CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 29/10/2026 |
| CVE-2026-7190 | MEDIUM5.1 | A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in the ‘login.php’ endpoint, where the ‘editForm[extension_username]’ parameter is reflected in the response without proper filtering. Successful exploitation of this vulnerability cou | 29/10/2026 |
| CVE-2026-115303 | LOW3.7 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbit | 29/10/2026 |
| CVE-2026-114358 | CRITICAL9.3 | This
vulnerability exists in the Radius
Xenia M2M Platform due to insufficient validation of user supplied input in
the password recovery functionality in the web management interface. An
unauthenticated remote attacker could exploit this vulnerability by supplying
crafted SQL query through input fields to the targeted | 29/10/2026 |
| CVE-2025-62841 | HIGH8.7 | An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.
We have already fixed the vulnerability in the following version:
HBS 3 Hybrid Backup | 29/10/2026 |
| CVE-2025-62839 | HIGH8.7 | An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.
We have already fixed the vulnerability in the following version:
HBS 3 Hybrid Backup | 29/10/2026 |
| CVE-2026-118030 | MEDIUM4.2 | A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users pass | 29/10/2026 |
| CVE-2026-117859 | MEDIUM5.4 | A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an attacker to reuse the same a | 29/10/2026 |
| CVE-2026-117688 | MEDIUM5.3 | A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client se | 29/10/2026 |
| CVE-2026-117627 | MEDIUM5.4 | A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based gran | 29/10/2026 |
| CVE-2026-117548 | MEDIUM6.5 | A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as "commonName") instead of its canonical name (such as "cn") as the new relative distinguished name. An authenticated attacker with the ModifyDN (rename) permission | 29/10/2026 |
| CVE-2026-93293 | MEDIUM6.4 | The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. Once the site's Freemius opt-in is complete (the normal state after | 29/10/2026 |
| CVE-2026-89216 | HIGH8.6 | The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database. | 29/10/2026 |
| CVE-2026-88928 | MEDIUM6.5 | The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card | 29/10/2026 |
| CVE-2026-86794 | HIGH8.8 | The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated users to inject arbitra | 29/10/2026 |
| CVE-2026-85007 | LOW3.8 | The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well. | 29/10/2026 |
| CVE-2026-78396 | MEDIUM5.3 | The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set is configured not to d | 29/10/2026 |
| CVE-2026-78395 | MEDIUM5.3 | The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not. | 29/10/2026 |