Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (10775 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-115569 1 Fallow-rs 4 Fallow, Fallow-cli, Fallow-core and 1 more 2026-10-30 3.3 Low
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior also affects Vitest test.projects paths, Vitest inline-project extends paths, and symlinked script --config paths. Fallow parses the outside files as test-runner configuration and uses them to credit dependencies, setup files, and JSX import sources, which can change unused dependency and unused file findings in CI or agent analysis. The outside file contents are not printed or sent over the network. This issue is fixed in version 3.34.0.
CVE-2026-90888 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
CVE-2026-119168 1 Hashicorp 2 Nomad, Nomad Enterprise 2026-10-30 8.8 High
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
CVE-2026-119526 2026-10-30 9.8 Critical
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.
CVE-2026-118089 2026-10-30 7.2 High
Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.
CVE-2026-118090 2026-10-30 8.8 High
Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.
CVE-2026-62131 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.
CVE-2026-62016 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
CVE-2026-62015 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.
CVE-2026-62014 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
CVE-2026-62011 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.
CVE-2026-62010 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.
CVE-2026-62009 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
CVE-2026-62005 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
CVE-2026-62004 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.
CVE-2026-62003 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Mission <= 1.22 versions.
CVE-2026-61998 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
CVE-2026-61997 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
CVE-2026-61992 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
CVE-2026-54860 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.