Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (413848 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-114615 1 Authlib 1 Authlib 2026-10-23 7.4 High
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.
CVE-2026-79855 2026-10-23 9.8 Critical
No description provided
CVE-2026-79859 2026-10-23 9.8 Critical
No description provided
CVE-2026-79888 2026-10-23 8.1 High
No description provided
CVE-2026-79891 2026-10-23 8.1 High
No description provided
CVE-2026-79893 2026-10-23 7.5 High
No description provided
CVE-2026-79894 2026-10-23 7.5 High
No description provided
CVE-2026-79955 2026-10-23 7.5 High
No description provided
CVE-2026-79956 2026-10-23 7.2 High
No description provided
CVE-2026-95704 2026-10-23 7.2 High
No description provided
CVE-2026-95705 2026-10-23 7.2 High
No description provided
CVE-2026-95709 2026-10-23 7.2 High
No description provided
CVE-2026-95711 2026-10-23 7.1 High
No description provided
CVE-2026-95712 2026-10-23 7.1 High
No description provided
CVE-2026-95717 2026-10-23 5.5 Medium
No description provided
CVE-2026-95718 2026-10-23 5.3 Medium
No description provided
CVE-2026-95719 2026-10-23 4.9 Medium
No description provided
CVE-2026-95720 2026-10-23 4.4 Medium
No description provided
CVE-2026-95721 2026-10-23 3.3 Low
No description provided
CVE-2026-115351 2 Lepture, Mistune Project 2 Mistune, Mistune 2026-10-23 4.7 Medium
Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url() to the rendered figure style attribute, forcing victim browsers to send requests to attacker servers and leak attribute values.