Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,255
- Last 24h
- 595
- Critical, 7 days
- 357
- Known exploited
- 1,779
2,874 results · Clear filters · Feed
-
Critical 9.8CVE-2026-47627 Public exploit
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A succe…
-
Critical 9.1CVE-2026-18963 Public exploit
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for a…
-
Critical 9.8CVE-2026-74943 Public exploit
Use-after-free in the Graphics: ImageLib component
Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
-
Critical 9.8CVE-2026-74936 Public exploit
Use-after-free in the JavaScript: WebAssembly component
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
-
Critical 9.8CVE-2026-15748 Public exploit
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-exte…
-
Critical 9.8CVE-2021-43717 Public exploit
An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjectio…
-
Critical 9.8CVE-2021-43716 Public exploit
Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector…
-
Critical 9.3CVE-2026-67921 Public exploit
Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java an…
-
Critical 9.3
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflo…
KEV Aug 19, 2026 -
Critical 9.4CVE-2026-19478 Public exploit
Improper Control of Generation of Code ('Code Injection') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete publ…
-
Critical 9.1CVE-2026-75045 Public exploit
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download datab…
-
Critical 9.8CVE-2026-67919 Public exploit
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri …
-
Critical 9.8CVE-2026-38165 Public exploit
A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.…
-
Critical 9.8CVE-2026-68004 Public exploit
An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP pu…
-
Critical 9.3CVE-2026-74251 Public exploit
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses wi…
-
Critical 9.8CVE-2026-19598 Public exploit
Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check …
-
Critical 9.8CVE-2026-15826 Public exploit
User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before pe…
-
Critical 9.8CVE-2026-72422 Public exploit
ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE conn->preauth_info is shared connection state (struct preauth_integrity_info, kmalloc-96) that is allocated and fr…
-
Critical 10.0CVE-2026-73678 Public exploit
MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()
MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ e…
-
Critical 9.9CVE-2026-19681 Public exploit
Command Injection
An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying op…
-
Critical 9.9CVE-2026-19626 Public exploit
Remote Code Execution
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-s…
-
Critical 9.3CVE-2026-73665 Public exploit
FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to…
-
Critical 9.3CVE-2026-73663 Public exploit
FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound param…
-
Critical 9.3CVE-2026-28001 Public exploit
WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
-
Critical 9.8CVE-2026-73519 Public exploit
WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret
WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack…
-
Critical 9.4CVE-2026-73296 Public exploit
Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP s…
-
Critical 9.8CVE-2026-18366 Public exploit
Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, esc…
-
Critical 9.8CVE-2026-73034 Public exploit
DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header
DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoi…
-
Critical 9.1
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user in…
KEV Sep 24, 2026 -
Critical 9.8CVE-2026-62878 Public exploit
Windows DNS Server Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.
-
Critical 10.0CVE-2026-58115 Public exploit
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running I…
-
Critical 9.8CVE-2026-72550 Public exploit
Friendica Friendica - SQL Injection
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a …
-
Critical 10.0CVE-2026-58231 Public exploit
Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise …
-
Critical 9.1CVE-2026-19516 Public exploit
CVE-2026-19516 CVE Record
A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configur…
-
Critical 9.9CVE-2026-72867 Public exploit
Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update requ…
-
Critical 10.0
Metabase SQL injection via password reset endpoint
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
KEV Aug 11, 2026 -
Critical 9.8CVE-2026-28672 Public exploit
Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8.
-
Critical 9.8CVE-2026-19089 Public exploit
Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload
The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to up…
-
Critical 9.8CVE-2026-15038 Public exploit
InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite
The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their o…
-
Critical 9.0CVE-2026-71851 Public exploit
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), in…