CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 03/11/2026 |
| CVE-2026-105980 | 高7.2 | Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges. | 03/11/2026 |
| CVE-2026-105979 | 高7.2 | Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges. | 03/11/2026 |
| CVE-2026-105978 | 高7.2 | Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges. | 03/11/2026 |
| CVE-2026-103327 | 中5.3 | The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed | 03/11/2026 |
| CVE-2026-74846 | 高7.5 | Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.
CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and b | 03/11/2026 |
| CVE-2026-4052 | 緊急9.8 | This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint. | 03/11/2026 |
| CVE-2026-16900 | 高7.5 | Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request. | 03/11/2026 |
| CVE-2026-13594 | 緊急9.1 | Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product. | 03/11/2026 |
| CVE-2026-120988 | 中6.1 | billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering. | 03/11/2026 |
| CVE-2026-103653 | 中6.7 | An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt CoAP module. Processing a malformed CoAP message can cause an application using Qt CoAP to crash (loss of availability) or to continue operating on incorrect data (potential loss of integrity). | 03/11/2026 |
| CVE-2026-120987 | 高7.5 | Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment. | 03/11/2026 |
| CVE-2025-5769 | 中6.1 | The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser.
By exploiting this vulnerability, an a | 03/11/2026 |
| CVE-2025-1397 | 中4.8 | When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled.
A malicious actor could leverage this vulnerability to obtain access | 03/11/2026 |
| CVE-2026-115205 | 中6.5 | The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages. | 03/11/2026 |
| CVE-2026-106004 | 中5.3 | The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status. | 03/11/2026 |
| CVE-2026-105993 | 中5.3 | The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options. | 03/11/2026 |