CVE Vulnerability Database
Search and browse 425,062 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-93317 | MEDIUM | 5.9 | 0.2% | Oct 5, 2026 | An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not ma... |
| CVE-2026-93316 | HIGH | 7.1 | 0.2% | Oct 5, 2026 | If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This c... |
| CVE-2026-78413 | MEDIUM | 5.5 | 0.2% | Oct 5, 2026 | Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do ... |
| CVE-2026-78411 | MEDIUM | 6.5 | 0.2% | Oct 5, 2026 | Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows ... |
| CVE-2026-42700 | MEDIUM | 6.5 | 0.2% | Oct 5, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Sli... |
| CVE-2026-105633 | HIGH | 7.1 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id... |
| CVE-2026-105632 | HIGH | 8.7 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace mem... |
| CVE-2026-105631 | HIGH | 7.5 | 0.2% | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownlo... |
| CVE-2026-105630 | HIGH | 8.7 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, includ... |
| CVE-2026-105629 | HIGH | 7.1 | 0.2% | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate ... |
| CVE-2026-105628 | HIGH | 7.6 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avata... |
| CVE-2026-105385 | HIGH | 7.3 | 0.3% | Oct 5, 2026 | A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61... |
| CVE-2026-105384 | HIGH | 7.3 | 0.3% | Oct 5, 2026 | A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is ... |
| CVE-2026-104979 | HIGH | 8.7 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes ... |
| CVE-2026-104978 | HIGH | 8.2 | 0.3% | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible ... |
| CVE-2026-104977 | HIGH | 7.7 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an ... |
| CVE-2026-104976 | HIGH | 8.7 | 0.2% | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and ... |
| CVE-2026-104975 | HIGH | 7.1 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/as... |
| CVE-2026-104974 | HIGH | 8.1 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is... |
| CVE-2026-104973 | HIGH | 7.6 | 0.3% | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP address... |
| CVE-2026-104971 | HIGH | 8.5 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset witho... |
| CVE-2026-104905 | HIGH | 8.1 | 0.5% | Oct 5, 2026 | FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() th... |
| CVE-2026-102576 | MEDIUM | 4.2 | 0.3% | Oct 5, 2026 | A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cros... |
| CVE-2026-102295 | MEDIUM | 5.4 | 0.2% | Oct 5, 2026 | A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attac... |
| CVE-2026-101919 | HIGH | 8.8 | 0.4% | Oct 5, 2026 | A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) sec... |