CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript payload. When the victim o |
| 29/10/2026 |
| CVE-2026-66911 | MEDIUM5.3 | Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when the victim opens the | 29/10/2026 |
| CVE-2026-62131 | CRITICAL9.8 | Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | 29/10/2026 |
| CVE-2026-62018 | CRITICAL9.8 | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | 29/10/2026 |
| CVE-2026-62017 | CRITICAL9.8 | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | 29/10/2026 |
| CVE-2026-62016 | CRITICAL9.8 | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | 29/10/2026 |
| CVE-2026-62015 | CRITICAL9.8 | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | 29/10/2026 |
| CVE-2026-62014 | CRITICAL9.8 | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | 29/10/2026 |
| CVE-2026-62013 | CRITICAL9.8 | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | 29/10/2026 |
| CVE-2026-62012 | CRITICAL9.8 | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | 29/10/2026 |
| CVE-2026-62011 | CRITICAL9.8 | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | 29/10/2026 |
| CVE-2026-62010 | CRITICAL9.8 | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | 29/10/2026 |
| CVE-2026-62009 | CRITICAL9.8 | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | 29/10/2026 |
| CVE-2026-62008 | CRITICAL9.8 | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | 29/10/2026 |
| CVE-2026-62006 | CRITICAL9.8 | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | 29/10/2026 |
| CVE-2026-62005 | CRITICAL9.8 | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | 29/10/2026 |
| CVE-2026-62004 | CRITICAL9.8 | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | 29/10/2026 |