CVE Vulnerability Database
Search and browse 424,998 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-15340 | CRITICAL | 9.8 | 0.6% | Oct 9, 2026 | lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow. |
| CVE-2026-108125 | HIGH | 7.1 | — | Oct 9, 2026 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. T... |
| CVE-2026-108124 | MEDIUM | 4.9 | — | Oct 9, 2026 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. T... |
| CVE-2026-108109 | CRITICAL | 9.1 | — | Oct 9, 2026 | PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/co... |
| CVE-2026-108108 | HIGH | 7.1 | 0.2% | Oct 9, 2026 | PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Passwor... |
| CVE-2026-108107 | CRITICAL | 9.8 | — | Oct 9, 2026 | PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST e... |
| CVE-2026-108106 | HIGH | 7.5 | 0.4% | Oct 9, 2026 | Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaus... |
| CVE-2026-108105 | MEDIUM | 5.9 | — | Oct 9, 2026 | Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows r... |
| CVE-2026-108104 | MEDIUM | 4.8 | 0.2% | Oct 9, 2026 | Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that... |
| CVE-2026-108103 | MEDIUM | 5.3 | 0.4% | Oct 9, 2026 | Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() ... |
| CVE-2026-108102 | MEDIUM | 5.3 | — | Oct 9, 2026 | Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_measurement() in lib/pfc... |
| CVE-2026-108101 | HIGH | 7.5 | 0.4% | Oct 9, 2026 | HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that al... |
| CVE-2026-108100 | MEDIUM | 6.5 | 0.3% | Oct 9, 2026 | HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL... |
| CVE-2026-107806 | HIGH | 7.2 | 0.3% | Oct 9, 2026 | Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with a... |
| CVE-2026-107805 | HIGH | 7.5 | 0.4% | Oct 9, 2026 | Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication pat... |
| CVE-2026-107804 | MEDIUM | 5.3 | — | Oct 9, 2026 | Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not pr... |
| CVE-2026-105278 | CRITICAL | 9.8 | 0.3% | Oct 9, 2026 | The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An... |
| CVE-2026-104117 | LOW | 1.9 | — | Oct 9, 2026 | A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent... |
| CVE-2026-104116 | LOW | 1.9 | — | Oct 9, 2026 | A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disr... |
| CVE-2026-104115 | MEDIUM | 5.4 | 0.1% | Oct 9, 2026 | A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. ge... |
| CVE-2026-104114 | MEDIUM | 5.4 | — | Oct 9, 2026 | A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwa... |
| CVE-2026-104113 | MEDIUM | 5.4 | — | Oct 9, 2026 | A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When ... |
| CVE-2026-104112 | MEDIUM | 6.8 | — | Oct 9, 2026 | A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel mem... |
| CVE-2026-104081 | HIGH | 8.1 | — | Oct 9, 2026 | KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/hel... |
| CVE-2026-102916 | MEDIUM | 6.8 | — | Oct 9, 2026 | A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-p... |