CVE Vulnerability Database
Search and browse 420,055 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-119745 | MEDIUM | 4.3 | — | Nov 4, 2026 | Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated u... |
| CVE-2026-118391 | HIGH | 8.9 | 0.5% | Nov 4, 2026 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote ... |
| CVE-2026-65555 | CRITICAL | 9.8 | — | Nov 4, 2026 | Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allo... |
| CVE-2026-121970 | LOW | 3.7 | — | Nov 4, 2026 | Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verif... |
| CVE-2026-121946 | HIGH | 7.2 | — | Nov 4, 2026 | zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-bu... |
| CVE-2026-121945 | HIGH | 7.6 | — | Nov 4, 2026 | CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and... |
| CVE-2026-121944 | MEDIUM | 5.5 | — | Nov 4, 2026 | sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows a... |
| CVE-2026-121943 | MEDIUM | 4.8 | — | Nov 4, 2026 | Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_pac... |
| CVE-2026-121942 | MEDIUM | 6.1 | — | Nov 4, 2026 | ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows atta... |
| CVE-2026-121941 | HIGH | 7.8 | — | Nov 4, 2026 | libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows at... |
| CVE-2026-121940 | HIGH | 8.8 | — | Nov 4, 2026 | Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticat... |
| CVE-2026-121939 | HIGH | 8.1 | — | Nov 4, 2026 | Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that... |
| CVE-2026-121938 | MEDIUM | 5.3 | — | Nov 4, 2026 | langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated ... |
| CVE-2026-121937 | LOW | 3.1 | — | Nov 4, 2026 | loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authentic... |
| CVE-2026-121936 | MEDIUM | 6.5 | — | Nov 4, 2026 | easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to ma... |
| CVE-2026-121620 | MEDIUM | 6.5 | — | Nov 4, 2026 | CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated ... |
| CVE-2026-121373 | MEDIUM | 5.3 | 0.5% | Nov 4, 2026 | The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refre... |
| CVE-2026-121147 | HIGH | 8.5 | 0.1% | Nov 4, 2026 | This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificat... |
| CVE-2026-121146 | MEDIUM | 6.8 | 0.1% | Nov 4, 2026 | This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in... |
| CVE-2026-121145 | HIGH | 7.1 | 0.2% | Nov 4, 2026 | This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origi... |
| CVE-2026-121144 | HIGH | 8.8 | 0.3% | Nov 4, 2026 | This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account cre... |
| CVE-2026-119481 | CRITICAL | 9.8 | — | Nov 4, 2026 | Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.Thi... |
| CVE-2026-119468 | HIGH | 7.1 | — | Nov 4, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter ... |
| CVE-2026-118516 | MEDIUM | 6.3 | 0.4% | Nov 4, 2026 | The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, al... |
| CVE-2026-118513 | HIGH | 7.7 | 0.3% | Nov 4, 2026 | Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.5... |