CVE Vulnerability Database
Search and browse 423,337 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-101360 | MEDIUM | 5.4 | 0.2% | Oct 20, 2026 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E... |
| CVE-2026-101359 | MEDIUM | 5.3 | 0.3% | Oct 20, 2026 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E... |
| CVE-2025-60496 | MEDIUM | 5.5 | 0.4% | Oct 20, 2026 | A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box befor... |
| CVE-2025-60494 | MEDIUM | 5.5 | 0.2% | Oct 20, 2026 | A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box be... |
| CVE-2025-60475 | MEDIUM | 5.5 | 0.2% | Oct 20, 2026 | A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows ... |
| CVE-2026-9869 | CRITICAL | 9.1 | 0.8% | Oct 20, 2026 | A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOL... |
| CVE-2026-9827 | CRITICAL | 9.1 | 1.0% | Oct 20, 2026 | A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X200... |
| CVE-2026-9817 | CRITICAL | 9.1 | 0.8% | Oct 20, 2026 | A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLI... |
| CVE-2026-9814 | CRITICAL | 9.1 | 1.3% | Oct 20, 2026 | An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK... |
| CVE-2026-9660 | CRITICAL | 9.1 | 0.8% | Oct 20, 2026 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (ve... |
| CVE-2026-9659 | CRITICAL | 9.1 | 0.8% | Oct 20, 2026 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (ve... |
| CVE-2026-94266 | HIGH | 7.5 | 0.2% | Oct 20, 2026 | libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentia... |
| CVE-2026-94265 | CRITICAL | 9.1 | 0.3% | Oct 20, 2026 | When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously ... |
| CVE-2026-92391 | HIGH | 7.5 | 0.4% | Oct 20, 2026 | A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal... |
| CVE-2026-92390 | HIGH | 7.5 | 0.3% | Oct 20, 2026 | When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an ... |
| CVE-2026-92389 | HIGH | 8.1 | 0.3% | Oct 20, 2026 | libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting ope... |
| CVE-2026-92388 | CRITICAL | 9.1 | 0.3% | Oct 20, 2026 | When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving t... |
| CVE-2026-92387 | HIGH | 8.1 | 0.3% | Oct 20, 2026 | By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl... |
| CVE-2026-92386 | HIGH | 8.1 | 0.3% | Oct 20, 2026 | When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record ... |
| CVE-2026-87866 | CRITICAL | 9.1 | 0.2% | Oct 20, 2026 | When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not pos... |
| CVE-2026-87865 | HIGH | 7.4 | 0.2% | Oct 20, 2026 | When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to ... |
| CVE-2026-87864 | HIGH | 8.1 | 0.2% | Oct 20, 2026 | Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmi... |
| CVE-2026-87863 | HIGH | 8.1 | 0.3% | Oct 20, 2026 | An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later f... |
| CVE-2026-87862 | HIGH | 8.1 | 0.3% | Oct 20, 2026 | Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequen... |
| CVE-2026-87861 | CRITICAL | 9.1 | 0.3% | Oct 20, 2026 | When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previous... |