CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 29/10/2026 |
| CVE-2026-54859 | 緊急9.8 | Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. | 29/10/2026 |
| CVE-2026-54858 | 緊急9.8 | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | 29/10/2026 |
| CVE-2026-54857 | 緊急9.8 | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | 29/10/2026 |
| CVE-2026-54856 | 緊急9.8 | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | 29/10/2026 |
| CVE-2026-48200 | 中5.3 | Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0. | 29/10/2026 |
| CVE-2026-42701 | 高7.2 | Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. | 29/10/2026 |
| CVE-2026-42694 | 中4.3 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0. | 29/10/2026 |
| CVE-2026-42692 | 高7.1 | Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. | 29/10/2026 |
| CVE-2026-42690 | 中5.4 | Subscriber Broken Access Control in LearnPress <= 4.4.10 versions. | 29/10/2026 |
| CVE-2026-27394 | 高7.1 | Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions. | 29/10/2026 |
| CVE-2026-20942 | 中4.3 | Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 29/10/2026 |
| CVE-2026-18894 | 緊急9.8 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-tr | 29/10/2026 |
| CVE-2026-119145 | 緊急9.9 | Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution | 29/10/2026 |
| CVE-2026-119144 | 高8.8 | Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates | 29/10/2026 |
| CVE-2026-119143 | 中4.8 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length component model stream reads or writes with unvalidated addresses, causing Direct | 29/10/2026 |