CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 03/11/2026 |
| CVE-2026-16900 | 高危7.5 | Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request. | 03/11/2026 |
| CVE-2026-13594 | 严重9.1 | Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product. | 03/11/2026 |
| CVE-2026-120988 | 中危6.1 | billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering. | 03/11/2026 |
| CVE-2026-103653 | 中危6.7 | An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt CoAP module. Processing a malformed CoAP message can cause an application using Qt CoAP to crash (loss of availability) or to continue operating on incorrect data (potential loss of integrity). | 03/11/2026 |
| CVE-2026-120987 | 高危7.5 | Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment. | 03/11/2026 |
| CVE-2025-5769 | 中危6.1 | The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser.
By exploiting this vulnerability, an a | 03/11/2026 |
| CVE-2025-1397 | 中危4.8 | When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled.
A malicious actor could leverage this vulnerability to obtain access | 03/11/2026 |
| CVE-2026-115205 | 中危6.5 | The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages. | 03/11/2026 |
| CVE-2026-106004 | 中危5.3 | The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status. | 03/11/2026 |
| CVE-2026-105993 | 中危5.3 | The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options. | 03/11/2026 |
| CVE-2026-105967 | 中危5.8 | The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses. | 03/11/2026 |
| CVE-2026-104648 | 中危4.9 | The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to impersonate other use | 03/11/2026 |
| CVE-2026-104647 | 低危3.8 | The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform ad | 03/11/2026 |
| CVE-2026-103379 | 中危5.3 | The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order and read the customer' | 03/11/2026 |
| CVE-2026-77800 | 高危7.7 | ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider. | 03/11/2026 |
| CVE-2026-77799 | 高危7.4 | ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code. | 03/11/2026 |
| CVE-2026-120971 | 中危5.3 | A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an excepti | 03/11/2026 |