CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 29/10/2026 |
| CVE-2026-54860 | 严重9.8 | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | 29/10/2026 |
| CVE-2026-54859 | 严重9.8 | Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. | 29/10/2026 |
| CVE-2026-54858 | 严重9.8 | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | 29/10/2026 |
| CVE-2026-54857 | 严重9.8 | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | 29/10/2026 |
| CVE-2026-54856 | 严重9.8 | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | 29/10/2026 |
| CVE-2026-48200 | 中危5.3 | Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0. | 29/10/2026 |
| CVE-2026-42701 | 高危7.2 | Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. | 29/10/2026 |
| CVE-2026-42694 | 中危4.3 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0. | 29/10/2026 |
| CVE-2026-42692 | 高危7.1 | Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. | 29/10/2026 |
| CVE-2026-42690 | 中危5.4 | Subscriber Broken Access Control in LearnPress <= 4.4.10 versions. | 29/10/2026 |
| CVE-2026-27394 | 高危7.1 | Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions. | 29/10/2026 |
| CVE-2026-20942 | 中危4.3 | Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 29/10/2026 |
| CVE-2026-18894 | 严重9.8 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-tr | 29/10/2026 |
| CVE-2026-119145 | 严重9.9 | Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution | 29/10/2026 |
| CVE-2026-119144 | 高危8.8 | Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates | 29/10/2026 |