CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 29/10/2026 |
| CVE-2026-54857 | CRITICAL9.8 | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | 29/10/2026 |
| CVE-2026-54856 | CRITICAL9.8 | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | 29/10/2026 |
| CVE-2026-48200 | MEDIUM5.3 | Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0. | 29/10/2026 |
| CVE-2026-42701 | HIGH7.2 | Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. | 29/10/2026 |
| CVE-2026-42694 | MEDIUM4.3 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0. | 29/10/2026 |
| CVE-2026-42692 | HIGH7.1 | Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. | 29/10/2026 |
| CVE-2026-42690 | MEDIUM5.4 | Subscriber Broken Access Control in LearnPress <= 4.4.10 versions. | 29/10/2026 |
| CVE-2026-27394 | HIGH7.1 | Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions. | 29/10/2026 |
| CVE-2026-20942 | MEDIUM4.3 | Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 29/10/2026 |
| CVE-2026-18894 | CRITICAL9.8 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-tr | 29/10/2026 |
| CVE-2026-119145 | CRITICAL9.9 | Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution | 29/10/2026 |
| CVE-2026-119144 | HIGH8.8 | Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates | 29/10/2026 |
| CVE-2026-119143 | MEDIUM4.8 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length component model stream reads or writes with unvalidated addresses, causing Direct | 29/10/2026 |
| CVE-2026-119142 | MEDIUM4.8 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting error, crashing embedder | 29/10/2026 |
| CVE-2026-119141 | MEDIUM5.3 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, such as cancelling the a | 29/10/2026 |