CVE Vulnerability Database
Search and browse 425,060 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-101893 | MEDIUM | 4.4 | 0.2% | Oct 5, 2026 | Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Fi... |
| CVE-2026-97257 | HIGH | 8.8 | 0.4% | Oct 5, 2026 | Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object I... |
| CVE-2026-95265 | HIGH | 7.5 | 0.1% | Oct 5, 2026 | Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The priv... |
| CVE-2026-95264 | MEDIUM | 6.5 | 0.2% | Oct 5, 2026 | Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can del... |
| CVE-2026-95263 | HIGH | 7.2 | 0.2% | Oct 5, 2026 | Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-upda... |
| CVE-2026-94201 | HIGH | 8.2 | 0.3% | Oct 5, 2026 | Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a fil... |
| CVE-2026-93617 | HIGH | 7.2 | 0.3% | Oct 5, 2026 | Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Inj... |
| CVE-2026-78862 | MEDIUM | 6.8 | 0.2% | Oct 5, 2026 | An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the prin... |
| CVE-2026-78861 | HIGH | 7.7 | 0.2% | Oct 5, 2026 | An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key |
| CVE-2026-78860 | HIGH | 7.8 | 0.2% | Oct 5, 2026 | An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plainte... |
| CVE-2026-71299 | MEDIUM | 6.5 | 0.3% | Oct 5, 2026 | A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This... |
| CVE-2026-71298 | MEDIUM | 6.4 | 0.3% | Oct 5, 2026 | A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parame... |
| CVE-2026-71297 | MEDIUM | 5.4 | 0.2% | Oct 5, 2026 | A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificat... |
| CVE-2026-105767 | LOW | 3.3 | 0.2% | Oct 5, 2026 | Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action... |
| CVE-2026-105766 | LOW | 3.1 | 0.1% | Oct 5, 2026 | Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy ... |
| CVE-2026-105696 | MEDIUM | 6.5 | 0.3% | Oct 5, 2026 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permiss... |
| CVE-2026-105695 | MEDIUM | 5.9 | — | Oct 5, 2026 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session u... |
| CVE-2026-105694 | MEDIUM | 5.4 | 0.2% | Oct 5, 2026 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission... |
| CVE-2026-105693 | MEDIUM | 5.3 | — | Oct 5, 2026 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC ... |
| CVE-2026-105692 | MEDIUM | 5.4 | 0.2% | Oct 5, 2026 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-... |
| CVE-2026-105691 | CRITICAL | 9.9 | 0.4% | Oct 5, 2026 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlle... |
| CVE-2026-105690 | MEDIUM | 5.9 | — | Oct 5, 2026 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie... |
| CVE-2026-105689 | MEDIUM | 6 | 0.3% | Oct 5, 2026 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java... |
| CVE-2026-105688 | MEDIUM | 6.7 | — | Oct 5, 2026 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation ac... |
| CVE-2026-105687 | MEDIUM | 4.9 | 0.3% | Oct 5, 2026 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team admi... |