CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 高危7.5 |
imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field |
| 30/10/2026 |
| GHSA-2wrx-84qj-4pcg | 中危6.5 | anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS | 30/10/2026 |
| CVE-2026-96634 | 中危 | AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE | 30/10/2026 |
| CVE-2026-96633 | 高危8.1 | AdminNeo SQLite Database-List Drop Arbitrary File Deletion | 30/10/2026 |
| CVE-2026-96631 | 高危8.2 | AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers | 30/10/2026 |
| CVE-2026-96632 | 高危 | AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass) | 30/10/2026 |
| CVE-2026-96630 | 高危7.2 | AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass) | 30/10/2026 |
| CVE-2026-96629 | 中危6.8 | AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery | 30/10/2026 |
| CVE-2026-54442 | 中危4.8 | NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571 | 30/10/2026 |
| CVE-2026-59978 | 高危7.5 | AdminNeo: version-cache array injection causes persistent denial of service | 30/10/2026 |
| CVE-2026-119284 | 中危 | joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection | 30/10/2026 |
| CVE-2026-119283 | 高危7.5 | joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption | 30/10/2026 |
| GHSA-f3fj-9625-rv3m | 中危5.9 | charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users | 30/10/2026 |
| GHSA-fgxm-5hvv-x4vh | 中危5.3 | charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories | 30/10/2026 |
| CVE-2026-119282 | 高危 | @nx/maven and @nx/gradle have OS command injection via nx.json plugin options | 30/10/2026 |
| GHSA-vpp8-g58w-m8mp | 高危7.5 | Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset | 29/10/2026 |