CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 03/11/2026 |
| CVE-2026-121732 | 低危2.7 | RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request | 03/11/2026 |
| CVE-2026-121731 | 高危8.8 | RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and stude | 03/11/2026 |
| CVE-2026-121730 | 中危6.5 | emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organiza | 03/11/2026 |
| CVE-2026-121729 | 高危8.3 | emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable i | 03/11/2026 |
| CVE-2026-121728 | 中危5.3 | SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAc | 03/11/2026 |
| CVE-2026-121727 | 高危7.5 | Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to | 03/11/2026 |
| CVE-2026-121582 | 中危6.5 | A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public an | 03/11/2026 |
| CVE-2026-121581 | 中危4.3 | A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{id}/test of the component Provider Test-Connection Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has be | 03/11/2026 |
| CVE-2026-121565 | 高危7.4 | Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys. | 03/11/2026 |
| CVE-2026-121539 | 中危6.3 | A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the atta | 03/11/2026 |
| CVE-2026-121535 | 低危3.7 | A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack rem | 03/11/2026 |
| CVE-2026-121520 | 中危4.5 | In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the h | 03/11/2026 |
| CVE-2026-120775 | 高危7.2 | Tanium addressed a heap-based buffer overflow vulnerability in Deploy. | 03/11/2026 |
| CVE-2026-118237 | 中危5.3 | An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algo | 03/11/2026 |
| CVE-2026-116669 | 中危6.5 | Tanium addressed an improper access controls vulnerability in Discover. | 03/11/2026 |
| CVE-2026-116668 | 中危4.3 | Tanium addressed an uncontrolled resource consumption vulnerability in Discover. | 03/11/2026 |
| CVE-2026-116667 | 中危4.2 | Tanium addressed an improper access controls vulnerability in Discover. | 03/11/2026 |