CVE Vulnerability Database
Search and browse 425,004 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-106449 | LOW | 3.7 | 0.3% | Oct 6, 2026 | yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with ... |
| CVE-2026-106448 | HIGH | 8.9 | 0.4% | Oct 6, 2026 | StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map dec... |
| CVE-2026-106447 | HIGH | 8.7 | 0.4% | Oct 6, 2026 | StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recu... |
| CVE-2026-106446 | CRITICAL | 9.8 | 0.6% | Oct 6, 2026 | Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compi... |
| CVE-2026-106445 | CRITICAL | 9.2 | 0.4% | Oct 6, 2026 | Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars looku... |
| CVE-2026-106444 | MEDIUM | 4.7 | — | Oct 6, 2026 | Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.preco... |
| CVE-2026-106063 | MEDIUM | 6.3 | 0.1% | Oct 6, 2026 | A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large widt... |
| CVE-2026-105244 | MEDIUM | 5.3 | 0.3% | Oct 6, 2026 | Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character ou... |
| CVE-2026-105243 | MEDIUM | 5.3 | 0.3% | Oct 6, 2026 | Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed s... |
| CVE-2026-105242 | MEDIUM | 5.3 | 0.3% | Oct 6, 2026 | Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Re... |
| CVE-2026-105241 | MEDIUM | 5.3 | 0.3% | Oct 6, 2026 | Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the ma... |
| CVE-2026-105240 | MEDIUM | 5.3 | 0.3% | Oct 6, 2026 | Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net. ... |
| CVE-2026-105239 | MEDIUM | 5.3 | 0.3% | Oct 6, 2026 | Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL ch... |
| CVE-2026-105111 | MEDIUM | 4.7 | — | Oct 6, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCE... |
| CVE-2026-104636 | HIGH | 7.5 | 0.3% | Oct 6, 2026 | Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads,... |
| CVE-2026-104632 | HIGH | 8.8 | 0.3% | Oct 6, 2026 | Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approve... |
| CVE-2026-104626 | HIGH | 8.8 | 0.3% | Oct 6, 2026 | A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gite... |
| CVE-2026-104048 | HIGH | 8.1 | 0.3% | Oct 6, 2026 | A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (H... |
| CVE-2026-104047 | MEDIUM | 5.3 | 0.1% | Oct 6, 2026 | A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before bei... |
| CVE-2026-103670 | HIGH | 7.5 | 0.2% | Oct 6, 2026 | When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without ch... |
| CVE-2026-103667 | MEDIUM | 5.4 | 0.2% | Oct 6, 2026 | Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed imag... |
| CVE-2026-103504 | HIGH | 8.1 | 0.2% | Oct 6, 2026 | Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's p... |
| CVE-2026-103059 | CRITICAL | 9.1 | 0.3% | Oct 6, 2026 | When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an ... |
| CVE-2026-103009 | HIGH | 7.1 | 0.2% | Oct 6, 2026 | Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a spe... |
| CVE-2026-103008 | MEDIUM | 6.5 | 0.3% | Oct 6, 2026 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that cau... |