CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| GHSA-2wrx-84qj-4pcg |
| MEDIUM6.5 |
anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS |
| 30/10/2026 |
| CVE-2026-96634 | MEDIUM | AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE | 30/10/2026 |
| CVE-2026-96633 | HIGH8.1 | AdminNeo SQLite Database-List Drop Arbitrary File Deletion | 30/10/2026 |
| CVE-2026-96631 | HIGH8.2 | AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers | 30/10/2026 |
| CVE-2026-96632 | HIGH | AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass) | 30/10/2026 |
| CVE-2026-96630 | HIGH7.2 | AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass) | 30/10/2026 |
| CVE-2026-96629 | MEDIUM6.8 | AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery | 30/10/2026 |
| CVE-2026-54442 | MEDIUM4.8 | NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571 | 30/10/2026 |
| CVE-2026-63224 | HIGH7.2 | OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV crosstab` SQL by concatenating an `asset name` and `attribute name` into a `COPY` query that uses `crosstab` and streams `TO STDOUT`. The `asset name` enters both a double-quoted column identifier and a | 30/10/2026 |
| CVE-2026-63201 | HIGH7.1 | Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netcon | 30/10/2026 |
| CVE-2026-63184 | HIGH7.1 | Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote `http(s) | 30/10/2026 |
| CVE-2026-63182 | HIGH8.1 | LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. `Response::deserialize` uses `manyElementsFromXml` to coll | 30/10/2026 |
| CVE-2026-63121 | MEDIUM6.3 | Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, `trusted-repos-policy` compares an image's `registry` hostname against `reject lists` and `allow lists` case-sensitively even though `registry` DNS | 30/10/2026 |
| CVE-2026-63115 | MEDIUM5.3 | ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service to act on a `follow` or `repost` as though the activity came from a different account. This permits removal of an existing `follow` relationship | 30/10/2026 |
| CVE-2026-62347 | MEDIUM5.9 | Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call `SPA` logs the `password` URL query parameter. When a user submits an error report, called a rageshake, these logs are shared with the application operator. Users can therefore unintentionally disclose | 30/10/2026 |
| CVE-2026-62277 | MEDIUM6.5 | LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, `PrintRecordStickers` in `/Controllers/VehicleController.cs` checks through `CollaboratorFilter` that the authenticated caller can view the supplied `vehicleId`, but fetches caller-supplied `recordIds` with | 30/10/2026 |