CVE Vulnerability Database
Search and browse 424,703 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-85947 | CRITICAL | 9.9 | 0.3% | Oct 12, 2026 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in c... |
| CVE-2026-81856 | LOW | 2.3 | 0.4% | Oct 12, 2026 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publ... |
| CVE-2026-109399 | HIGH | 8.1 | 0.2% | Oct 12, 2026 | SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_opens... |
| CVE-2026-109398 | HIGH | 7.5 | 0.5% | Oct 12, 2026 | Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in l... |
| CVE-2026-109397 | HIGH | 7.2 | 0.4% | Oct 12, 2026 | Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated ... |
| CVE-2026-109396 | MEDIUM | 4.2 | 0.2% | Oct 12, 2026 | Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated vi... |
| CVE-2026-109394 | HIGH | 7.4 | 0.3% | Oct 12, 2026 | Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that ... |
| CVE-2026-109393 | MEDIUM | 6.3 | 0.2% | Oct 12, 2026 | QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOr... |
| CVE-2026-109392 | MEDIUM | 5.4 | 0.2% | Oct 12, 2026 | Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to... |
| CVE-2026-109391 | HIGH | 8.1 | 0.5% | Oct 12, 2026 | Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated atta... |
| CVE-2026-109195 | LOW | 3.1 | 0.2% | Oct 12, 2026 | A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespace... |
| CVE-2026-109194 | MEDIUM | 6.4 | 0.2% | Oct 12, 2026 | A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify w... |
| CVE-2026-108906 | HIGH | 7.2 | 0.4% | Oct 12, 2026 | A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the fil... |
| CVE-2026-108901 | LOW | 3.5 | 0.3% | Oct 12, 2026 | A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown f... |
| CVE-2026-108900 | HIGH | 7.3 | 0.4% | Oct 12, 2026 | A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.... |
| CVE-2026-108899 | HIGH | 7.3 | 0.6% | Oct 12, 2026 | A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicp... |
| CVE-2026-107248 | HIGH | 8.8 | 0.2% | Oct 12, 2026 | Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any ... |
| CVE-2026-105668 | HIGH | 7.1 | 0.4% | Oct 12, 2026 | Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over... |
| CVE-2026-105280 | MEDIUM | 6.9 | 0.2% | Oct 12, 2026 | Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarbal... |
| CVE-2026-103503 | MEDIUM | 5.9 | 0.2% | Oct 12, 2026 | Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and h... |
| CVE-2026-103060 | HIGH | 7.5 | 0.4% | Oct 12, 2026 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a m... |
| CVE-2026-92877 | HIGH | 8.3 | 0.3% | Oct 12, 2026 | The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) ... |
| CVE-2026-109390 | CRITICAL | 9.8 | 1.6% | Oct 12, 2026 | AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow,... |
| CVE-2026-108898 | LOW | 3.5 | 0.2% | Oct 12, 2026 | A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Sett... |
| CVE-2026-108897 | MEDIUM | 5.3 | 0.3% | Oct 12, 2026 | A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The impacted e... |