Vulnerability intelligence / live index
A working index of published vulnerability records, ordered by latest update. Open a record to inspect its score, vector, and impact metrics.
CVE Program / CVE List®
Updated continuously
Oct 29, 2026 UTC
Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwri…
Inspect record →Oct 29, 2026 UTC
Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
Inspect record →Oct 29, 2026 UTC
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and r…
Inspect record →Oct 29, 2026 UTC
Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation…
Inspect record →Oct 29, 2026 UTC
Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.
Inspect record →Oct 29, 2026 UTC
A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file /source/registerform3.php of the component Registration. The manipulation of the argument pemail leads to sql injectio…
Inspect record →Oct 29, 2026 UTC
Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.
Inspect record →Oct 29, 2026 UTC
A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widget.html of the component Query Parameter Handler. Such manipulation of the argument welcome leads to cross site scripting. The attack can be launched remot…
Inspect record →Oct 29, 2026 UTC
A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation leads to unrestricted upload. It is possible …
Inspect record →Oct 29, 2026 UTC
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.
Inspect record →Oct 29, 2026 UTC
Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.
Inspect record →Oct 29, 2026 UTC
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven…
Inspect record →Oct 29, 2026 UTC
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to tr…
Inspect record →Oct 29, 2026 UTC
Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.
Inspect record →Oct 29, 2026 UTC
Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.
Inspect record →
