CVE Vulnerability Database
Search and browse 425,062 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-15643 | HIGH | 7.1 | 0.1% | Oct 5, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Ads... |
| CVE-2026-86671 | HIGH | 8.4 | 0.3% | Oct 5, 2026 | In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an ... |
| CVE-2026-78412 | MEDIUM | 4.9 | 0.2% | Oct 5, 2026 | Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server che... |
| CVE-2026-12171 | HIGH | 7.8 | 0.2% | Oct 5, 2026 | auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the aut... |
| CVE-2026-105383 | HIGH | 7.3 | 0.3% | Oct 5, 2026 | A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61... |
| CVE-2026-105382 | HIGH | 7.3 | 0.3% | Oct 5, 2026 | A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This a... |
| CVE-2026-104970 | HIGH | 8.1 | 0.3% | Oct 5, 2026 | Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/li... |
| CVE-2026-104969 | MEDIUM | 6.5 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the re... |
| CVE-2026-104968 | HIGH | 8.7 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=us... |
| CVE-2026-104967 | MEDIUM | 5.4 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/... |
| CVE-2026-104966 | HIGH | 8.7 | 0.2% | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resour... |
| CVE-2026-104965 | MEDIUM | 5.4 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the ... |
| CVE-2026-104964 | MEDIUM | 6.8 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller a... |
| CVE-2026-104963 | MEDIUM | 4.3 | 0.2% | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyc... |
| CVE-2026-104962 | MEDIUM | 6.5 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/mem... |
| CVE-2026-104961 | MEDIUM | 5.4 | 0.2% | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require is_active=Tru... |
| CVE-2026-104960 | MEDIUM | 6.5 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/w... |
| CVE-2026-104956 | MEDIUM | 5.3 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts grou... |
| CVE-2026-104955 | MEDIUM | 5.4 | 0.2% | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request ... |
| CVE-2026-104894 | MEDIUM | 4.3 | — | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL pat... |
| CVE-2026-104893 | MEDIUM | 5.4 | 0.3% | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user... |
| CVE-2026-102779 | HIGH | 7.3 | 0.4% | Oct 5, 2026 | Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - ... |
| CVE-2026-102777 | MEDIUM | 6.5 | 0.3% | Oct 5, 2026 | Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < ... |
| CVE-2026-102282 | HIGH | 7.1 | 0.1% | Oct 5, 2026 | adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the... |
| CVE-2026-88397 | MEDIUM | 6.5 | 0.2% | Oct 5, 2026 | ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid ... |