CVE Vulnerability Database
Search and browse 424,998 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-107704 | CRITICAL | 9.8 | 1.7% | Oct 8, 2026 | The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identi... |
| CVE-2026-107703 | CRITICAL | 9.8 | — | Oct 8, 2026 | @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to... |
| CVE-2026-107701 | HIGH | 8.2 | 0.3% | Oct 8, 2026 | dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype b... |
| CVE-2026-107700 | CRITICAL | 9.8 | — | Oct 8, 2026 | dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScrip... |
| CVE-2026-107699 | CRITICAL | 9.8 | 1.5% | Oct 8, 2026 | ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system c... |
| CVE-2026-107388 | MEDIUM | 5.5 | 0.1% | Oct 8, 2026 | music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncs... |
| CVE-2026-107387 | MEDIUM | 5.5 | 0.2% | Oct 8, 2026 | music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacke... |
| CVE-2026-107386 | MEDIUM | 6.3 | 0.5% | Oct 8, 2026 | amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advi... |
| CVE-2026-107385 | HIGH | 7.4 | — | Oct 8, 2026 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to ... |
| CVE-2026-107384 | HIGH | 8.1 | 0.4% | Oct 8, 2026 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.... |
| CVE-2026-107383 | HIGH | 7.5 | 0.4% | Oct 8, 2026 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to ... |
| CVE-2026-107382 | MEDIUM | 5.9 | — | Oct 8, 2026 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.... |
| CVE-2026-107325 | MEDIUM | 5.9 | 0.2% | Oct 8, 2026 | Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic w... |
| CVE-2026-107324 | MEDIUM | 5.9 | 0.2% | Oct 8, 2026 | An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application... |
| CVE-2026-107322 | HIGH | 7.8 | — | Oct 8, 2026 | An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow... |
| CVE-2026-106438 | LOW | 3.7 | 0.1% | Oct 8, 2026 | An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs c... |
| CVE-2026-106437 | HIGH | 7.4 | 0.1% | Oct 8, 2026 | The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Lat... |
| CVE-2026-106434 | MEDIUM | 4.3 | — | Oct 8, 2026 | The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instea... |
| CVE-2026-106433 | HIGH | 8.8 | 0.3% | Oct 8, 2026 | Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible typ... |
| CVE-2026-106431 | MEDIUM | 5.7 | — | Oct 8, 2026 | An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a ... |
| CVE-2026-106430 | MEDIUM | 5.9 | — | Oct 8, 2026 | The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the... |
| CVE-2026-106429 | MEDIUM | 6.5 | — | Oct 8, 2026 | An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that ter... |
| CVE-2026-106428 | LOW | 3.7 | — | Oct 8, 2026 | An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-... |
| CVE-2026-105570 | MEDIUM | 6.7 | — | Oct 8, 2026 | Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credenti... |
| CVE-2026-105452 | MEDIUM | 5.9 | — | Oct 8, 2026 | Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. Th... |