CVE Vulnerability Database
Search and browse 423,865 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-94134 | CRITICAL | 9.1 | 0.2% | Oct 15, 2026 | The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `... |
| CVE-2026-92228 | MEDIUM | 6.5 | 0.2% | Oct 15, 2026 | The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role glob... |
| CVE-2026-111369 | HIGH | 7.1 | 0.2% | Oct 15, 2026 | ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson rout... |
| CVE-2026-111368 | MEDIUM | 6.4 | 0.2% | Oct 15, 2026 | ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission r... |
| CVE-2026-111367 | MEDIUM | 6.5 | 0.3% | Oct 15, 2026 | BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to f... |
| CVE-2026-111366 | HIGH | 7.2 | 0.4% | Oct 15, 2026 | cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to ... |
| CVE-2026-111365 | MEDIUM | 6 | 0.3% | Oct 15, 2026 | cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read... |
| CVE-2026-111364 | MEDIUM | 6.5 | 0.2% | Oct 15, 2026 | MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that ... |
| CVE-2026-111363 | MEDIUM | 6.5 | 0.2% | Oct 15, 2026 | BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-pri... |
| CVE-2026-111359 | HIGH | 7.1 | 0.2% | Oct 15, 2026 | CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefron... |
| CVE-2026-111358 | MEDIUM | 5.4 | 0.3% | Oct 15, 2026 | SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated worksp... |
| CVE-2026-111356 | HIGH | 7.4 | 0.3% | Oct 15, 2026 | MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthentica... |
| CVE-2026-111355 | MEDIUM | 6.3 | 0.3% | Oct 15, 2026 | zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to igno... |
| CVE-2026-111354 | LOW | 3.1 | 0.3% | Oct 15, 2026 | crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other me... |
| CVE-2026-111353 | MEDIUM | 4.3 | 0.2% | Oct 15, 2026 | Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create tim... |
| CVE-2026-111352 | HIGH | 8.8 | 0.4% | Oct 15, 2026 | ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restrict... |
| CVE-2026-111351 | MEDIUM | 4.2 | 0.2% | Oct 15, 2026 | metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows ... |
| CVE-2026-111350 | MEDIUM | 5 | 0.3% | Oct 15, 2026 | Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows au... |
| CVE-2026-111349 | MEDIUM | 5.3 | 0.3% | Oct 15, 2026 | Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthen... |
| CVE-2026-111348 | MEDIUM | 5.4 | 0.2% | Oct 15, 2026 | Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.ph... |
| CVE-2026-111347 | MEDIUM | 5.9 | 0.4% | Oct 15, 2026 | go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encry... |
| CVE-2026-111346 | MEDIUM | 5.4 | 0.2% | Oct 15, 2026 | ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated ... |
| CVE-2026-111345 | MEDIUM | 4.3 | 0.3% | Oct 15, 2026 | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private... |
| CVE-2026-111344 | MEDIUM | 4.3 | 0.3% | Oct 15, 2026 | APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node... |
| CVE-2026-111343 | MEDIUM | 4.3 | 0.3% | Oct 15, 2026 | pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated... |