CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 30/10/2026 |
| CVE-2026-119542 | MOYENNE4.3 | A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially aff | 30/10/2026 |
| CVE-2026-119528 | ÉLEVÉE7.8 | A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. | 30/10/2026 |
| CVE-2026-118987 | MOYENNE5.3 | CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header.
cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is.
A session cookie t | 30/10/2026 |
| CVE-2026-118986 | ÉLEVÉE7.5 | CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand().
The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enoug | 30/10/2026 |
| CVE-2026-117350 | MOYENNE6.5 | Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue. | 30/10/2026 |
| CVE-2026-117028 | MOYENNE6.5 | Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method. An authenticated student can manipulate the studentId parameter to retrieve another student's examination results, including examination marks, without authorization. | 30/10/2026 |
| CVE-2026-115683 | MOYENNE6.8 | A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page.
Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before loading the error page, l | 30/10/2026 |
| CVE-2026-112348 | MOYENNE6.5 | Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return | 30/10/2026 |
| CVE-2026-112347 | ÉLEVÉE7.6 | Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without perfo | 30/10/2026 |
| CVE-2026-111500 | MOYENNE5.4 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Server-side request forgery. | 30/10/2026 |
| CVE-2026-111499 | MOYENNE5.5 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. | 30/10/2026 |
| CVE-2026-111498 | MOYENNE4.7 | OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. | 30/10/2026 |
| CVE-2026-100355 | FAIBLE3.1 | Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby's `IPAddr#private? `` IPAddr#loopback?`, and `IPAddr#link_local?` predicates plus IPv4-mapped | 30/10/2026 |
| CVE-2026-91917 | ÉLEVÉE8.0 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution. | 30/10/2026 |
| CVE-2026-87768 | ÉLEVÉE7.5 | DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds.
_normalize_leap_seconds crosses day boundaries one day at a time, so add(seconds => $n) on an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits $n. The XS implementation a | 30/10/2026 |
| CVE-2026-75882 | ÉLEVÉE8.5 | An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests. | 30/10/2026 |
| CVE-2026-64860 | MOYENNE6.5 | ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the `mdns` component follows DNS name-compression pointers recursively when parsing fully qualified domain names (FQDNs) in inbound mDNS packets without capping pointer-follow depth in `mdns_utils_read_fqdn()`. An unauthenti | 30/10/2026 |