CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2026-105924 | 보통4.3 | A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module. | 30/10/2026 |
| CVE-2026-101214 | 높음7.2 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. | 30/10/2026 |
| CVE-2026-101213 | 높음7.8 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. | 30/10/2026 |
| CVE-2026-101210 | 높음7.2 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. | 30/10/2026 |
| CVE-2026-101209 | 낮음2.7 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure. | 30/10/2026 |
| CVE-2025-68395 | 보통5.1 | ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module.
This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67 | 30/10/2026 |
| CVE-2025-68394 | 높음8.4 | ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "profilInput" parameter allows for SQL Injection attacks.
This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67 | 30/10/2026 |
| CVE-2025-68393 | 높음8.4 | ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "Utilisateur" parameter allows for SQL Injection attacks.
This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67 | 30/10/2026 |
| CVE-2025-68392 | 보통5.1 | ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint.
This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67 | 30/10/2026 |
| CVE-2025-68391 | 보통5.3 | ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to download the uploaded file. | 30/10/2026 |
| CVE-2026-85268 | 높음8.7 | A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID. | 30/10/2026 |
| CVE-2026-22114 | 보통5.3 | HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible. | 30/10/2026 |
| CVE-2026-22110 | 높음8.7 | The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting. | 30/10/2026 |
| CVE-2026-22109 | 높음8.4 | The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit. | 30/10/2026 |
| CVE-2026-22105 | 높음8.7 | Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as th | 30/10/2026 |
| CVE-2026-116366 | 심각9.5 | An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server. | 30/10/2026 |
| CVE-2025-31704 | 심각9.8 | A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution. | 30/10/2026 |