CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 03/11/2026 |
| CVE-2026-115293 | MEDIUM6.5 | Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges | 03/11/2026 |
| CVE-2026-115292 | MEDIUM4.3 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame | 03/11/2026 |
| CVE-2026-115290 | HIGH7.5 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials ar | 03/11/2026 |
| CVE-2026-115289 | MEDIUM4.3 | Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A servi | 03/11/2026 |
| CVE-2026-114187 | MEDIUM5.3 | Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0. | 03/11/2026 |
| CVE-2026-114185 | MEDIUM6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0. | 03/11/2026 |
| CVE-2026-114183 | MEDIUM6.5 | Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0. | 03/11/2026 |
| CVE-2026-109594 | MEDIUM6.8 | Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in | 03/11/2026 |
| CVE-2026-109593 | CRITICAL9.1 | An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information. | 03/11/2026 |
| CVE-2026-103916 | HIGH8.4 | Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with th | 03/11/2026 |
| CVE-2026-103077 | MEDIUM4.3 | Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | 03/11/2026 |
| GHSA-9ppr-wfw9-xvr2 | MEDIUM | Netfoil doesn't decrement TTL | 03/11/2026 |
| GHSA-m3qr-fvp4-78xj | LOW | Arc has unauthenticated application log disclosure via `/api/v1/logs` | 03/11/2026 |
| CVE-2026-97350 | MEDIUM6.9 | Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy settings that allow non-privileged local users to influence operations performed with NT AUTHORITY\SYSTEM privileges.
Two attack vectors have been identified:
*
Improper authorization of config | 03/11/2026 |
| CVE-2026-73328 | HIGH7.2 | Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user. | 03/11/2026 |
| CVE-2026-65168 | HIGH7.0 | NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code. | 03/11/2026 |
| CVE-2026-65165 | MEDIUM5.3 | NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation. | 03/11/2026 |