CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 30/10/2026 |
| CVE-2026-116860 | MEDIUM5.3 | Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.65. | 30/10/2026 |
| CVE-2026-112905 | CRITICAL9.0 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in version 1.0.8.7. | 30/10/2026 |
| CVE-2026-111487 | MEDIUM4.3 | An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module. | 30/10/2026 |
| CVE-2026-110799 | CRITICAL9.8 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been patched in version 1.0.8.7 | 30/10/2026 |
| CVE-2015-20130 | MEDIUM6.1 | Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view_server_log.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HTML response without o | 30/10/2026 |
| CVE-2010-20125 | HIGH7.5 | DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outs | 30/10/2026 |
| GHSA-f3fj-9625-rv3m | MEDIUM5.9 | charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users | 30/10/2026 |
| GHSA-fgxm-5hvv-x4vh | MEDIUM5.3 | charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories | 30/10/2026 |
| CVE-2026-91915 | MEDIUM6.8 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection. | 30/10/2026 |
| CVE-2026-91914 | HIGH7.1 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Session theft. | 30/10/2026 |
| CVE-2026-91913 | HIGH8.8 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. | 30/10/2026 |
| CVE-2026-91912 | MEDIUM6.5 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. | 30/10/2026 |
| CVE-2026-86715 | HIGH7.1 | Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials.
This issue affects Vatos DLP: from 1.1.176 before 1.1.243. | 30/10/2026 |
| CVE-2026-119602 | LOW3.7 | libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write | 30/10/2026 |
| CVE-2026-119601 | MEDIUM6.1 | AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the sector zero-fill loop | 30/10/2026 |
| CVE-2026-119600 | MEDIUM4.8 | tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into reconstructed flow fil | 30/10/2026 |