CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 02/11/2026 |
| CVE-2026-99218 | ALTO7.0 | In the Linux kernel, the following vulnerability has been resolved:
coredump: hold RCU while releasing parked threads
coredump_finish() releases the parked threads by clearing ->task in
their core_thread entry and calling wake_up_process() on each of them.
It does that without holding a reference on the task and with | 02/11/2026 |
| CVE-2026-99217 | In the Linux kernel, the following vulnerability has been resolved:
fork: release the files of a failed fork after sched_cancel_fork()
Reorder copy_process() cleanup so sched_fork() taking scx_fork_rwsem
scx_pre_fork() is safe and isn't held around exiting files. Right now, a
fork that fails while another thread clos | 02/11/2026 |
| CVE-2026-94290 | CRÍTICO9.1 | SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordi | 02/11/2026 |
| CVE-2026-88809 | ALTO7.6 | A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it could not stop a request from being forwarded, so a rejected | 02/11/2026 |
| CVE-2026-77881 | MEDIO6.2 | Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requests to the unauthen | 02/11/2026 |
| CVE-2026-77880 | ALTO8.4 | Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving rem | 02/11/2026 |
| CVE-2026-77879 | ALTO7.7 | Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id p | 02/11/2026 |
| CVE-2026-77878 | ALTO8.4 | Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker ab | 02/11/2026 |
| CVE-2026-77877 | ALTO8.4 | Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_acc | 02/11/2026 |
| CVE-2026-77876 | CRÍTICO9.8 | Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, | 02/11/2026 |
| CVE-2026-2102 | MEDIO6.1 | wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an atta | 02/11/2026 |
| CVE-2026-16306 | Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted `imodular:// URI` containing attacker-controlled command and argument parame | 02/11/2026 |
| CVE-2026-120501 | MEDIO5.3 | An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to render the file as a ta | 02/11/2026 |
| CVE-2026-120500 | MEDIO6.1 | An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code that allows attackers who can edit pages, including anonymous users under the default configuration, to inject arbitrary script. Attackers can place HTML inside a math fenced code block, which is rendered | 02/11/2026 |
| CVE-2026-115654 | MEDIO6.9 | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a thread passed by a user-mode, memory-protected module belongs to that module. Any loaded module can suspend, resume, terminate, reset or re-prioritise application threads and other modules' threads a | 02/11/2026 |
| CVE-2026-115653 | ALTO7.0 | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer against the thread's stack. A user-mode, memory-protected mod | 02/11/2026 |
| CVE-2026-114408 | ALTO8.7 | In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too Big messages quoting new | 02/11/2026 |