CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 02/11/2026 |
| CVE-2026-120214 | 中危5.9 | @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives th | 02/11/2026 |
| CVE-2026-120213 | 严重9.1 | @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into | 02/11/2026 |
| CVE-2026-117549 | 中危4.2 | @fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, when the signature check reports the value as invalid, still passes the original coo | 02/11/2026 |
| CVE-2026-117531 | 中危5.9 | @fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though the Content-Length is complete, the clie | 02/11/2026 |
| CVE-2026-117518 | 高危8.2 | @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its percent-encoded form to a | 02/11/2026 |
| CVE-2025-12544 | 中危4.8 | The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application.
The security consequences include the ability for a ma | 02/11/2026 |
| CVE-2024-2372 | 中危5.4 | The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.
By leveraging this open redirection vulnerability, an attacker can craft a ma | 02/11/2026 |
| CVE-2026-18800 | 中危4.4 | When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property.
A malicious | 02/11/2026 |
| CVE-2026-118871 | 中危6.5 | SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in. | 02/11/2026 |
| CVE-2025-13647 | 中危5.8 | The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header.
Successful exploitation can lead to the unintended exposure of the file paths for certific | 02/11/2026 |
| CVE-2024-7075 | 中危4.6 | The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the management console.
Successful exploitation enables an attacker | 02/11/2026 |
| CVE-2026-107457 | 低危2.3 | A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash. | 02/11/2026 |
| CVE-2026-18199 | 高危8.8 | Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability. | 02/11/2026 |
| CVE-2026-103310 | 中危5.3 | The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment. | 02/11/2026 |
| CVE-2026-101184 | 中危5.5 | Permission control vulnerability in the Bluetooth module.
Impact: Successful exploitation of this vulnerability may affect availability. | 02/11/2026 |
| CVE-2026-101178 | 中危6.6 | Permission control vulnerability in the autofill service module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality. | 02/11/2026 |
| CVE-2026-120349 | 高危7.3 | A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit h | 02/11/2026 |