CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 30/10/2026 |
| CVE-2026-119699 | MOYENNE5.3 | WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to | 30/10/2026 |
| CVE-2026-119479 | MOYENNE5.3 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1. | 30/10/2026 |
| CVE-2026-119369 | MOYENNE6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2. | 30/10/2026 |
| CVE-2026-119291 | MOYENNE5.5 | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository, template, or archive with a | 30/10/2026 |
| CVE-2026-119290 | ÉLEVÉE7.5 | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that | 30/10/2026 |
| CVE-2026-119289 | ÉLEVÉE7.1 | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations where the external work | 30/10/2026 |
| CVE-2026-119288 | ÉLEVÉE7.0 | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin | 30/10/2026 |
| CVE-2026-119287 | ÉLEVÉE8.0 | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-run reads a registry w | 30/10/2026 |
| CVE-2026-118238 | ÉLEVÉE7.2 | The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed | 30/10/2026 |
| CVE-2026-117184 | ÉLEVÉE7.5 | An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a crafted POST request to the GraphQL endpoint | 30/10/2026 |
| CVE-2026-117183 | ÉLEVÉE7.5 | A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL. | 30/10/2026 |
| CVE-2026-117182 | MOYENNE5.4 | An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted URL. | 30/10/2026 |
| CVE-2026-116407 | MOYENNE5.4 | Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4. | 30/10/2026 |
| CVE-2026-105456 | MOYENNE5.3 | RTIR extends RT's HTML scrubber to allow an internal link
placeholder, and the extension lets through any link that merely
contains the placeholder, including links using the executable
javascript: scheme. The change applies to the whole RT instance
once RTIR is installed, not only to RTIR's own | 30/10/2026 |
| CVE-2026-105455 | MOYENNE5.3 | RTIR's ticket creation forms show the subject of the related
ticket when splitting a ticket or creating an incident from a
report, and they render that subject without HTML escaping. A
ticket subject containing script runs it when a user opens either
form. RTIR grants everyone the right to creat | 30/10/2026 |
| CVE-2026-105454 | MOYENNE5.3 | RT's automatic link creation for URLs in HTML ticket content does
not HTML-escape the URL it places in the link. A URL crafted to
break out of the link's address can add a script that runs when the
ticket history is displayed, with no further action by the viewer.
Anyone who can add HTML content | 30/10/2026 |
| CVE-2026-104615 | ÉLEVÉE7.9 | A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration | 30/10/2026 |