Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,514
- Last 24h
- 772
- Critical, 7 days
- 366
- Known exploited
- 1,779
26,235 results · Clear filters · Feed
-
Critical 9.1
Remote Code Execution
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context.
-
Critical 9.1
Authentication bypass between ZCC and client connector portal
An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal.
-
Critical 9.6
RustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Length
RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStream_Read in libs/clip…
-
Critical 9.2
RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data
RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through seve…
-
Critical 10.0
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2 - The manipul…
-
Critical 9.2
RansomLook Unauthenticated Database Export Exposes Private Data
RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/<database> endpoint permits selected internal databases to be exp…
-
Critical 9.3
IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request…
-
Critical 9.8
WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.
-
Critical 9.8
WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.
-
Critical 9.8
WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
-
Critical 9.8
WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.
-
Critical 9.3
WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0.
-
Critical 9.8
WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Digits <= 9.2 versions.
-
Critical 9.9
Instance template path traversal allows arbitrary host file write as root
A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths spec…
-
Critical 9.3
Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5
Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the loadStyles method of the frontend page model.
-
Critical 9.3
DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory
DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite …
-
Critical 9.8
4MOSAn Security Technology｜4MOSAn GCB Doctor - OS Command Injection
4MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious commands through an unremoved ADOdb test page parameter, thereby executing arbitrary system commands on t…
-
Critical 9.9
UTT HiPER 1250GW HTTP Request aspRemoteApConfTempSend strcpy stack-based overflow
A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profile results in stack-…
-
Critical 9.8
EFM ipTIME T24000M Session Validation httpcon_check_session_url improper authentication
A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed rem…
-
Critical 10.0
EFM ipTIME T16000M Session Validation httpcon_check_session_url improper authentication
A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is po…
-
Critical 9.4
exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization
exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell n…
-
Critical 9.8
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the proce…
-
Critical 9.8
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float. quote_float() allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -I…
-
Critical 9.8
justhtml before 1.16.0 Multiple Security Issues via Sanitization
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather th…
-
Critical 9.8
justhtml before 1.12.0 Sanitizer Bypass via Markdown
justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters are escaped, char…
-
Critical 9.8
justhtml before 1.15.0 Multiple Security Issues
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on co…
-
Critical 9.9
Untrusted Search Path in StackGres
privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges
-
Critical 9.8
RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator
The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site take…
-
Critical 9.9
Comfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflow
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component Web Management. The manipulation of the argument timestr/ntp_client_enabled…
-
Critical 9.8
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix th…
-
Critical 9.8CVE-2026-74727 Public exploit
ovpn: skip rehash for peers already removed from by_id
In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from by_id ovpn_nl_peer_set_doit() resolves the target peer via ovpn_peer_get_by_id() before taking ovpn->lock. In the window between the lookup (w…
-
Critical 9.8
btrfs: lzo: reject inline extents without valid headers
In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers [BUG] For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: sl…
-
Critical 9.3
vdpa/mlx5: Fix buffer length in create_direct_keys()
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create_direct_keys() We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core] Read of size 272 at…
-
Critical 10.0
udp: fix potential use-after-free in tunnel segmentation
In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation __skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head…
-
Critical 9.8
sctp: clear control chunk transport if it is being removed
In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok i…
-
Critical 9.8
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, …
-
Critical 9.1
net: fix skb length accounting after generic XDP frag adjustment
In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, bpf_prog_run_ge…
-
Critical 9.8
inet: frags: publish queues before arming timer
In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zer…
-
Critical 9.8
net/x25: fix use-after-free of the socket by its timers
In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket and a …
-
Critical 9.8
dibs: initialise dibs->lock in dibs_dev_alloc()
In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs->lock in dibs_dev_alloc() dibs->lock is initialised by dibs_dev_add(), but a dibs device can already take interrupts before that call: ism_probe() runs ism_dev_init(), a…