CVE Vulnerability Database
Search and browse 420,973 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-113352 | HIGH | 7.5 | — | Oct 20, 2026 | uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending ... |
| CVE-2026-113351 | HIGH | 7.5 | 0.5% | Oct 20, 2026 | libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte c... |
| CVE-2026-113350 | MEDIUM | 5.4 | — | Oct 20, 2026 | react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts b... |
| CVE-2026-113349 | MEDIUM | 4.3 | 0.2% | Oct 20, 2026 | OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() t... |
| CVE-2026-112787 | MEDIUM | 4.3 | — | Oct 20, 2026 | OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenti... |
| CVE-2026-112786 | MEDIUM | 5.4 | — | Oct 20, 2026 | OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privi... |
| CVE-2026-112785 | MEDIUM | 4.3 | — | Oct 20, 2026 | OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, de... |
| CVE-2026-112784 | MEDIUM | 4.3 | — | Oct 20, 2026 | OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any auth... |
| CVE-2026-112783 | MEDIUM | 4.3 | 0.2% | Oct 20, 2026 | OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.p... |
| CVE-2026-108089 | HIGH | 7.5 | — | Oct 20, 2026 | ** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability... |
| CVE-2026-108088 | HIGH | 7.5 | 0.2% | Oct 20, 2026 | ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using... |
| CVE-2026-108087 | HIGH | 8.8 | 0.3% | Oct 20, 2026 | ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vul... |
| CVE-2026-108086 | HIGH | 7.5 | 0.2% | Oct 20, 2026 | ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vul... |
| CVE-2026-108062 | MEDIUM | 6.9 | — | Oct 20, 2026 | Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated r... |
| CVE-2026-107597 | MEDIUM | 5.1 | — | Oct 20, 2026 | PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer ... |
| CVE-2026-85267 | HIGH | 8.7 | 0.2% | Oct 20, 2026 | A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an una... |
| CVE-2026-43858 | HIGH | 8.6 | 0.7% | Oct 20, 2026 | A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execut... |
| CVE-2026-43857 | HIGH | 8.6 | 0.7% | Oct 20, 2026 | A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the s... |
| CVE-2026-43856 | HIGH | 8.6 | 0.7% | Oct 20, 2026 | A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated att... |
| CVE-2026-43855 | HIGH | 7.5 | 0.6% | Oct 20, 2026 | A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code executi... |
| CVE-2026-43854 | MEDIUM | 6.3 | 0.1% | Oct 20, 2026 | A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials f... |
| CVE-2026-43853 | HIGH | 8.2 | 0.4% | Oct 20, 2026 | A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to ... |
| CVE-2026-43852 | HIGH | 8.2 | 0.4% | Oct 20, 2026 | A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system. |
| CVE-2026-43851 | HIGH | 8.2 | 0.4% | Oct 20, 2026 | A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system. |
| CVE-2026-43850 | HIGH | 8.6 | 1.3% | Oct 20, 2026 | A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the syst... |