CVE Vulnerability Database
Search and browse 423,461 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-10574 | HIGH | 8.8 | 0.3% | Oct 19, 2026 | IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a... |
| CVE-2026-10572 | HIGH | 8.8 | 0.3% | Oct 19, 2026 | IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a... |
| CVE-2026-107188 | CRITICAL | 9.6 | 0.4% | Oct 19, 2026 | A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be ... |
| CVE-2026-107187 | HIGH | 8.5 | 0.3% | Oct 19, 2026 | A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workfl... |
| CVE-2026-107186 | HIGH | 8.6 | 0.4% | Oct 19, 2026 | An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can ... |
| CVE-2026-107083 | CRITICAL | 9.8 | — | Oct 19, 2026 | SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/r... |
| CVE-2026-107082 | HIGH | 8.8 | 0.2% | Oct 19, 2026 | Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection vi... |
| CVE-2026-103038 | HIGH | 8.6 | 3.4% | Oct 19, 2026 | PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP serv... |
| CVE-2025-7203 | MEDIUM | 4.9 | 0.2% | Oct 19, 2026 | The Management Console and product files expose sensitive data, including remote log server credentials, truststore pass... |
| CVE-2025-7043 | MEDIUM | 5.4 | 0.2% | Oct 19, 2026 | The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid ac... |
| CVE-2025-6623 | MEDIUM | 4.3 | 0.3% | Oct 19, 2026 | The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowin... |
| CVE-2025-13591 | MEDIUM | 5.3 | 0.3% | Oct 19, 2026 | The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does n... |
| CVE-2025-13173 | MEDIUM | 6.5 | 0.2% | Oct 19, 2026 | Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another S... |
| CVE-2025-10149 | HIGH | 8.2 | 0.2% | Oct 19, 2026 | The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against th... |
| CVE-2024-4412 | LOW | 2.7 | 0.4% | Oct 19, 2026 | The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expressio... |
| CVE-2026-77228 | — | — | — | Oct 19, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-77227 | — | — | — | Oct 19, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-77225 | — | — | — | Oct 19, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-12254 | MEDIUM | 6.4 | 0.2% | Oct 19, 2026 | Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting ... |
| CVE-2026-112368 | HIGH | 7.5 | 0.3% | Oct 19, 2026 | An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated par... |
| CVE-2026-112366 | HIGH | 7.5 | — | Oct 19, 2026 | Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the... |
| CVE-2026-112363 | MEDIUM | 5.3 | — | Oct 19, 2026 | Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that all... |
| CVE-2026-112310 | MEDIUM | 4.3 | — | Oct 19, 2026 | docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local ima... |
| CVE-2026-112309 | HIGH | 7.5 | 0.4% | Oct 19, 2026 | @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers ... |
| CVE-2026-112308 | HIGH | 7.4 | — | Oct 19, 2026 | crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows at... |