct 20, 2026 | Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.... |
| CVE-2026-112947 | MEDIUM | 6.3 | 0.4% | Oct 20, 2026 | Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outsid... |
| CVE-2026-112946 | MEDIUM | 6.3 | — | Oct 20, 2026 | Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can... |
| CVE-2026-112945 | LOW | 2.1 | 0.6% | Oct 20, 2026 | Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using ... |
| CVE-2026-112840 | MEDIUM | 6.5 | — | Oct 20, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force S... |
| CVE-2026-112836 | HIGH | 8.8 | — | Oct 20, 2026 | Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This... |
| CVE-2026-112829 | MEDIUM | 5.3 | — | Oct 20, 2026 | Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Contr... |
| CVE-2026-112824 | MEDIUM | 5.3 | — | Oct 20, 2026 | Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-... |
| CVE-2026-112823 | MEDIUM | 4.3 | — | Oct 20, 2026 | Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.Th... |
| CVE-2026-111843 | MEDIUM | 6.5 | — | Oct 20, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblo... |
| CVE-2026-111765 | HIGH | 7.5 | 0.7% | Oct 20, 2026 | A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to v... |
| CVE-2026-111764 | HIGH | 7.5 | — | Oct 20, 2026 | A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTask... |
| CVE-2026-111763 | MEDIUM | 5.7 | 0.1% | Oct 20, 2026 | A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromis... |
| CVE-2026-109700 | MEDIUM | 6.5 | — | Oct 20, 2026 | Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting ... |
| CVE-2026-107755 | MEDIUM | 6 | — | Oct 20, 2026 | Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms all... |
| CVE-2025-71436 | HIGH | 7.1 | 0.5% | Oct 20, 2026 | Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_t... |
| CVE-2026-97400 | MEDIUM | 6.8 | — | Oct 20, 2026 | In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent D... |
| CVE-2026-96402 | MEDIUM | 5.2 | — | Oct 20, 2026 | A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, le... |
| CVE-2026-95168 | HIGH | 7.8 | 0.2% | Oct 20, 2026 | An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thef... |
| CVE-2026-95111 | MEDIUM | 4.8 | — | Oct 20, 2026 | A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of... |
| CVE-2026-92454 | MEDIUM | 6.1 | — | Oct 20, 2026 | The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what... |
| CVE-2026-92449 | MEDIUM | 6.8 | — | Oct 20, 2026 | `_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value re... |
| CVE-2026-92446 | MEDIUM | 6.8 | — | Oct 20, 2026 | `gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BI... |