Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (53630 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-114615 1 Authlib 1 Authlib 2026-10-23 7.4 High
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.
CVE-2026-79859 2026-10-23 9.8 Critical
No description provided
CVE-2026-79888 2026-10-23 8.1 High
No description provided
CVE-2026-79891 2026-10-23 8.1 High
No description provided
CVE-2026-79893 2026-10-23 7.5 High
No description provided
CVE-2026-79955 2026-10-23 7.5 High
No description provided
CVE-2026-95720 2026-10-23 4.4 Medium
No description provided
CVE-2026-95721 2026-10-23 3.3 Low
No description provided
CVE-2026-115484 2 Red Hat, Redhat 2 Enterprise Linux, Enterprise Linux 2026-10-23 7.6 High
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
CVE-2026-79860 2026-10-23 9.8 Critical
No description provided
CVE-2026-79863 2026-10-23 9.6 Critical
No description provided
CVE-2026-79865 2026-10-23 9.6 Critical
No description provided
CVE-2026-79879 2026-10-23 8.8 High
No description provided
CVE-2026-79883 2026-10-23 8.3 High
No description provided
CVE-2026-79886 2026-10-23 8.2 High
No description provided
CVE-2026-79889 2026-10-23 8.1 High
No description provided
CVE-2026-79892 2026-10-23 7.8 High
No description provided
CVE-2026-115349 2 Lepture, Mistune Project 2 Mistune, Mistune 2026-10-23 7.5 High
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
CVE-2026-86020 2026-10-23 4.6 Medium
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.
CVE-2026-114645 1 Mongodb 1 C Driver 2026-10-23 5.2 Medium
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side configuration, in conjunction with the affected authentication mechanism, can cause the driver to write outside the bounds of the allocated buffer. This may result in corruption of client process memory and denial of service of the client application. The issue affects only client builds compiled with the Windows-native authentication backend.