CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 26/10/2026 |
| CVE-2026-116581 | HIGH7.5 | Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. | 26/10/2026 |
| CVE-2026-116580 | HIGH7.3 | Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted Seroval input and an applicatio | 26/10/2026 |
| CVE-2026-116579 | MEDIUM5.9 | Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame has been infla | 26/10/2026 |
| CVE-2026-116578 | LOW2.1 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly afte | 26/10/2026 |
| CVE-2026-116577 | MEDIUM5.3 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing man | 26/10/2026 |
| CVE-2026-116576 | HIGH7.8 | systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits | 26/10/2026 |
| CVE-2026-116575 | MEDIUM6.3 | Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delim | 26/10/2026 |
| CVE-2026-116506 | CRITICAL9.9 | A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. | 26/10/2026 |
| CVE-2026-116505 | CRITICAL9.1 | A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched remotely. The exploit ha | 26/10/2026 |
| CVE-2026-116504 | CRITICAL9.9 | A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been d | 26/10/2026 |
| CVE-2026-116502 | MEDIUM4.4 | A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::make_sequential of the file exllamav2/exllamav2_ext/cuda/q_matrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument g_idx can lead to out-of-bounds write. The attack needs to be lau | 26/10/2026 |
| CVE-2026-113952 | MEDIUM5.4 | A logic issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2. A website may be able to use a media format that should be restricted in Lockdown Mode. | 26/10/2026 |
| CVE-2026-113950 | MEDIUM5.4 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory. | 26/10/2026 |
| CVE-2026-113949 | HIGH8.8 | A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to memory corruption. | 26/10/2026 |
| CVE-2026-113948 | MEDIUM5.5 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2. An app may be able to modify protected parts of the file system. | 26/10/2026 |
| CVE-2026-113947 | HIGH8.8 | This issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2. Unpacking a maliciously crafted archive may lead to unexpected app termination or arbitrary code execution. | 26/10/2026 |
| CVE-2026-113946 | HIGH7.8 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory. | 26/10/2026 |