CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 30/10/2026 |
| CVE-2026-62160 | ALTO8.7 | Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddlewareFunc` through `GetLanguagePreference` to `golang.org/x/text/language.ParseAcceptLanguage` without a size or shape filter. The guard for CVE | 30/10/2026 |
| CVE-2026-62122 | MEDIO5.3 | Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31. | 30/10/2026 |
| CVE-2026-62121 | MEDIO6.5 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited Elements For Elemen | 30/10/2026 |
| CVE-2026-62057 | MEDIO5.3 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0. | 30/10/2026 |
| CVE-2026-62056 | MEDIO5.3 | Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent CRM: from n/a through 3.2.6. | 30/10/2026 |
| CVE-2026-62047 | MEDIO4.3 | Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2. | 30/10/2026 |
| CVE-2026-62023 | MEDIO4.3 | Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): fro | 30/10/2026 |
| CVE-2026-62019 | MEDIO4.3 | Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.6. | 30/10/2026 |
| CVE-2026-61854 | ALTO8.2 | VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing s | 30/10/2026 |
| CVE-2026-61848 | MEDIO6.3 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing `non-ASCII characters`, inefficiencies in tracking the positions of `multi-byte characters` result in superlinear parsing time. An attacker-controlled CSS input consisting of m | 30/10/2026 |
| CVE-2026-61847 | MEDIO6.3 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of a | 30/10/2026 |
| CVE-2026-61846 | MEDIO6.3 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS simple blocks and functions` without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises `SystemStackError`: s | 30/10/2026 |
| CVE-2026-61845 | ALTO8.9 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced | 30/10/2026 |
| CVE-2026-61840 | BAJO2.3 | Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to GIF` command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a `second DNS lookup`. An attacker controlling a domain can return a public address during validation and an int | 30/10/2026 |
| CVE-2026-61586 | ALTO8.2 | Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory does not block XInclude resource resolution on the stock JDK provider after an application enables XInclude on a factory returned by `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXPars | 30/10/2026 |
| CVE-2026-59978 | ALTO7.5 | AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type validation. A `version[]` parameter becomes a PHP array that `bootstrap.inc.php` serializes into the shared `adminneo.versi | 30/10/2026 |
| CVE-2026-54855 | ALTO7.1 | Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. | 30/10/2026 |