CVE Vulnerability Database
Search and browse 423,806 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-111624 | LOW | 3.7 | 0.3% | Oct 16, 2026 | Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients ... |
| CVE-2026-111623 | MEDIUM | 5.6 | 0.4% | Oct 16, 2026 | Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated atta... |
| CVE-2026-111622 | MEDIUM | 6.8 | — | Oct 16, 2026 | smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attack... |
| CVE-2026-111621 | MEDIUM | 4.3 | — | Oct 16, 2026 | TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read ... |
| CVE-2026-111620 | MEDIUM | 5.3 | 0.3% | Oct 16, 2026 | O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows ... |
| CVE-2026-111619 | MEDIUM | 6.5 | 0.3% | Oct 16, 2026 | FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject ... |
| CVE-2026-111618 | MEDIUM | 5.3 | 0.4% | Oct 16, 2026 | CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article arc... |
| CVE-2026-111617 | MEDIUM | 6.5 | — | Oct 16, 2026 | WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect... |
| CVE-2026-111616 | MEDIUM | 4.9 | — | Oct 16, 2026 | Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site a... |
| CVE-2026-111615 | MEDIUM | 6.5 | 0.3% | Oct 16, 2026 | Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to... |
| CVE-2026-111614 | MEDIUM | 6.5 | 0.3% | Oct 16, 2026 | DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath tha... |
| CVE-2026-111613 | HIGH | 7.5 | 0.5% | Oct 16, 2026 | AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbi... |
| CVE-2026-111612 | HIGH | 7.5 | — | Oct 16, 2026 | netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attacke... |
| CVE-2026-111611 | MEDIUM | 5.4 | — | Oct 16, 2026 | roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authentic... |
| CVE-2026-111610 | MEDIUM | 5.4 | 0.2% | Oct 16, 2026 | B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated auth... |
| CVE-2026-111609 | LOW | 3.8 | 0.2% | Oct 16, 2026 | PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal ... |
| CVE-2026-111608 | MEDIUM | 4.2 | 0.2% | Oct 16, 2026 | Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users... |
| CVE-2026-111607 | HIGH | 7.1 | — | Oct 16, 2026 | Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users... |
| CVE-2026-111606 | HIGH | 8.1 | — | Oct 16, 2026 | Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge... |
| CVE-2026-111605 | HIGH | 8.8 | 0.3% | Oct 16, 2026 | Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated works... |
| CVE-2026-111604 | LOW | 3.8 | 0.3% | Oct 16, 2026 | eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify... |
| CVE-2026-111603 | MEDIUM | 4.3 | 0.3% | Oct 16, 2026 | PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated stu... |
| CVE-2026-111392 | MEDIUM | 4.8 | — | Oct 16, 2026 | SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attack... |
| CVE-2026-109839 | LOW | 3.1 | — | Oct 16, 2026 | IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing init... |
| CVE-2026-109838 | MEDIUM | 5.1 | — | Oct 16, 2026 | IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryp... |