CVE Vulnerability Database
Search and browse 425,066 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-82039 | HIGH | 8.8 | 0.3% | Oct 2, 2026 | UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows ... |
| CVE-2026-39718 | HIGH | 8.8 | 0.1% | Oct 2, 2026 | Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This ... |
| CVE-2026-12392 | MEDIUM | 5.3 | 0.3% | Oct 2, 2026 | An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows... |
| CVE-2026-104994 | LOW | 2.5 | 0.2% | Oct 2, 2026 | Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above... |
| CVE-2026-104991 | HIGH | 7.1 | 0.2% | Oct 2, 2026 | Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (sing... |
| CVE-2026-104988 | HIGH | 8.1 | 0.2% | Oct 2, 2026 | A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enroll... |
| CVE-2026-104873 | HIGH | 7.6 | 0.3% | Oct 2, 2026 | LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs fro... |
| CVE-2026-104872 | MEDIUM | 5.8 | 0.2% | Oct 2, 2026 | OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript application... |
| CVE-2026-104871 | MEDIUM | 6.3 | 0.4% | Oct 2, 2026 | The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7... |
| CVE-2026-104019 | CRITICAL | 9 | 1.4% | Oct 2, 2026 | OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, ... |
| CVE-2026-103918 | MEDIUM | 6.5 | 0.2% | Oct 2, 2026 | oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, th... |
| CVE-2026-103036 | MEDIUM | 6.5 | 0.2% | Oct 2, 2026 | oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the... |
| CVE-2026-96940 | HIGH | 8.8 | 0.5% | Oct 2, 2026 | Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-19856 | MEDIUM | 6.5 | 0.2% | Oct 2, 2026 | The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content ... |
| CVE-2026-103958 | HIGH | 7.6 | 0.3% | Oct 2, 2026 | Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might a... |
| CVE-2026-103957 | MEDIUM | 6.2 | 0.4% | Oct 2, 2026 | Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated r... |
| CVE-2026-103956 | CRITICAL | 10 | 0.5% | Oct 2, 2026 | Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remot... |
| CVE-2023-54405 | CRITICAL | 9.8 | 0.6% | Oct 2, 2026 | H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitr... |
| CVE-2020-37278 | HIGH | 7.5 | 0.4% | Oct 2, 2026 | Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arb... |
| CVE-2014-125130 | HIGH | 7.5 | 0.5% | Oct 2, 2026 | CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticate... |
| CVE-2026-64818 | — | — | — | Oct 2, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-59265 | HIGH | 8.8 | 0.4% | Oct 2, 2026 | A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted docum... |
| CVE-2026-104861 | HIGH | 7.5 | — | Oct 2, 2026 | probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and li... |
| CVE-2026-104859 | HIGH | 7.3 | 0.1% | Oct 2, 2026 | Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, ... |
| CVE-2026-104855 | LOW | 2 | 0.3% | Oct 2, 2026 | Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk... |