CVE Vulnerability Database
Search and browse 423,833 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-110287 | MEDIUM | 4.3 | 0.2% | Oct 16, 2026 | Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated u... |
| CVE-2026-107617 | CRITICAL | 9.8 | — | Oct 16, 2026 | An attacker can use a hard-coded credential to log in to EseeCloud devices. |
| CVE-2026-105664 | MEDIUM | 5.3 | — | Oct 16, 2026 | The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexisten... |
| CVE-2026-68571 | HIGH | 8.8 | 0.2% | Oct 16, 2026 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL c... |
| CVE-2026-64959 | CRITICAL | 9.8 | 0.3% | Oct 16, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critica... |
| CVE-2026-64610 | CRITICAL | 9.8 | 0.4% | Oct 16, 2026 | Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken ... |
| CVE-2026-63619 | CRITICAL | 9.1 | 0.2% | Oct 16, 2026 | Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the... |
| CVE-2026-63618 | HIGH | 7.5 | — | Oct 16, 2026 | Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kyl... |
| CVE-2026-111555 | MEDIUM | 6 | 0.1% | Oct 16, 2026 | A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or ... |
| CVE-2026-111409 | MEDIUM | 5.3 | — | Oct 16, 2026 | Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-fo... |
| CVE-2026-111405 | MEDIUM | 6.5 | — | Oct 16, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights ... |
| CVE-2026-111400 | MEDIUM | 6.5 | — | Oct 16, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations ... |
| CVE-2026-111399 | HIGH | 8.5 | — | Oct 16, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights ... |
| CVE-2026-111397 | MEDIUM | 5.3 | — | Oct 16, 2026 | Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Re... |
| CVE-2026-111396 | HIGH | 7.1 | — | Oct 16, 2026 | Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploit... |
| CVE-2026-110903 | MEDIUM | 6.5 | — | Oct 16, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / Stell... |
| CVE-2026-110901 | MEDIUM | 5.4 | — | Oct 16, 2026 | Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting I... |
| CVE-2026-110900 | MEDIUM | 5.3 | — | Oct 16, 2026 | Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Acc... |
| CVE-2026-110896 | MEDIUM | 5.3 | — | Oct 16, 2026 | Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Acce... |
| CVE-2026-110380 | MEDIUM | 5.3 | — | Oct 16, 2026 | Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Confi... |
| CVE-2026-107564 | HIGH | 7.5 | — | Oct 16, 2026 | An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affec... |
| CVE-2026-105958 | HIGH | 7.5 | 0.2% | Oct 16, 2026 | A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_D... |
| CVE-2026-111391 | HIGH | 8.1 | — | Oct 16, 2026 | SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers ... |
| CVE-2026-111390 | MEDIUM | 5.3 | 0.3% | Oct 16, 2026 | Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data f... |
| CVE-2026-110029 | MEDIUM | 5.4 | — | Oct 16, 2026 | The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authe... |