01 Search console
The CVE corpus, on scope in milliseconds.
412,978 records · updated every 15 minutes
02 Telemetry
Total CVEs412,978
New today116
Known-exploited (KEV)1,754
Sync lag19 MIN
03 Severity mix
04 Latest published
CVE IDCVSSSeverityKEVSummaryVendor / ProductPublished
CVE-2026-1103537.5High—HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c doeshaproxy haproxy haproxy haproxy enterprise edition haproxy kubernetes ingress controller haproxy kubernetes ingress controller enterprise24 MIN AGO
CVE-2026-1103547.5High—HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexerhaproxy haproxy haproxy haproxy enterprise edition haproxy technologies haproxy kubernetes ingress controller haproxy technologies kubernetes ingress controller enterprise31 MIN AGO
CVE-2026-1147326.8Medium—Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address,roundcube webmail1 HR AGO
CVE-2026-1147315.3Medium—Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was readroundcube webmail1 HR AGO
CVE-2026-1147307.2High—Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052roundcube webmail1 HR AGO
CVE-2026-1147295.3Medium—Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, butroundcube webmail1 HR AGO
CVE-2026-1147285.3Medium—Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a patternroundcube webmail1 HR AGO
CVE-2026-1145776.9Medium—oretnom23 php-travel-agency-system Insertion insert.php sql injectionoretnom23 php-travel-agency-system1 HR AGO
CVE-2026-1147278.3High—Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo uploadroundcube webmail1 HR AGO
CVE-2026-1147265.8Medium—Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip controlroundcube webmail1 HR AGO
CVE-2026-1147255.0Medium—Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization headers,roundcube webmail1 HR AGO
CVE-2026-1147247.4High—Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and theroundcube webmail1 HR AGO
CVE-2026-1147233.7Low—Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory checkroundcube webmail1 HR AGO
CVE-2026-1146647.1High—Frappe before 16.33.0 Blind SQL Injection via get_eventsfrappe frappe1 HR AGO
CVE-2026-1146638.6High—Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Argumentsvyperlang vyper1 HR AGO
05 Recently added to KEV
KEVCVE-2026-106931eg secure solutions inc. siteguard server edition for apache httpd eg secure solutions inc. siteguard server edition for apache httpd on freebsd eg secure solutions inc. siteguard server edition for iis eg secure solutions inc. siteguard server edition for nginx eg secure solutions inc. siteguard server edition for nginx on freebsdAdded 2026-10-20