CVE Vulnerability Database
Search and browse 424,817 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-108976 | HIGH | 7.8 | 0.5% | Oct 11, 2026 | GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has... |
| CVE-2026-108963 | HIGH | 8.8 | 1.7% | Oct 11, 2026 | databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a data... |
| CVE-2026-108925 | MEDIUM | 6.1 | 0.2% | Oct 11, 2026 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Admini... |
| CVE-2026-108768 | MEDIUM | 4.3 | 0.5% | Oct 11, 2026 | A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of th... |
| CVE-2026-59508 | MEDIUM | 5.9 | 0.3% | Oct 11, 2026 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Interuse i-Bos. T... |
| CVE-2026-19935 | HIGH | 7.5 | 0.2% | Oct 11, 2026 | The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a str... |
| CVE-2026-19740 | MEDIUM | 6.5 | 0.1% | Oct 11, 2026 | The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receiv... |
| CVE-2026-19739 | MEDIUM | 6.5 | 0.1% | Oct 11, 2026 | The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the rec... |
| CVE-2026-19738 | MEDIUM | 6.5 | 0.1% | Oct 11, 2026 | The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains... |
| CVE-2026-19737 | MEDIUM | 5.5 | 0.1% | Oct 11, 2026 | i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DI... |
| CVE-2026-19736 | HIGH | 7.8 | 0.1% | Oct 11, 2026 | The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the v... |
| CVE-2026-19735 | MEDIUM | 4.8 | 0.2% | Oct 11, 2026 | The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key... |
| CVE-2026-19669 | HIGH | 7.8 | 0.2% | Oct 11, 2026 | The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fu... |
| CVE-2026-19577 | HIGH | 7.1 | 0.2% | Oct 11, 2026 | net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(... |
| CVE-2026-19576 | MEDIUM | 6.8 | 0.2% | Oct 11, 2026 | The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status re... |
| CVE-2026-18418 | LOW | 3.4 | 0.1% | Oct 11, 2026 | The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected... |
| CVE-2026-108913 | HIGH | 7.1 | 0.4% | Oct 11, 2026 | omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ... |
| CVE-2026-107761 | MEDIUM | 5.3 | 0.3% | Oct 11, 2026 | Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the c... |
| CVE-2026-108905 | HIGH | 7.5 | 0.3% | Oct 11, 2026 | pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allo... |
| CVE-2026-108904 | MEDIUM | 6.5 | 0.3% | Oct 11, 2026 | pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API client... |
| CVE-2026-108903 | MEDIUM | 5.3 | 0.3% | Oct 11, 2026 | pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated att... |
| CVE-2026-108902 | HIGH | 8.1 | 0.4% | Oct 11, 2026 | pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePho... |
| CVE-2026-108891 | MEDIUM | 4.3 | 0.2% | Oct 11, 2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId ha... |
| CVE-2026-108888 | MEDIUM | 4.3 | 0.2% | Oct 11, 2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler ... |
| CVE-2026-108887 | MEDIUM | 4.3 | 0.2% | Oct 11, 2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler tha... |