01 Search console
The CVE corpus, on scope in milliseconds.
404,887 records · updated every 15 minutes
02 Telemetry
Total CVEs404,887
New today539
Known-exploited (KEV)1,739
Sync lag8 MIN
03 Severity mix
04 Latest published
CVE IDCVSSSeverityKEVSummaryVendor / ProductPublished
CVE-2026-412106.5Medium—Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_idmoonlight-stream moonlight-qt16 MIN AGO
CVE-2026-1036585.9Medium—GNU Aspell through 0.60.8.2 contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signedgnu aspell17 MIN AGO
CVE-2026-1025395.7Medium—Super Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is setsuper-productivity super-productivity19 MIN AGO
CVE-2026-843127.1High—Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)0xjacky nginx-ui24 MIN AGO
CVE-2026-843608.1High—Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools0xjacky nginx-ui33 MIN AGO
CVE-2026-843168.8High—Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)0xjacky nginx-ui36 MIN AGO
CVE-2026-843198.3High—Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context0xjacky nginx-ui38 MIN AGO
CVE-2026-185137.2High—IBM Maximo Application Suite - Location Service for Esri Component Improper Privilege Managementibm maximo application suite - location service for esri component40 MIN AGO
CVE-2026-185177.7High—IBM Maximo Application Suite - Location Service for Esri Component Improper Access Controlibm maximo application suite - location service for esri component40 MIN AGO
CVE-2026-185298.7High—IBM Maximo Application Suite - Location Service for Esri Component Code Executionibm maximo application suite - location service for esri component40 MIN AGO
CVE-2026-185336.5Medium—IBM Maximo Application Suite - Location Service for Esri Component Code Executionibm maximo application suite - location service for esri component40 MIN AGO
CVE-2026-185378.7High—IBM Maximo Application Suite - Location Service for Esri Component Code Executionibm maximo application suite - location service for esri component40 MIN AGO
CVE-2026-758817.5High—IBM Maximo Application Suite - IoT Component Denial of Serviceibm maximo application suite - iot component40 MIN AGO
CVE-2026-1050527.5High—IBM Maximo Application Suite Information Disclosureibm maximo application suite40 MIN AGO
05 Recently added to KEV
KEVCVE-2023-22894Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that containAdded 2026-10-08
KEVCVE-2021-3199Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.Added 2026-10-08
KEVCVE-2016-3081Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related toAdded 2026-10-08
KEVCVE-2015-5477named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.Added 2026-10-08
KEVCVE-2015-3306The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.Added 2026-10-08