CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 27/10/2026 |
| CVE-2026-102787 | MEDIUM5.3 | Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5 | 27/10/2026 |
| CVE-2026-92885 | CRITICAL9.8 | The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_ | 27/10/2026 |
| CVE-2026-65213 | MEDIUM6.6 | This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC | 27/10/2026 |
| CVE-2026-65211 | HIGH7.2 | This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system. | 27/10/2026 |
| CVE-2026-65220 | HIGH8.8 | A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges. | 27/10/2026 |
| CVE-2026-65219 | HIGH7.4 | A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands. | 27/10/2026 |
| CVE-2026-65210 | MEDIUM4.9 | This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role. | 27/10/2026 |
| CVE-2026-18451 | LOW3.1 | The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session. | 27/10/2026 |
| CVE-2026-18450 | CRITICAL9.8 | The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session. | 27/10/2026 |
| CVE-2026-18449 | HIGH7.5 | The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session. | 27/10/2026 |
| CVE-2026-16521 | HIGH7.2 | An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted. | 27/10/2026 |
| CVE-2026-111461 | HIGH7.5 | An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management functionality to execute arbitrary commands on the affected device. | 27/10/2026 |
| CVE-2026-111460 | HIGH7.7 | A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potentially compromising the con | 27/10/2026 |
| CVE-2026-111459 | HIGH7.6 | An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack, potentially c | 27/10/2026 |
| CVE-2026-10511 | MEDIUM6.4 | The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' parameter in all versions up to, and including, 4.61.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and abo | 27/10/2026 |
| CVE-2026-107472 | MEDIUM4.3 | An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret | 27/10/2026 |
| CVE-2026-101034 | MEDIUM6.8 | An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmitted by GSS Deployment Server installation. | 27/10/2026 |