CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 29/10/2026 |
| CVE-2026-107052 | 高危7.5 | Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path. | 29/10/2026 |
| CVE-2026-107051 | 高危7.5 | Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations. | 29/10/2026 |
| CVE-2026-107050 | 严重9.8 | An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution. | 29/10/2026 |
| CVE-2026-107049 | 高危7.5 | An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string. | 29/10/2026 |
| CVE-2026-107048 | 严重9.8 | An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request. | 29/10/2026 |
| CVE-2026-107047 | 高危7.5 | Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data. | 29/10/2026 |
| CVE-2026-107046 | 中危5.3 | A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL. | 29/10/2026 |
| CVE-2026-107045 | 严重9.1 | Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database. | 29/10/2026 |
| CVE-2026-107044 | 高危7.5 | Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism. | 29/10/2026 |
| CVE-2026-107043 | 严重9.1 | Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism. | 29/10/2026 |
| CVE-2025-12523 | 中危6.5 | Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user | 29/10/2026 |
| CVE-2023-7357 | 高危8.6 | A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addressed in the FlexNet Publisher 2023 R2 (11.19.4.0) release. | 29/10/2026 |
| GHSA-vpp8-g58w-m8mp | 高危7.5 | Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset | 29/10/2026 |
| GHSA-w9x9-j56r-h98r | 高危8.2 | @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy | 29/10/2026 |
| GHSA-c33x-vcv4-vg3g | 低危 | Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence | 29/10/2026 |
| CVE-2026-96203 | 高危8.8 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. | 29/10/2026 |