CVE Vulnerability Database
Search and browse 425,004 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-107168 | MEDIUM | 6.2 | 0.1% | Oct 7, 2026 | A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can... |
| CVE-2026-107162 | MEDIUM | 6.8 | 0.3% | Oct 7, 2026 | Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant tha... |
| CVE-2026-107151 | MEDIUM | 5.9 | 0.4% | Oct 7, 2026 | Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress ... |
| CVE-2026-105140 | MEDIUM | 4.2 | — | Oct 7, 2026 | Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can r... |
| CVE-2026-105139 | MEDIUM | 4.3 | — | Oct 7, 2026 | Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vM... |
| CVE-2026-105138 | MEDIUM | 6.5 | — | Oct 7, 2026 | Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users... |
| CVE-2026-103435 | HIGH | 7.7 | — | Oct 7, 2026 | Claude Code validated that a target file path resided within the project working directory at permission-check time, but... |
| CVE-2026-102256 | HIGH | 7.8 | — | Oct 7, 2026 | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi... |
| CVE-2026-102255 | CRITICAL | 10 | — | Oct 7, 2026 | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern... |
| CVE-2026-42710 | HIGH | 7.6 | — | Oct 7, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10... |
| CVE-2026-42708 | HIGH | 7.6 | — | Oct 7, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post ... |
| CVE-2026-107159 | MEDIUM | 6.5 | — | Oct 7, 2026 | MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows un... |
| CVE-2026-106059 | HIGH | 8.8 | 1.3% | Oct 7, 2026 | GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell comman... |
| CVE-2026-106058 | HIGH | 7.5 | — | Oct 7, 2026 | GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious reposi... |
| CVE-2026-106057 | HIGH | 7.8 | — | Oct 7, 2026 | patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd... |
| CVE-2026-106056 | HIGH | 7.5 | — | Oct 7, 2026 | Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permiss... |
| CVE-2026-96408 | CRITICAL | 9.3 | — | Oct 7, 2026 | A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker... |
| CVE-2026-92533 | HIGH | 7.1 | — | Oct 7, 2026 | Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name ... |
| CVE-2026-92532 | HIGH | 7.5 | — | Oct 7, 2026 | Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with admini... |
| CVE-2026-92531 | HIGH | 7.5 | — | Oct 7, 2026 | Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application inc... |
| CVE-2026-42714 | HIGH | 7.6 | — | Oct 7, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por... |
| CVE-2026-42713 | HIGH | 7.6 | — | Oct 7, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post titl... |
| CVE-2026-103668 | HIGH | 8.8 | — | Oct 7, 2026 | An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated at... |
| CVE-2026-97294 | MEDIUM | 6.5 | — | Oct 7, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Medi... |
| CVE-2026-97146 | MEDIUM | 4.8 | 0.4% | Oct 7, 2026 | Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the... |