Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 405,973
- Last 24h
- 246
- Critical, 7 days
- 307
- Known exploited
- 1,769
2,865 results · Clear filters · Feed
-
Critical 9.3CVE-2026-123488 Public exploit
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the el…
-
Critical 9.1CVE-2026-114630 Public exploit
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for…
-
Critical 10.0CVE-2026-118423 Public exploit
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
-
Critical 9.8CVE-2026-113615 Public exploit
GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi
The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and o…
-
Critical 9.8CVE-2026-116779 Public exploit
FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of …
-
Critical 9.8CVE-2026-83542 Public exploit
Apache OFBiz: Unauthenticated RCE via login-page widget injection
Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overridin…
-
Critical 9.1CVE-2026-117691 Public exploit
Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An a…
-
Critical 9.8CVE-2026-100109 Public exploit
Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated att…
-
Critical 9.4CVE-2026-123025 Public exploit
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-…
-
Critical 10.0CVE-2026-122051 Public exploit
Edimax BR-6208AC mp command injection
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and …
-
Critical 9.8CVE-2026-122006 Public exploit
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server…
-
Critical 9.8CVE-2026-44267 Public exploit
Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access ha…
-
Critical 9.8CVE-2026-86596 Public exploit
s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?'…
-
Critical 9.8CVE-2026-58868 Public exploit
In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This co…
-
Critical 9.3CVE-2026-116606 Public exploit
Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modifi…
-
Critical 9.8CVE-2026-120209 Public exploit
AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoad…
-
Critical 9.8CVE-2026-116512 Public exploit
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsaniti…
-
Critical 9.3CVE-2026-39732 Public exploit
WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability
Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.
-
Critical 10.0CVE-2026-112816 Public exploit
Improper certificate validation in the HTTPS listener in LXD
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed v…
-
Critical 9.5CVE-2026-116366 Public exploit
Unauthenticated RCE vulnerability against ClickHouse Server
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
-
Critical 9.8CVE-2026-103039 Public exploit
Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unr…
-
Critical 10.0CVE-2026-84295 Public exploit
Improper Authentication in Progress WS_FTP Server
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
-
Critical 9.8CVE-2026-93680 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.
-
Critical 9.9CVE-2026-107327 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.
-
Critical 9.9CVE-2026-107328 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.
-
Critical 9.9CVE-2026-107329 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
-
Critical 9.8CVE-2026-110186 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
-
Critical 9.6CVE-2026-115904 Public exploit
Topluyo Desktop for Linux has an OS Command Injection issue
Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. A…
-
Critical 9.8CVE-2026-103688 Public exploit
Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbit…
-
Critical 9.6CVE-2026-118306 Public exploit
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary cod…
-
Critical 9.8CVE-2026-116692 Public exploit
MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PART…
-
Critical 9.8CVE-2026-114595 Public exploit
Integer overflow or wraparound in EPICS Base
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential r…
-
Critical 9.8CVE-2026-117532 Public exploit
REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state an…
-
Critical 9.9CVE-2026-110720 Public exploit
Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and…
-
Critical 10.0CVE-2026-115905 Public exploit
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling th…
-
Critical 9.3CVE-2026-93328 Public exploit
Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storag…
-
Critical 9.1CVE-2026-116214 Public exploit
MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via use…
-
Critical 9.8CVE-2026-31158 Public exploit
SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbi…
-
Critical 9.8CVE-2026-107092 Public exploit
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
-
Critical 9.1CVE-2026-114820 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…