CVE Vulnerability Database
Search and browse 425,064 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-105129 | MEDIUM | 6.5 | 0.3% | Oct 4, 2026 | LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only s... |
| CVE-2026-105128 | MEDIUM | 5.4 | 0.3% | Oct 4, 2026 | LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by sup... |
| CVE-2026-105127 | MEDIUM | 5.3 | 0.4% | Oct 4, 2026 | LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password... |
| CVE-2026-105126 | HIGH | 7.2 | 0.5% | Oct 4, 2026 | LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users... |
| CVE-2026-105125 | LOW | 3.7 | 0.3% | Oct 4, 2026 | LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON fi... |
| CVE-2026-105124 | MEDIUM | 6.1 | 0.2% | Oct 4, 2026 | W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated... |
| CVE-2026-105123 | HIGH | 8.8 | 0.5% | Oct 4, 2026 | W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors... |
| CVE-2026-96451 | HIGH | 8.8 | 0.3% | Oct 3, 2026 | Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows... |
| CVE-2026-103342 | HIGH | 7.1 | 0.1% | Oct 3, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements... |
| CVE-2026-103065 | HIGH | 8.2 | 0.2% | Oct 3, 2026 | Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality N... |
| CVE-2026-105122 | MEDIUM | 5.4 | 0.2% | Oct 3, 2026 | OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modi... |
| CVE-2026-105121 | MEDIUM | 4.9 | 0.3% | Oct 3, 2026 | OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy se... |
| CVE-2026-105120 | MEDIUM | 4.9 | 0.3% | Oct 3, 2026 | OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that a... |
| CVE-2026-105119 | MEDIUM | 6.8 | 0.2% | Oct 3, 2026 | OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is ... |
| CVE-2026-105118 | MEDIUM | 4.7 | 0.1% | Oct 3, 2026 | OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by ... |
| CVE-2026-105117 | MEDIUM | 6.1 | 0.2% | Oct 3, 2026 | OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control ... |
| CVE-2026-105116 | MEDIUM | 6.1 | 0.2% | Oct 3, 2026 | OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target ... |
| CVE-2026-105115 | HIGH | 8.6 | 0.5% | Oct 3, 2026 | OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP ... |
| CVE-2026-105114 | MEDIUM | 6.1 | 0.2% | Oct 3, 2026 | OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to in... |
| CVE-2026-105113 | MEDIUM | 6.5 | 0.2% | Oct 3, 2026 | Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock le... |
| CVE-2026-105112 | MEDIUM | 5.3 | 0.2% | Oct 3, 2026 | Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated ... |
| CVE-2026-105105 | CRITICAL | 9.8 | 0.8% | Oct 3, 2026 | CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) i... |
| CVE-2026-104983 | MEDIUM | 6.3 | 0.4% | Oct 3, 2026 | A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file ... |
| CVE-2026-97873 | MEDIUM | 5.3 | 0.3% | Oct 3, 2026 | In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ra... |
| CVE-2026-85515 | HIGH | 8.2 | 0.2% | Oct 3, 2026 | In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on... |