01 Search console
The CVE corpus, on scope in milliseconds.
412,983 records · updated every 15 minutes
02 Telemetry
Total CVEs412,983
New today121
Known-exploited (KEV)1,754
Sync lag49 MIN
03 Severity mix
04 Latest published
CVE IDCVSSSeverityKEVSummaryVendor / ProductPublished
CVE-2026-1142236.7Medium—NewType Infortech｜NT OneAPP - Exposure of Sensitive Informationnewtype infortech nt oneapp55 MIN AGO
CVE-2026-1142226.9Medium—NewType Infortech｜NT OneAPP - Authentication Bypassnewtype infortech nt oneapp55 MIN AGO
CVE-2026-1142215.9Medium—NewType Infortech｜NT OneAPP - Credential Disclosurenewtype infortech nt oneapp55 MIN AGO
CVE-2026-1142209.3Critical—NewType Infortech｜NT OneAPP - Improper Certificate Validationnewtype infortech nt oneapp56 MIN AGO
CVE-2026-1142199.1Critical—NewType Infortech｜NT OneAPP - Hard-coded Credentialsnewtype infortech nt oneapp56 MIN AGO
CVE-2026-1103537.5High—HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c doeshaproxy haproxy haproxy haproxy enterprise edition haproxy kubernetes ingress controller haproxy kubernetes ingress controller enterprise2 HR AGO
CVE-2026-1103547.5High—HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexerhaproxy haproxy haproxy haproxy enterprise edition haproxy technologies haproxy kubernetes ingress controller haproxy technologies kubernetes ingress controller enterprise2 HR AGO
CVE-2026-1147326.8Medium—Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address,roundcube webmail3 HR AGO
CVE-2026-1147315.3Medium—Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was readroundcube webmail3 HR AGO
CVE-2026-1147307.2High—Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052roundcube webmail3 HR AGO
CVE-2026-1147295.3Medium—Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, butroundcube webmail3 HR AGO
CVE-2026-1147285.3Medium—Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a patternroundcube webmail3 HR AGO
CVE-2026-1145776.9Medium—oretnom23 php-travel-agency-system Insertion insert.php sql injectionoretnom23 php-travel-agency-system3 HR AGO
CVE-2026-1147278.3High—Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo uploadroundcube webmail3 HR AGO
CVE-2026-1147265.8Medium—Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip controlroundcube webmail3 HR AGO
05 Recently added to KEV
KEVCVE-2026-106931eg secure solutions inc. siteguard server edition for apache httpd eg secure solutions inc. siteguard server edition for apache httpd on freebsd eg secure solutions inc. siteguard server edition for iis eg secure solutions inc. siteguard server edition for nginx eg secure solutions inc. siteguard server edition for nginx on freebsdAdded 2026-10-20