CVE Vulnerability Database
Search and browse 423,895 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-111105 | HIGH | 7 | 0.1% | Oct 15, 2026 | Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e... |
| CVE-2026-110891 | MEDIUM | 5.4 | 0.2% | Oct 15, 2026 | Missing Authorization vulnerability in WordLift Srl WordLift wordlift allows Exploiting Incorrectly Configured Access Co... |
| CVE-2026-110890 | MEDIUM | 6.5 | — | Oct 15, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmar... |
| CVE-2026-110888 | MEDIUM | 4.3 | 0.2% | Oct 15, 2026 | Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Con... |
| CVE-2026-110381 | MEDIUM | 6.3 | 0.2% | Oct 15, 2026 | Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-... |
| CVE-2026-110371 | MEDIUM | 4.3 | — | Oct 15, 2026 | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Co... |
| CVE-2026-110367 | MEDIUM | 5.3 | — | Oct 15, 2026 | Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrect... |
| CVE-2026-108175 | MEDIUM | 6.5 | — | Oct 15, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF ... |
| CVE-2026-106707 | MEDIUM | 5.4 | 0.2% | Oct 15, 2026 | XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). ... |
| CVE-2026-106706 | MEDIUM | 5.4 | 0.2% | Oct 15, 2026 | XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeContro... |
| CVE-2026-104266 | MEDIUM | 6.5 | 0.3% | Oct 15, 2026 | tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom w... |
| CVE-2026-103936 | HIGH | 7.5 | 0.5% | Oct 15, 2026 | libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect()... |
| CVE-2026-103350 | MEDIUM | 5.3 | — | Oct 15, 2026 | Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-a... |
| CVE-2026-102740 | MEDIUM | 5.8 | 0.1% | Oct 15, 2026 | The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses.... |
| CVE-2026-85634 | HIGH | 8.8 | 0.4% | Oct 15, 2026 | A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by... |
| CVE-2026-78851 | MEDIUM | 6.5 | 1.1% | Oct 15, 2026 | Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive informati... |
| CVE-2026-78850 | MEDIUM | 5 | 0.3% | Oct 15, 2026 | An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / Sites... |
| CVE-2026-77470 | HIGH | 8.3 | — | Oct 15, 2026 | Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Chec... |
| CVE-2026-77468 | MEDIUM | 6.9 | 0.4% | Oct 15, 2026 | Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAP... |
| CVE-2026-77467 | HIGH | 7.1 | 0.3% | Oct 15, 2026 | Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostsc... |
| CVE-2026-77466 | HIGH | 8.3 | — | Oct 15, 2026 | Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from t... |
| CVE-2026-62679 | HIGH | 8.9 | 0.4% | Oct 15, 2026 | Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path... |
| CVE-2026-61838 | HIGH | 8.2 | — | Oct 15, 2026 | Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives... |
| CVE-2026-61611 | HIGH | 7.5 | 0.4% | Oct 15, 2026 | Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt... |
| CVE-2026-61610 | LOW | 2.3 | 0.2% | Oct 15, 2026 | Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, PO... |