CVE Vulnerability Database
Search and browse 386,125 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-65760 | CRITICAL | 9.2 | — | Jul 23, 2026 | Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0... |
| CVE-2026-65759 | HIGH | 8.7 | — | Jul 23, 2026 | Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical... |
| CVE-2026-65698 | MEDIUM | 6 | 0.3% | Jul 23, 2026 | Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjace... |
| CVE-2026-65697 | MEDIUM | 6.1 | — | Jul 23, 2026 | Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that... |
| CVE-2026-65696 | MEDIUM | 5.4 | — | Jul 23, 2026 | Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscrip... |
| CVE-2026-65695 | HIGH | 7.6 | — | Jul 23, 2026 | Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attacker... |
| CVE-2026-44909 | HIGH | 7.5 | — | Jul 23, 2026 | Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticate... |
| CVE-2026-16768 | MEDIUM | 5.3 | 0.2% | Jul 23, 2026 | A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined pale... |
| CVE-2026-65917 | HIGH | 8.8 | 0.4% | Jul 23, 2026 | CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in ... |
| CVE-2026-65916 | HIGH | 8.1 | — | Jul 23, 2026 | CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCre... |
| CVE-2026-48539 | MEDIUM | 5.4 | — | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report conf... |
| CVE-2026-48538 | MEDIUM | 5.4 | — | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configurat... |
| CVE-2026-48537 | MEDIUM | 5.4 | — | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configurati... |
| CVE-2026-48536 | MEDIUM | 5.4 | — | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuratio... |
| CVE-2026-48535 | MEDIUM | 5.4 | 0.1% | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configurati... |
| CVE-2026-48534 | MEDIUM | 5.4 | — | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that all... |
| CVE-2026-48533 | — | — | — | Jul 23, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-48532 | MEDIUM | 5.4 | — | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy conf... |
| CVE-2026-48531 | MEDIUM | 5.4 | — | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration tha... |
| CVE-2026-48530 | MEDIUM | 5.4 | — | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification Rules configuration... |
| CVE-2026-16584 | HIGH | 7.3 | — | Jul 23, 2026 | Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to ... |
| CVE-2026-15617 | CRITICAL | 9.1 | 0.2% | Jul 23, 2026 | Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unaut... |
| CVE-2026-15616 | CRITICAL | 9.1 | 0.2% | Jul 23, 2026 | Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirem... |
| CVE-2026-15615 | HIGH | 7.5 | 0.1% | Jul 23, 2026 | Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and ... |
| CVE-2026-15614 | HIGH | 7.5 | 0.1% | Jul 23, 2026 | Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s valid... |