Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,504
- Last 24h
- 766
- Critical, 7 days
- 366
- Known exploited
- 1,779
26,235 results · Clear filters · Feed
-
Critical 9.3
WatchGuard Agent improper authentication allows unauthenticated remote code execution
Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.
-
Critical 9.4
WatchGuard Agent path traversal allows unauthenticated remote code execution
A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system.
-
Critical 9.8CVE-2026-79657 Public exploit
NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization
NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace funct…
-
Critical 9.8
Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths
SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics upda…
-
Critical 9.1
Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url
Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url …
-
Critical 9.5
Server-Side Template Injection in extension "powermail" (powermail)
The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template…
-
Critical 9.3
Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code E…
-
Critical 9.8
Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface
The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system…
-
Critical 9.1
FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel'…
-
Critical 9.8
Stack buffer overflow in OCPP GetConfiguration key parsing
The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfiguration request from the central system, the handler copied the attacker-controlled JSON "key" string into the caller's fix…
-
Critical 9.6
NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization
NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deseriali…
-
Critical 9.8
GitPython before 3.1.59 Remote Code Execution via Config Injection
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live …
-
Critical 9.8
Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-f…
-
Critical 9.8CVE-2026-56705 Public exploit
Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection
Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root,…
-
Critical 9.8
An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remo…
-
Critical 9.8
WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.
-
Critical 9.8
WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
-
Critical 9.8
WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.
-
Critical 9.8
WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
-
Critical 9.9
WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0 versions.
-
Critical 9.3
WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability
Unauthenticated SQL Injection in Boost <= 2.0.4 versions.
-
Critical 9.3
WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability
Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.
-
Critical 9.1
CakePHP: Potential Authentication bypass with CookieAuthenticator
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion…
-
Critical 9.2CVE-2026-77635 Public exploit
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the json…
-
Critical 9.4
RansomLook API Key Disclosure Through /admin/apikeys HTML Source
RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable…
-
Critical 9.4
Combodo iTop: Remote code execution using external auth variable value
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actio…
-
Critical 9.1
OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set
OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go p…
-
Critical 9.1
DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify co…
-
Critical 9.8
DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi
Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this …
-
Critical 9.8
DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm
Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability is caused by insufficient validation of UDP message content after START_SPEED_TEST before command execution. A remote attacker can trigger t…
-
Critical 10.0
Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread ne…
-
Critical 9.8CVE-2026-78329 Public exploit
Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base…
-
Critical 9.8CVE-2026-71300 Public exploit
Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection
Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which conn…
-
Critical 9.1CVE-2026-66906 Public exploit
Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure S…
-
Critical 9.8
rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php
rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables t…
-
Critical 9.8CVE-2026-76071 Public exploit
Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter
Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod action in netis.cgi. …
-
Critical 9.8CVE-2026-76070 Public exploit
Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter
Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bin/netis.cgi.…
-
Critical 9.1CVE-2026-19874 Public exploit
Konami's Metal Gear Online 3 contains a heap-based buffer overflow
A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data ke…
-
Critical 9.4
RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification
RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check befo…
-
Critical 9.1
phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache
phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without includ…