CVE Vulnerability Database
Search and browse 423,337 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-113654 | MEDIUM | 5.3 | 0.3% | Oct 20, 2026 | ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi... |
| CVE-2026-113653 | MEDIUM | 6.9 | — | Oct 20, 2026 | ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous... |
| CVE-2026-113652 | MEDIUM | 5.6 | 0.3% | Oct 20, 2026 | ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leak... |
| CVE-2026-113651 | LOW | 3.3 | — | Oct 20, 2026 | ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to up... |
| CVE-2026-113650 | MEDIUM | 5.3 | 0.4% | Oct 20, 2026 | ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allo... |
| CVE-2026-113649 | MEDIUM | 6.5 | 0.2% | Oct 20, 2026 | ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0... |
| CVE-2026-113648 | LOW | 3.1 | 0.3% | Oct 20, 2026 | ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API e... |
| CVE-2026-113505 | MEDIUM | 4.3 | 0.4% | Oct 20, 2026 | A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of th... |
| CVE-2026-112958 | MEDIUM | 5.4 | — | Oct 20, 2026 | ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget s... |
| CVE-2026-112957 | MEDIUM | 4.3 | 0.3% | Oct 20, 2026 | ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages d... |
| CVE-2026-95109 | HIGH | 8.5 | — | Oct 20, 2026 | The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The c... |
| CVE-2026-95108 | MEDIUM | 6.8 | — | Oct 20, 2026 | One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one.... |
| CVE-2026-95107 | HIGH | 7 | — | Oct 20, 2026 | A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-by... |
| CVE-2026-94202 | MEDIUM | 4.8 | — | Oct 20, 2026 | The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memo... |
| CVE-2026-94192 | HIGH | 8.5 | — | Oct 20, 2026 | A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask f... |
| CVE-2026-94024 | MEDIUM | 6.9 | — | Oct 20, 2026 | The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much... |
| CVE-2026-94023 | MEDIUM | 6.9 | — | Oct 20, 2026 | A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one q... |
| CVE-2026-94018 | HIGH | 8.8 | — | Oct 20, 2026 | The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` under... |
| CVE-2026-93475 | CRITICAL | 9.3 | — | Oct 20, 2026 | The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts in... |
| CVE-2026-93003 | MEDIUM | 6.9 | — | Oct 20, 2026 | The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the ... |
| CVE-2026-92853 | HIGH | 8.7 | — | Oct 20, 2026 | The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first... |
| CVE-2026-92843 | HIGH | 8.7 | — | Oct 20, 2026 | A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger ... |
| CVE-2026-91057 | MEDIUM | 4.6 | — | Oct 20, 2026 | `_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the stri... |
| CVE-2026-90800 | HIGH | 8.1 | — | Oct 20, 2026 | Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the... |
| CVE-2026-90799 | LOW | 1.3 | — | Oct 20, 2026 | Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user ... |