CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CRITICAL9.4 |
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31. |
| 27/10/2026 |
| CVE-2026-117493 | HIGH8.3 | Stored Cross-Site Scripting (XSS) in Sisense BloX widgets, in all versions, both on Sisense Cloud and in self-hosted deployments, allows an authenticated user with the Designer or Administrator role to execute JavaScript code in the browser of another user who opens the dashboard, via HTML or JavaScript code inserted i | 27/10/2026 |
| CVE-2026-107147 | MEDIUM6.3 | The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the second factor being byp | 27/10/2026 |
| CVE-2026-107146 | MEDIUM6.3 | The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the | 27/10/2026 |
| CVE-2026-107145 | MEDIUM6.3 | The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system.
This issue was fixed in c | 27/10/2026 |
| CVE-2026-102789 | CRITICAL9.3 | Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check. | 27/10/2026 |
| CVE-2026-102788 | CRITICAL9.3 | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a | 27/10/2026 |
| CVE-2026-102787 | MEDIUM5.3 | Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5 | 27/10/2026 |
| CVE-2026-92885 | CRITICAL9.8 | The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_ | 27/10/2026 |
| CVE-2026-65213 | MEDIUM6.6 | This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC | 27/10/2026 |
| CVE-2026-65211 | HIGH7.2 | This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system. | 27/10/2026 |
| CVE-2026-65220 | HIGH8.8 | A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges. | 27/10/2026 |
| CVE-2026-65219 | HIGH7.4 | A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands. | 27/10/2026 |
| CVE-2026-65210 | MEDIUM4.9 | This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role. | 27/10/2026 |
| CVE-2026-18451 | LOW3.1 | The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session. | 27/10/2026 |
| CVE-2026-18450 | CRITICAL9.8 | The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session. | 27/10/2026 |
| CVE-2026-18449 | HIGH7.5 | The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session. | 27/10/2026 |