CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 29/10/2026 |
| CVE-2026-85899 | 高危8.1 | Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network. | 29/10/2026 |
| CVE-2026-85897 | 高危8.8 | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 29/10/2026 |
| CVE-2026-85890 | 高危8.8 | Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 29/10/2026 |
| CVE-2026-85330 | 中危4.3 | Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network. | 29/10/2026 |
| CVE-2026-84296 | 中危6.8 | Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts. | 29/10/2026 |
| CVE-2026-84295 | 严重10.0 | Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials. | 29/10/2026 |
| CVE-2026-84294 | 高危7.7 | Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories. | 29/10/2026 |
| CVE-2026-77819 | 中危6.5 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory. | 29/10/2026 |
| CVE-2026-77817 | 中危6.5 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports. | 29/10/2026 |
| CVE-2026-66912 | 中危5.3 | Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript payload. When the victim o | 29/10/2026 |
| CVE-2026-66911 | 中危5.3 | Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when the victim opens the | 29/10/2026 |
| CVE-2026-62131 | 严重9.8 | Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | 29/10/2026 |
| CVE-2026-62018 | 严重9.8 | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | 29/10/2026 |
| CVE-2026-62017 | 严重9.8 | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | 29/10/2026 |
| CVE-2026-62016 | 严重9.8 | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | 29/10/2026 |
| CVE-2026-62015 | 严重9.8 | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | 29/10/2026 |