CVE Vulnerability Database
Search and browse 420,973 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-43849 | MEDIUM | 6.9 | 0.4% | Oct 20, 2026 | A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data. |
| CVE-2026-113468 | MEDIUM | 6.9 | 0.4% | Oct 20, 2026 | The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment prov... |
| CVE-2026-113459 | HIGH | 7.1 | 0.4% | Oct 20, 2026 | In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the edi... |
| CVE-2026-113442 | MEDIUM | 5.3 | 0.5% | Oct 20, 2026 | Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker co... |
| CVE-2026-113381 | HIGH | 7.3 | 0.4% | Oct 20, 2026 | A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItem... |
| CVE-2026-113378 | MEDIUM | 5.3 | 0.7% | Oct 20, 2026 | A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src... |
| CVE-2026-112240 | MEDIUM | 6.3 | 0.4% | Oct 20, 2026 | The download link for files uploaded through a form relied on a token that could be predicted. The file name in the requ... |
| CVE-2026-112239 | HIGH | 7.2 | 0.4% | Oct 20, 2026 | The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page recor... |
| CVE-2026-112238 | HIGH | 8.7 | 0.4% | Oct 20, 2026 | The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the w... |
| CVE-2026-112237 | MEDIUM | 6.9 | 0.4% | Oct 20, 2026 | The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method,... |
| CVE-2026-112071 | MEDIUM | 6.9 | 0.4% | Oct 20, 2026 | The order cancellation function accepts an order identifier from the request and acts on that order without checking tha... |
| CVE-2026-112070 | MEDIUM | 5.3 | 0.4% | Oct 20, 2026 | The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widge... |
| CVE-2026-112069 | MEDIUM | 6.3 | 0.5% | Oct 20, 2026 | The extension no longer applied its access protection to files in file storages that use a non-default relative base pat... |
| CVE-2026-112068 | MEDIUM | 5.3 | 0.4% | Oct 20, 2026 | The backend module does not check whether a backend user has access to the requested site. Users with access to the modu... |
| CVE-2026-112067 | MEDIUM | 6.9 | 0.4% | Oct 20, 2026 | The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can reque... |
| CVE-2026-112066 | HIGH | 7.1 | 0.4% | Oct 20, 2026 | The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend us... |
| CVE-2026-112065 | MEDIUM | 5.3 | 0.4% | Oct 20, 2026 | The routes that provide consent history and statistics data did not check whether the backend user had access to the mod... |
| CVE-2026-112064 | HIGH | 7.1 | 0.4% | Oct 20, 2026 | The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and u... |
| CVE-2026-111844 | MEDIUM | 6.5 | 0.2% | Oct 20, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy ... |
| CVE-2026-92287 | HIGH | 8.1 | 0.2% | Oct 20, 2026 | Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This... |
| CVE-2026-43848 | MEDIUM | 6.9 | 0.3% | Oct 20, 2026 | A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the servic... |
| CVE-2026-43847 | HIGH | 8.2 | 0.2% | Oct 20, 2026 | A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without re... |
| CVE-2026-43846 | HIGH | 8.6 | 0.3% | Oct 20, 2026 | A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve... |
| CVE-2026-43845 | CRITICAL | 9.2 | 0.3% | Oct 20, 2026 | A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism. |
| CVE-2026-43844 | CRITICAL | 9.3 | 0.4% | Oct 20, 2026 | A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism. |