Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,588
- Last 24h
- 528
- Critical, 7 days
- 345
- Known exploited
- 1,779
639 results · Clear filters · Feed
-
Critical 10.0
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS d…
KEV Jun 23, 2026 -
Critical 10.0
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to …
KEV Jun 23, 2026 -
Critical 10.0
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild …
KEV May 26, 2026 -
Critical 9.8
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, fr…
KEV May 22, 2026 -
Critical 9.8CVE-2026-8398 Exploited
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421…
KEV May 27, 2026 -
Critical 10.0
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The secti…
KEV May 14, 2026 -
Critical 9.0
Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions
Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the exec…
-
Critical 9.6
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/r…
KEV May 27, 2026 -
Critical 9.3
LiteLLM: SQL injection in Proxy API key verification
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing i…
KEV May 8, 2026 -
Critical 9.8
WebPros cPanel and WHM Authentication Bypass via Login Flow
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
KEV Apr 30, 2026 -
Critical 10.0
Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authen…
-
Critical 9.1CVE-2026-40478 Exploited
Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expre…
-
Critical 9.1
Improper restriction of the scope of accessible objects in Thymeleaf expressions
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expressio…
-
Critical 9.8
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
KEV Aug 18, 2026 -
Critical 9.1
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
KEV Jul 16, 2026 -
Critical 9.3
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary…
KEV Apr 23, 2026 -
Critical 9.1
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated att…
KEV Apr 6, 2026 -
Critical 9.4
Trivy ecosystem supply chain briefly compromised
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in…
KEV Mar 26, 2026 -
Critical 9.3
Insufficient input validation leading to memory overread
Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread
KEV Mar 30, 2026 -
Critical 9.3
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data paramete…
KEV Mar 25, 2026 -
Critical 9.8
Lantronix EDS5000, G520, and X300 OS Command Injection
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to injec…
KEV Jun 23, 2026 -
Critical 10.0
Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to ins…
KEV Mar 19, 2026 -
Critical 10.0
Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying oper…
KEV Sep 9, 2026 -
Critical 10.0
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remo…
KEV Feb 25, 2026 -
Critical 10.0
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. Th…
KEV Feb 18, 2026 -
Critical 9.9
Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to ex…
KEV Feb 13, 2026 -
Critical 9.1
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet Forti…
KEV Apr 13, 2026 -
Critical 9.8
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
KEV Apr 8, 2026 -
Critical 9.8
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
KEV Jan 29, 2026 -
Critical 9.8
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
KEV Feb 3, 2026 -
Critical 9.4
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnal…
KEV Jan 27, 2026 -
Critical 9.3
SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. …
KEV Feb 5, 2026 -
Critical 9.8
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to e…
KEV Jul 21, 2026 -
Critical 9.3
SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resett…
KEV Jan 26, 2026 -
Critical 9.8
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment…
KEV Jan 26, 2026 -
Critical 10.0
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (comp…
KEV Aug 24, 2026 -
Critical 9.8
Microsoft SharePoint Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
KEV Mar 18, 2026 -
Critical 10.0
Upload Arbitrary Files
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
KEV Jan 26, 2026 -
Critical 10.0
n8n Vulnerable to Remote Code Execution via Expression Injection
n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions…
KEV Mar 11, 2026 -
Critical 9.3
WatchGuard Firebox iked Out of Bounds Write Vulnerability
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when co…
KEV Dec 19, 2025