CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 30/10/2026 |
| CVE-2026-63346 | 높음8.6 | Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header("<name>")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass | 30/10/2026 |
| CVE-2026-63345 | 높음8.6 | Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survi | 30/10/2026 |
| CVE-2026-63344 | 높음8.6 | Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers("Accept: <ct>", "Content-Type: <ct>")]` attribute string without escaping quotation marks. A crafted content-type k | 30/10/2026 |
| CVE-2026-63341 | 높음7.5 | Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqemitter` into `qlobber`. A `PUBLISH`, `SUBSCRIBE`, or registered `Will` message containing an excessively deep topic can reach `qlobber._split_w | 30/10/2026 |
| CVE-2026-63339 | 높음8.8 | IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces exposure but is not a complete fix. This issue is fixed in version 7.3.0 | 30/10/2026 |
| CVE-2026-63338 | 높음8.3 | IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyController` selects records by identifier without checking that `user_id` | 30/10/2026 |
| CVE-2026-61725 | 보통6.1 | sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In `src/util/decompress.rs`, `decompress_impl` computes each destination with `dest.join(entry.name())` without normalizing the arch | 30/10/2026 |
| GHSA-4xm8-rg9h-jhq2 | 심각9.8 | Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution | 30/10/2026 |
| GHSA-hff9-5pqw-6w9f | 심각9.8 | imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution | 30/10/2026 |
| GHSA-494m-4556-wf5p | 높음7.5 | imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash | 30/10/2026 |
| GHSA-mmq5-xm89-9pfg | 높음7.5 | imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field | 30/10/2026 |
| GHSA-2wrx-84qj-4pcg | 보통6.5 | anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS | 30/10/2026 |
| CVE-2026-96634 | 보통 | AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE | 30/10/2026 |
| CVE-2026-96633 | 높음8.1 | AdminNeo SQLite Database-List Drop Arbitrary File Deletion | 30/10/2026 |
| CVE-2026-96631 | 높음8.2 | AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers | 30/10/2026 |
| CVE-2026-96632 | 높음 | AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass) | 30/10/2026 |
| CVE-2026-96630 | 높음7.2 | AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass) | 30/10/2026 |