CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 30/10/2026 |
| CVE-2026-63339 | ÉLEVÉE8.8 | IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces exposure but is not a complete fix. This issue is fixed in version 7.3.0 | 30/10/2026 |
| CVE-2026-63338 | ÉLEVÉE8.3 | IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyController` selects records by identifier without checking that `user_id` | 30/10/2026 |
| CVE-2026-61725 | MOYENNE6.1 | sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In `src/util/decompress.rs`, `decompress_impl` computes each destination with `dest.join(entry.name())` without normalizing the arch | 30/10/2026 |
| GHSA-4xm8-rg9h-jhq2 | CRITIQUE9.8 | Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution | 30/10/2026 |
| GHSA-hff9-5pqw-6w9f | CRITIQUE9.8 | imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution | 30/10/2026 |
| GHSA-494m-4556-wf5p | ÉLEVÉE7.5 | imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash | 30/10/2026 |
| GHSA-mmq5-xm89-9pfg | ÉLEVÉE7.5 | imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field | 30/10/2026 |
| GHSA-2wrx-84qj-4pcg | MOYENNE6.5 | anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS | 30/10/2026 |
| CVE-2026-96634 | MOYENNE | AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE | 30/10/2026 |
| CVE-2026-96633 | ÉLEVÉE8.1 | AdminNeo SQLite Database-List Drop Arbitrary File Deletion | 30/10/2026 |
| CVE-2026-96631 | ÉLEVÉE8.2 | AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers | 30/10/2026 |
| CVE-2026-96632 | ÉLEVÉE | AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass) | 30/10/2026 |
| CVE-2026-96630 | ÉLEVÉE7.2 | AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass) | 30/10/2026 |
| CVE-2026-96629 | MOYENNE6.8 | AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery | 30/10/2026 |
| CVE-2026-63224 | ÉLEVÉE7.2 | OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV crosstab` SQL by concatenating an `asset name` and `attribute name` into a `COPY` query that uses `crosstab` and streams `TO STDOUT`. The `asset name` enters both a double-quoted column identifier and a | 30/10/2026 |
| CVE-2026-63201 | ÉLEVÉE7.1 | Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netcon | 30/10/2026 |
| CVE-2026-63184 | ÉLEVÉE7.1 | Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote `http(s) | 30/10/2026 |