CVE Vulnerability Database
Search and browse 423,412 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-113465 | MEDIUM | 6.6 | 0.2% | Oct 20, 2026 | It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To ... |
| CVE-2026-101201 | MEDIUM | 4.3 | 0.1% | Oct 20, 2026 | A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-... |
| CVE-2026-43835 | HIGH | 8.6 | 0.3% | Oct 20, 2026 | A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware ... |
| CVE-2026-43834 | HIGH | 7.5 | 0.3% | Oct 20, 2026 | A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to ... |
| CVE-2026-113407 | HIGH | 8.8 | 0.4% | Oct 20, 2026 | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitr... |
| CVE-2026-113406 | HIGH | 8.8 | 0.4% | Oct 20, 2026 | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitr... |
| CVE-2026-113405 | HIGH | 8.8 | 0.4% | Oct 20, 2026 | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitr... |
| CVE-2026-112177 | HIGH | 7.3 | 0.4% | Oct 20, 2026 | A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitte... |
| CVE-2026-111090 | HIGH | 7.8 | 0.1% | Oct 20, 2026 | A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license... |
| CVE-2024-2323 | MEDIUM | 4.8 | 0.2% | Oct 20, 2026 | The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history vali... |
| CVE-2026-93878 | MEDIUM | 6.4 | 0.2% | Oct 20, 2026 | The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action i... |
| CVE-2026-113404 | HIGH | 8.8 | 0.4% | Oct 20, 2026 | WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard... |
| CVE-2026-113403 | MEDIUM | 6.5 | 0.8% | Oct 20, 2026 | ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers ... |
| CVE-2026-113402 | MEDIUM | 6.5 | 0.4% | Oct 20, 2026 | ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attacke... |
| CVE-2026-112148 | MEDIUM | 5.1 | 0.4% | Oct 20, 2026 | A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (... |
| CVE-2026-110725 | LOW | 3.7 | 0.3% | Oct 20, 2026 | fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu... |
| CVE-2026-110306 | MEDIUM | 6.1 | 0.2% | Oct 20, 2026 | fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu... |
| CVE-2026-110180 | MEDIUM | 4.8 | 0.2% | Oct 20, 2026 | fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from... |
| CVE-2026-110095 | LOW | 3.7 | 0.2% | Oct 20, 2026 | fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu... |
| CVE-2026-97627 | HIGH | 8.6 | 0.3% | Oct 20, 2026 | Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A use... |
| CVE-2026-96903 | MEDIUM | 4.3 | 0.1% | Oct 20, 2026 | The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contac... |
| CVE-2026-96902 | MEDIUM | 5.3 | 0.2% | Oct 20, 2026 | The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public R... |
| CVE-2026-93300 | HIGH | 7.5 | 0.4% | Oct 20, 2026 | The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all ve... |
| CVE-2026-100737 | MEDIUM | 6.9 | 0.2% | Oct 20, 2026 | Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A use... |
| CVE-2026-113386 | HIGH | 7.1 | 1.0% | Oct 20, 2026 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated at... |