01 Search console

The CVE corpus, on scope in milliseconds.

408,097 records · updated every 15 minutes

02 Telemetry

Total CVEs408,097

New today769

Known-exploited (KEV)1,740

Sync lag19 MIN

03 Severity mix

04 Latest published

CVE IDCVSSSeverityKEVSummaryVendor / ProductPublished

CVE-2026-1106955.3Medium—5.3Mediumturboderp ExLlamaV2 Safetensors Tensor Loader stloader.py STFile.get_tensor buffer overflowturboderp exllamav226 MIN AGO

CVE-2026-1106945.3Medium—5.3MediumOAID Tengine tmfile Model Loader tm2_serializer.c get_tm_file_model out-of-boundsoaid tengine41 MIN AGO

CVE-2026-1106894.8Medium—4.8MediumOpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanismopenclaw clawscan56 MIN AGO

CVE-2026-1041096.8Medium—6.8MediumFileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage rooterror311 filerise56 MIN AGO

CVE-2026-1041076.5Medium—6.5MediumFileRise: Authenticated path traversal escapes configured storage root through inherited ACLserror311 filerise59 MIN AGO

CVE-2026-1041105.3Medium—5.3MediumFileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.phperror311 filerise1 HR AGO

CVE-2026-1041088.1High—8.1HighFileRise OIDC login can bind an attacker identity to an existing local accounterror311 filerise1 HR AGO

CVE-2026-1039778.1High—8.1HighFileRise: Session-scoped TOTP rate limiting permits repeated verification attemptserror311 filerise1 HR AGO

CVE-2026-1041056.4Medium—6.4MediumFileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)error311 filerise1 HR AGO

CVE-2026-1041066.5Medium—6.5MediumFileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verificationerror311 filerise1 HR AGO

CVE-2026-1039885.4Medium—5.4MediumFileRise renameFolder omits destination-parent authorizationerror311 filerise1 HR AGO

CVE-2026-691936.5Medium—6.5MediumFileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Sprayingerror311 filerise1 HR AGO

CVE-2026-691915.4Medium—5.4MediumFileRise: Login Method Restriction Bypass via Direct API Accesserror311 filerise1 HR AGO

CVE-2026-774275.9Medium—5.9MediumFileRise: Insecure default cryptographic key fallback in manual installserror311 filerise1 HR AGO

CVE-2026-691944.8Medium—4.8MediumFileRise: Unsanitized footerHtml in Public Site Configerror311 filerise1 HR AGO

View all 408,097 records

05 Recently added to KEV

KEVCVE-2026-104935ivanti connect secureAdded 2026-10-13

KEVCVE-2023-22894Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that containAdded 2026-10-08

KEVCVE-2021-3199Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.Added 2026-10-08

KEVCVE-2016-3081Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related toAdded 2026-10-08

KEVCVE-2015-5477named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.Added 2026-10-08

KEVCVE-2015-3306The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.Added 2026-10-08