CVE Vulnerability Database
Search and browse 425,066 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-105051 | LOW | 1.9 | 0.1% | Oct 2, 2026 | Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys... |
| CVE-2026-105050 | HIGH | 7.1 | 0.5% | Oct 2, 2026 | PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive... |
| CVE-2026-105049 | MEDIUM | 5.8 | 0.2% | Oct 2, 2026 | Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and H... |
| CVE-2026-105048 | MEDIUM | 4 | 0.2% | Oct 2, 2026 | The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses). |
| CVE-2026-97363 | HIGH | 7.5 | 0.3% | Oct 2, 2026 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc... |
| CVE-2026-97212 | HIGH | 7.3 | 0.2% | Oct 2, 2026 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to ... |
| CVE-2026-95102 | CRITICAL | 9.4 | 0.3% | Oct 2, 2026 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a res... |
| CVE-2026-94594 | MEDIUM | 4 | 0.1% | Oct 2, 2026 | Armatura One's message broker logs client connection credentials and the associated password in plain text during normal... |
| CVE-2026-94593 | HIGH | 7.8 | 0.1% | Oct 2, 2026 | Armatura One's backup and restore routine records the full database connection command, including the superuser password... |
| CVE-2026-94592 | HIGH | 8.4 | 0.1% | Oct 2, 2026 | Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser accoun... |
| CVE-2026-94591 | HIGH | 8.4 | 0.1% | Oct 2, 2026 | Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-1... |
| CVE-2026-93474 | MEDIUM | 6.5 | 0.2% | Oct 2, 2026 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
| CVE-2026-105046 | MEDIUM | 4.3 | 0.2% | Oct 2, 2026 | Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints. |
| CVE-2026-105043 | LOW | 3.6 | 0.1% | Oct 2, 2026 | MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simuli... |
| CVE-2026-104887 | — | — | — | Oct 2, 2026 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-78409. Reason: This candidate is a ... |
| CVE-2026-104886 | — | — | — | Oct 2, 2026 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-78410. Reason: This candidate is a ... |
| CVE-2026-82045 | MEDIUM | 6.5 | 0.3% | Oct 2, 2026 | UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary en... |
| CVE-2026-82044 | HIGH | 7.7 | 0.3% | Oct 2, 2026 | UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make... |
| CVE-2026-82043 | MEDIUM | 5.3 | 0.2% | Oct 2, 2026 | UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine... |
| CVE-2026-82042 | CRITICAL | 9.8 | 0.5% | Oct 2, 2026 | UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full admini... |
| CVE-2026-82041 | CRITICAL | 9.9 | 0.4% | Oct 2, 2026 | UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), ... |
| CVE-2026-75937 | CRITICAL | 9.4 | 0.5% | Oct 2, 2026 | A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute ... |
| CVE-2026-104874 | MEDIUM | 5.3 | 0.3% | Oct 2, 2026 | Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view refle... |
| CVE-2026-104055 | MEDIUM | 5.3 | 0.3% | Oct 2, 2026 | The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitor... |
| CVE-2026-82040 | MEDIUM | 5 | 0.2% | Oct 2, 2026 | UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadata... |