CVE Vulnerability Database
Search and browse 423,806 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-111649 | MEDIUM | 6.5 | 0.3% | Oct 16, 2026 | Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment... |
| CVE-2026-111648 | LOW | 2.7 | 0.3% | Oct 16, 2026 | BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend ad... |
| CVE-2026-111647 | MEDIUM | 4.3 | — | Oct 16, 2026 | PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buy... |
| CVE-2026-111646 | MEDIUM | 5.9 | — | Oct 16, 2026 | SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to downloa... |
| CVE-2026-111645 | MEDIUM | 5.4 | 0.2% | Oct 16, 2026 | MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows au... |
| CVE-2026-111644 | HIGH | 7.3 | 0.4% | Oct 16, 2026 | Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers ... |
| CVE-2026-111643 | CRITICAL | 9.8 | 0.4% | Oct 16, 2026 | Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers ... |
| CVE-2026-111642 | HIGH | 8.8 | — | Oct 16, 2026 | FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privi... |
| CVE-2026-111641 | CRITICAL | 9.8 | — | Oct 16, 2026 | FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain... |
| CVE-2026-111640 | MEDIUM | 5.4 | 0.2% | Oct 16, 2026 | DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the m... |
| CVE-2026-111639 | HIGH | 8.1 | 0.4% | Oct 16, 2026 | bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allo... |
| CVE-2026-111638 | HIGH | 7.7 | 0.3% | Oct 16, 2026 | sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that ... |
| CVE-2026-111637 | MEDIUM | 5.3 | — | Oct 16, 2026 | NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read acco... |
| CVE-2026-111636 | HIGH | 8.1 | — | Oct 16, 2026 | OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to... |
| CVE-2026-111635 | MEDIUM | 4.3 | 0.3% | Oct 16, 2026 | Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files ou... |
| CVE-2026-111634 | HIGH | 8.1 | 0.3% | Oct 16, 2026 | Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL th... |
| CVE-2026-111633 | HIGH | 8.6 | 0.3% | Oct 16, 2026 | ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST ... |
| CVE-2026-111632 | MEDIUM | 5.4 | — | Oct 16, 2026 | Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or... |
| CVE-2026-111631 | MEDIUM | 5.4 | — | Oct 16, 2026 | Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke ex... |
| CVE-2026-111630 | MEDIUM | 5.4 | 0.2% | Oct 16, 2026 | abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIMan... |
| CVE-2026-111629 | MEDIUM | 4.3 | 0.3% | Oct 16, 2026 | IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to ... |
| CVE-2026-111628 | MEDIUM | 5 | 0.3% | Oct 16, 2026 | 10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to insta... |
| CVE-2026-111627 | HIGH | 7.2 | — | Oct 16, 2026 | HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perfor... |
| CVE-2026-111626 | CRITICAL | 9.8 | — | Oct 16, 2026 | Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers ... |
| CVE-2026-111625 | MEDIUM | 5 | 0.2% | Oct 16, 2026 | 10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-leve... |