CVE Vulnerability Database
Search and browse 424,280 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-77362 | MEDIUM | 4.3 | 0.2% | Oct 13, 2026 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools d... |
| CVE-2026-77361 | MEDIUM | 4.7 | 0.1% | Oct 13, 2026 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-co... |
| CVE-2026-74047 | MEDIUM | 6.5 | 0.3% | Oct 13, 2026 | Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with ag... |
| CVE-2026-74045 | HIGH | 7.1 | 0.3% | Oct 13, 2026 | Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from inp... |
| CVE-2026-74043 | CRITICAL | 9 | — | Oct 13, 2026 | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload... |
| CVE-2026-74041 | HIGH | 7.2 | 0.5% | Oct 13, 2026 | Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-lo... |
| CVE-2026-74040 | CRITICAL | 9.1 | 0.6% | Oct 13, 2026 | Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files... |
| CVE-2026-74037 | HIGH | 7.2 | 0.4% | Oct 13, 2026 | Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token... |
| CVE-2026-74036 | HIGH | 7.2 | 0.8% | Oct 13, 2026 | Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by fi... |
| CVE-2026-74035 | HIGH | 7.2 | — | Oct 13, 2026 | Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places... |
| CVE-2026-74034 | HIGH | 7.5 | 0.3% | Oct 13, 2026 | Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue ... |
| CVE-2026-74033 | MEDIUM | 6.1 | 0.2% | Oct 13, 2026 | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB lis... |
| CVE-2026-74032 | MEDIUM | 4.3 | 0.3% | Oct 13, 2026 | Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated u... |
| CVE-2026-74031 | MEDIUM | 6.5 | 0.5% | Oct 13, 2026 | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file h... |
| CVE-2026-74030 | MEDIUM | 4.9 | — | Oct 13, 2026 | Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows... |
| CVE-2026-109967 | HIGH | 7.5 | 0.6% | Oct 13, 2026 | yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method tha... |
| CVE-2026-109966 | MEDIUM | 5.3 | 0.4% | Oct 13, 2026 | yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to... |
| CVE-2026-109965 | HIGH | 7.1 | 0.2% | Oct 13, 2026 | Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the... |
| CVE-2026-109964 | MEDIUM | 5.6 | 0.4% | Oct 13, 2026 | ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pic... |
| CVE-2026-109963 | MEDIUM | 4.3 | 0.2% | Oct 13, 2026 | Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_tem... |
| CVE-2026-109962 | MEDIUM | 4.3 | 0.2% | Oct 13, 2026 | Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-a... |
| CVE-2026-109961 | HIGH | 8.5 | 0.2% | Oct 13, 2026 | Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject ar... |
| CVE-2026-109960 | HIGH | 7.7 | — | Oct 13, 2026 | Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to ... |
| CVE-2026-109959 | MEDIUM | 4.3 | — | Oct 13, 2026 | EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited fie... |
| CVE-2026-109958 | MEDIUM | 4.3 | — | Oct 13, 2026 | EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read re... |