CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 27/10/2026 |
| CVE-2026-117526 | MEDIUM5.3 | A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only possible with local access. The exploit has been made public and could be used. Th | 27/10/2026 |
| CVE-2026-117516 | HIGH7.3 | A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments causes sql injection. The attack can be initiated remotely. Th | 27/10/2026 |
| CVE-2026-117515 | HIGH7.3 | A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possible to launch the attack remotely. The exploit has been relea | 27/10/2026 |
| CVE-2026-116682 | HIGH8.6 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Do | 27/10/2026 |
| CVE-2026-116680 | MEDIUM6.4 | HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled delivery, but shoutrrr sends the request through http.DefaultClient.Do without a CheckRedirect policy that revalidates each Locat | 27/10/2026 |
| CVE-2026-116679 | MEDIUM5.4 | Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room membe | 27/10/2026 |
| CVE-2026-116678 | MEDIUM5.8 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to get_page_with_referer() without applying should_block_host() to the second-stage host. Th | 27/10/2026 |
| CVE-2026-116677 | MEDIUM5.3 | OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's certificat | 27/10/2026 |
| CVE-2026-116676 | HIGH8.8 | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, " ") and executed through sh | 27/10/2026 |
| CVE-2026-116662 | HIGH7.5 | Tanium addressed a compression bomb vulnerability in Enforce. | 27/10/2026 |
| CVE-2026-116660 | MEDIUM4.3 | Tanium addressed an improper access controls vulnerability in Enforce. | 27/10/2026 |
| CVE-2026-116659 | MEDIUM4.3 | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | 27/10/2026 |
| CVE-2026-116658 | MEDIUM6.5 | Tanium addressed a denial of service vulnerability in Enforce. | 27/10/2026 |
| CVE-2026-116657 | MEDIUM5.3 | Tanium addressed a denial of service vulnerability in Enforce. | 27/10/2026 |
| CVE-2026-116656 | HIGH7.5 | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | 27/10/2026 |
| CVE-2026-116649 | HIGH7.1 | Tanium addressed an improper output sanitization vulnerability in Enforce. | 27/10/2026 |
| CVE-2026-116647 | HIGH7.1 | Tanium addressed an improper output sanitization vulnerability in Comply. | 27/10/2026 |