CVE Vulnerability Database
Search and browse 420,055 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-121951 | HIGH | 7.5 | 0.4% | Nov 4, 2026 | FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with a... |
| CVE-2026-121950 | MEDIUM | 6.5 | 0.3% | Nov 4, 2026 | FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX CREA... |
| CVE-2026-119746 | MEDIUM | 5.9 | — | Nov 4, 2026 | ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web... |
| CVE-2026-109518 | HIGH | 7.7 | — | Nov 4, 2026 | On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (includin... |
| CVE-2026-106554 | — | — | — | Nov 4, 2026 | One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time ... |
| CVE-2026-66736 | — | — | — | Nov 4, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-39431 | HIGH | 7.2 | 0.5% | Nov 4, 2026 | On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible... |
| CVE-2026-39430 | CRITICAL | 9.8 | 0.2% | Nov 4, 2026 | On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management a... |
| CVE-2026-122008 | MEDIUM | 5 | — | Nov 4, 2026 | Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileCo... |
| CVE-2026-122007 | MEDIUM | 6.5 | — | Nov 4, 2026 | Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an aut... |
| CVE-2026-122006 | CRITICAL | 9.8 | 0.7% | Nov 4, 2026 | The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server ... |
| CVE-2026-121640 | CRITICAL | 9.1 | 0.5% | Nov 4, 2026 | An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has obse... |
| CVE-2026-121639 | CRITICAL | 9.2 | 0.7% | Nov 4, 2026 | A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthentic... |
| CVE-2026-121638 | CRITICAL | 9.1 | 0.3% | Nov 4, 2026 | An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path netw... |
| CVE-2026-121637 | HIGH | 8.9 | 0.3% | Nov 4, 2026 | An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a n... |
| CVE-2026-121632 | — | — | — | Nov 4, 2026 | Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping. proce... |
| CVE-2026-121009 | — | — | — | Nov 4, 2026 | SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given ... |
| CVE-2026-121008 | — | — | — | Nov 4, 2026 | SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind valu... |
| CVE-2026-121007 | — | — | — | Nov 4, 2026 | SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested sta... |
| CVE-2026-120421 | MEDIUM | 6.1 | — | Nov 4, 2026 | In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client ... |
| CVE-2026-119776 | MEDIUM | 6.1 | — | Nov 4, 2026 | In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets hav... |
| CVE-2026-114627 | — | — | — | Nov 4, 2026 | Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags ou... |
| CVE-2026-100408 | MEDIUM | 4.4 | — | Nov 4, 2026 | Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credenti... |
| CVE-2026-100407 | MEDIUM | 4.4 | 0.1% | Nov 4, 2026 | Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred sto... |
| CVE-2026-121993 | MEDIUM | 4.3 | — | Nov 4, 2026 | wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/paymen... |