CVE Vulnerability Database
Search and browse 420,032 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-113369 | MEDIUM | 6.3 | 0.2% | Nov 4, 2026 | Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account tha... |
| CVE-2026-113368 | MEDIUM | 5.3 | 0.2% | Nov 4, 2026 | Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the repositor... |
| CVE-2026-97701 | MEDIUM | 6.5 | 0.4% | Nov 4, 2026 | Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages... |
| CVE-2026-82033 | HIGH | 8.4 | — | Nov 4, 2026 | DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerabilit... |
| CVE-2026-82029 | MEDIUM | 6.5 | 0.2% | Nov 4, 2026 | Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal cont... |
| CVE-2026-63183 | MEDIUM | 6.9 | 0.2% | Nov 4, 2026 | OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callba... |
| CVE-2026-122148 | HIGH | 8.2 | 0.2% | Nov 4, 2026 | In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerabili... |
| CVE-2026-122124 | MEDIUM | 6.1 | — | Nov 4, 2026 | On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials... |
| CVE-2026-122120 | CRITICAL | 9 | 0.5% | Nov 4, 2026 | In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenari... |
| CVE-2026-121932 | CRITICAL | 10 | — | Nov 4, 2026 | A vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system of the file /wizard/apply.cgi... |
| CVE-2026-121931 | CRITICAL | 9.1 | — | Nov 4, 2026 | A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of th... |
| CVE-2026-121930 | CRITICAL | 9.1 | — | Nov 4, 2026 | A weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the function system of the file apply... |
| CVE-2026-121929 | LOW | 3.5 | — | Nov 4, 2026 | A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. Impacted is an unknown function of the file /e/me... |
| CVE-2026-121928 | LOW | 3.5 | — | Nov 4, 2026 | A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the fil... |
| CVE-2026-113783 | HIGH | 7.4 | — | Nov 4, 2026 | ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3... |
| CVE-2026-113782 | HIGH | 7.1 | — | Nov 4, 2026 | ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, an... |
| CVE-2026-113780 | CRITICAL | 9.3 | 0.1% | Nov 4, 2026 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the e... |
| CVE-2026-107846 | CRITICAL | 9.3 | — | Nov 4, 2026 | bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMe... |
| CVE-2026-102345 | MEDIUM | 5.1 | — | Nov 4, 2026 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the new Vue-based ticket interface c... |
| CVE-2026-57853 | HIGH | 8.8 | 0.6% | Nov 4, 2026 | DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with ... |
| CVE-2026-122118 | HIGH | 7.4 | — | Nov 4, 2026 | In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with... |
| CVE-2026-122116 | MEDIUM | 4.3 | — | Nov 4, 2026 | Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X ... |
| CVE-2026-122054 | MEDIUM | 5.9 | — | Nov 4, 2026 | Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU ... |
| CVE-2026-121971 | HIGH | 8.2 | 0.2% | Nov 4, 2026 | The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_bearer or au... |
| CVE-2026-121927 | MEDIUM | 6.3 | — | Nov 4, 2026 | A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function _account_get o... |