CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| ÉLEVÉE7.5 |
imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field |
| 30/10/2026 |
| GHSA-2wrx-84qj-4pcg | MOYENNE6.5 | anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS | 30/10/2026 |
| CVE-2026-96634 | MOYENNE | AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE | 30/10/2026 |
| CVE-2026-96633 | ÉLEVÉE8.1 | AdminNeo SQLite Database-List Drop Arbitrary File Deletion | 30/10/2026 |
| CVE-2026-96631 | ÉLEVÉE8.2 | AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers | 30/10/2026 |
| CVE-2026-96632 | ÉLEVÉE | AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass) | 30/10/2026 |
| CVE-2026-96630 | ÉLEVÉE7.2 | AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass) | 30/10/2026 |
| CVE-2026-96629 | MOYENNE6.8 | AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery | 30/10/2026 |
| CVE-2026-54442 | MOYENNE4.8 | NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571 | 30/10/2026 |
| CVE-2026-59978 | ÉLEVÉE7.5 | AdminNeo: version-cache array injection causes persistent denial of service | 30/10/2026 |
| CVE-2026-119284 | MOYENNE | joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection | 30/10/2026 |
| CVE-2026-119283 | ÉLEVÉE7.5 | joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption | 30/10/2026 |
| GHSA-f3fj-9625-rv3m | MOYENNE5.9 | charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users | 30/10/2026 |
| GHSA-fgxm-5hvv-x4vh | MOYENNE5.3 | charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories | 30/10/2026 |
| CVE-2026-119282 | ÉLEVÉE | @nx/maven and @nx/gradle have OS command injection via nx.json plugin options | 30/10/2026 |
| GHSA-vpp8-g58w-m8mp | ÉLEVÉE7.5 | Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset | 29/10/2026 |