CVE Vulnerability Database
Search and browse 425,004 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-106499 | MEDIUM | 4.9 | 0.3% | Oct 6, 2026 | Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend ... |
| CVE-2026-106498 | HIGH | 7.7 | 0.3% | Oct 6, 2026 | Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backs... |
| CVE-2026-106497 | MEDIUM | 4.3 | 0.2% | Oct 6, 2026 | Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend pac... |
| CVE-2026-106496 | MEDIUM | 6.5 | 0.2% | Oct 6, 2026 | Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend pac... |
| CVE-2026-105268 | MEDIUM | 4.3 | 0.2% | Oct 6, 2026 | The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also a... |
| CVE-2026-105267 | HIGH | 8.1 | 0.4% | Oct 6, 2026 | The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, ... |
| CVE-2026-104633 | MEDIUM | 6.5 | 0.4% | Oct 6, 2026 | When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API se... |
| CVE-2026-101023 | CRITICAL | 9.1 | 0.4% | Oct 6, 2026 | Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type,... |
| CVE-2026-43598 | HIGH | 7.7 | 0.5% | Oct 6, 2026 | Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank o... |
| CVE-2026-19029 | MEDIUM | 6.8 | 0.1% | Oct 6, 2026 | A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacke... |
| CVE-2026-106586 | MEDIUM | 4.3 | 0.1% | Oct 6, 2026 | In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwar... |
| CVE-2026-106585 | MEDIUM | 6.5 | 0.2% | Oct 6, 2026 | In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decom... |
| CVE-2026-106584 | LOW | 3.3 | 0.1% | Oct 6, 2026 | In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mish... |
| CVE-2026-106582 | LOW | 3.7 | 0.2% | Oct 6, 2026 | In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the ... |
| CVE-2026-106555 | HIGH | 7.5 | 0.1% | Oct 6, 2026 | In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentica... |
| CVE-2026-106553 | HIGH | 7.5 | 0.1% | Oct 6, 2026 | In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authenticati... |
| CVE-2026-106552 | MEDIUM | 6.5 | 0.3% | Oct 6, 2026 | In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended loca... |
| CVE-2026-106550 | HIGH | 7.5 | 0.2% | Oct 6, 2026 | Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete... |
| CVE-2026-106547 | HIGH | 8.5 | 0.2% | Oct 6, 2026 | A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an app... |
| CVE-2026-106494 | MEDIUM | 4.9 | 0.3% | Oct 6, 2026 | Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package ... |
| CVE-2026-106493 | MEDIUM | 4.1 | 0.3% | Oct 6, 2026 | Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not ... |
| CVE-2026-106492 | MEDIUM | 6.5 | 0.2% | Oct 6, 2026 | Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaul... |
| CVE-2026-106491 | MEDIUM | 6.4 | 0.3% | Oct 6, 2026 | Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend pack... |
| CVE-2026-106490 | MEDIUM | 6.5 | 0.4% | Oct 6, 2026 | Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend pa... |
| CVE-2026-106489 | MEDIUM | 6.5 | 0.3% | Oct 6, 2026 | Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend pa... |