CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 27/10/2026 |
| CVE-2026-116680 | MEDIUM6.4 | HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled delivery, but shoutrrr sends the request through http.DefaultClient.Do without a CheckRedirect policy that revalidates each Locat | 27/10/2026 |
| CVE-2026-116679 | MEDIUM5.4 | Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room membe | 27/10/2026 |
| CVE-2026-116678 | MEDIUM5.8 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to get_page_with_referer() without applying should_block_host() to the second-stage host. Th | 27/10/2026 |
| CVE-2026-116677 | MEDIUM5.3 | OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's certificat | 27/10/2026 |
| CVE-2026-116676 | HIGH8.8 | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, " ") and executed through sh | 27/10/2026 |
| CVE-2026-116662 | HIGH7.5 | Tanium addressed a compression bomb vulnerability in Enforce. | 27/10/2026 |
| CVE-2026-116660 | MEDIUM4.3 | Tanium addressed an improper access controls vulnerability in Enforce. | 27/10/2026 |
| CVE-2026-116659 | MEDIUM4.3 | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | 27/10/2026 |
| CVE-2026-116658 | MEDIUM6.5 | Tanium addressed a denial of service vulnerability in Enforce. | 27/10/2026 |
| CVE-2026-116657 | MEDIUM5.3 | Tanium addressed a denial of service vulnerability in Enforce. | 27/10/2026 |
| CVE-2026-116656 | HIGH7.5 | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | 27/10/2026 |
| CVE-2026-116649 | HIGH7.1 | Tanium addressed an improper output sanitization vulnerability in Enforce. | 27/10/2026 |
| CVE-2026-116647 | HIGH7.1 | Tanium addressed an improper output sanitization vulnerability in Comply. | 27/10/2026 |
| CVE-2026-108333 | LOW2.5 | Tanium addressed a use-after-free vulnerability in Threat Response Client Extension. | 27/10/2026 |
| CVE-2026-108332 | MEDIUM6.3 | Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension. | 27/10/2026 |
| CVE-2026-108331 | LOW3.3 | Tanium addressed an infinite loop vulnerability in Threat Response Client Extension. | 27/10/2026 |
| CVE-2026-108330 | LOW3.6 | Tanium addressed an information disclosure vulnerability in Threat Response Client Extension. | 27/10/2026 |