CVE Vulnerability Database
Search and browse 424,940 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-108600 | MEDIUM | 4.7 | 0.1% | Oct 10, 2026 | open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write... |
| CVE-2026-108599 | MEDIUM | 4.7 | 0.2% | Oct 10, 2026 | phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass... |
| CVE-2026-108598 | CRITICAL | 9.8 | 0.7% | Oct 10, 2026 | Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attack... |
| CVE-2026-108597 | MEDIUM | 4.8 | 0.3% | Oct 10, 2026 | Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile t... |
| CVE-2026-108596 | MEDIUM | 5.3 | 0.3% | Oct 10, 2026 | OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' tel... |
| CVE-2026-108595 | MEDIUM | 5.3 | 0.3% | Oct 10, 2026 | Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_o... |
| CVE-2026-108594 | LOW | 3.5 | 0.2% | Oct 10, 2026 | Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch tha... |
| CVE-2026-108593 | MEDIUM | 6.4 | 0.3% | Oct 10, 2026 | 9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings... |
| CVE-2026-108592 | MEDIUM | 5.3 | 0.3% | Oct 10, 2026 | mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwra... |
| CVE-2026-108591 | MEDIUM | 4.4 | 0.3% | Oct 10, 2026 | InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create... |
| CVE-2026-106610 | CRITICAL | 9.8 | 0.5% | Oct 10, 2026 | Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allow... |
| CVE-2026-105892 | CRITICAL | 9.8 | 0.4% | Oct 10, 2026 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for ... |
| CVE-2026-94160 | HIGH | 7.1 | 0.1% | Oct 10, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeSte... |
| CVE-2026-62044 | HIGH | 7.2 | 0.3% | Oct 10, 2026 | Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injectio... |
| CVE-2026-108586 | MEDIUM | 5.4 | 0.2% | Oct 10, 2026 | 1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticat... |
| CVE-2026-108585 | MEDIUM | 5.4 | 0.3% | Oct 10, 2026 | argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool tha... |
| CVE-2026-106609 | HIGH | 7.5 | 0.2% | Oct 10, 2026 | Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Confi... |
| CVE-2026-106608 | HIGH | 7.2 | 0.3% | Oct 10, 2026 | Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issu... |
| CVE-2026-105889 | CRITICAL | 9.3 | 0.3% | Oct 10, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera ti... |
| CVE-2026-104398 | CRITICAL | 9.8 | 0.3% | Oct 10, 2026 | Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-... |
| CVE-2026-103357 | MEDIUM | 6.9 | 0.3% | Oct 10, 2026 | Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrec... |
| CVE-2026-103071 | HIGH | 7.5 | 0.3% | Oct 10, 2026 | Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooC... |
| CVE-2026-108583 | MEDIUM | 4.2 | 0.2% | Oct 10, 2026 | zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach int... |
| CVE-2026-108582 | MEDIUM | 5.5 | 0.1% | Oct 10, 2026 | GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows... |
| CVE-2026-108581 | MEDIUM | 6.5 | 0.2% | Oct 10, 2026 | TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileg... |