CVE Vulnerability Database
Search and browse 423,833 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-111581 | LOW | 3.3 | 0.1% | Oct 16, 2026 | A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied la... |
| CVE-2026-102941 | HIGH | 7.5 | 0.3% | Oct 16, 2026 | The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0... |
| CVE-2026-102923 | MEDIUM | 5.4 | 0.2% | Oct 16, 2026 | SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/... |
| CVE-2026-97851 | CRITICAL | 9.1 | — | Oct 16, 2026 | The storage status-change REST service allows location records still associated with DICOM instances to be changed to de... |
| CVE-2026-95183 | HIGH | 8.8 | 0.2% | Oct 16, 2026 | An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a promp... |
| CVE-2026-95182 | CRITICAL | 10 | — | Oct 16, 2026 | An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supply... |
| CVE-2026-88755 | HIGH | 7.8 | — | Oct 16, 2026 | Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a reposit... |
| CVE-2026-111728 | MEDIUM | 5.4 | — | Oct 16, 2026 | Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowin... |
| CVE-2026-107777 | MEDIUM | 6.5 | — | Oct 16, 2026 | Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to r... |
| CVE-2026-107621 | HIGH | 7.5 | — | Oct 16, 2026 | JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream. |
| CVE-2026-106705 | HIGH | 8.8 | — | Oct 16, 2026 | ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endp... |
| CVE-2026-105667 | HIGH | 7.5 | — | Oct 16, 2026 | In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending... |
| CVE-2026-105279 | CRITICAL | 9.1 | — | Oct 16, 2026 | In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can ... |
| CVE-2026-105273 | HIGH | 7.5 | — | Oct 16, 2026 | MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and ... |
| CVE-2026-101021 | HIGH | 7.5 | — | Oct 16, 2026 | MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can ... |
| CVE-2025-52097 | MEDIUM | 5.4 | 0.3% | Oct 16, 2026 | Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary c... |
| CVE-2026-97858 | MEDIUM | 5.3 | — | Oct 16, 2026 | An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting acco... |
| CVE-2026-97470 | MEDIUM | 6.4 | — | Oct 16, 2026 | The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-S... |
| CVE-2026-90821 | MEDIUM | 5.4 | — | Oct 16, 2026 | An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, auth... |
| CVE-2026-18516 | CRITICAL | 9.6 | — | Oct 16, 2026 | An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attac... |
| CVE-2026-111593 | — | — | — | Oct 16, 2026 | Rejected reason: This CVE ID was reserved for a reported issue in the PDF Invoices & Packing Slips for WooCommerce WordP... |
| CVE-2026-111413 | HIGH | 8.8 | — | Oct 16, 2026 | Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross ... |
| CVE-2026-110806 | MEDIUM | 6.5 | 0.2% | Oct 16, 2026 | Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user w... |
| CVE-2026-110805 | LOW | 2.6 | 0.1% | Oct 16, 2026 | Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authentica... |
| CVE-2026-110804 | MEDIUM | 4.3 | 0.2% | Oct 16, 2026 | Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlie... |