CVE Vulnerability Database
Search and browse 424,998 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-101998 | MEDIUM | 5.9 | — | Oct 8, 2026 | Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read retur... |
| CVE-2026-97147 | HIGH | 7.2 | 0.3% | Oct 8, 2026 | In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can r... |
| CVE-2026-95210 | MEDIUM | 4.8 | 0.2% | Oct 8, 2026 | GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an A... |
| CVE-2026-95184 | MEDIUM | 5.9 | 0.2% | Oct 8, 2026 | GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=Ev... |
| CVE-2026-93861 | MEDIUM | 6 | 0.3% | Oct 8, 2026 | In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another pro... |
| CVE-2026-93860 | HIGH | 7.1 | — | Oct 8, 2026 | In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the mainten... |
| CVE-2026-93858 | HIGH | 8.7 | — | Oct 8, 2026 | In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to... |
| CVE-2026-62171 | — | — | — | Oct 8, 2026 | Rejected reason: This CVE is a duplicate of another CVE. |
| CVE-2026-62170 | — | — | — | Oct 8, 2026 | Rejected reason: This CVE is a duplicate of another CVE. |
| CVE-2026-107702 | MEDIUM | 4.3 | — | Oct 8, 2026 | QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() ... |
| CVE-2026-107698 | MEDIUM | 5.4 | 0.3% | Oct 8, 2026 | FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in ... |
| CVE-2026-107697 | MEDIUM | 4.3 | 0.3% | Oct 8, 2026 | FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol ... |
| CVE-2026-107696 | MEDIUM | 6.5 | 0.3% | Oct 8, 2026 | FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTS... |
| CVE-2026-107695 | MEDIUM | 6.5 | 0.4% | Oct 8, 2026 | FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause den... |
| CVE-2026-107380 | MEDIUM | 5.4 | 0.2% | Oct 8, 2026 | savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after... |
| CVE-2026-107379 | MEDIUM | 6.5 | — | Oct 8, 2026 | savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribut... |
| CVE-2026-107378 | HIGH | 8.7 | — | Oct 8, 2026 | CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG... |
| CVE-2026-107377 | HIGH | 7.5 | 0.5% | Oct 8, 2026 | datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-con... |
| CVE-2026-107376 | HIGH | 8.2 | — | Oct 8, 2026 | webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser perf... |
| CVE-2026-107375 | HIGH | 8.8 | 0.3% | Oct 8, 2026 | JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice arc... |
| CVE-2026-107362 | HIGH | 7.1 | 0.3% | Oct 8, 2026 | The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL... |
| CVE-2026-107361 | MEDIUM | 4.2 | — | Oct 8, 2026 | The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network... |
| CVE-2026-107337 | HIGH | 7.1 | — | Oct 8, 2026 | The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard ... |
| CVE-2026-107336 | MEDIUM | 6.5 | — | Oct 8, 2026 | Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex mat... |
| CVE-2026-107335 | MEDIUM | 6.5 | 0.4% | Oct 8, 2026 | Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompress... |