Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,514
- Last 24h
- 734
- Critical, 7 days
- 360
- Known exploited
- 1,779
26,233 results · Clear filters · Feed
-
Critical 9.3CVE-2026-73665 Public exploit
FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to…
-
Critical 9.3CVE-2026-73663 Public exploit
FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound param…
-
Critical 9.8
AgenticSeek Unauthenticated RCE via /query API Endpoint
AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by submitting crafted queries to the unprotected POST /query API endpoint bound to 0.0.0.0:777…
-
Critical 9.1
Insufficient Authentication Brute Force Protection on Login Endpoint
IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts.
-
Critical 9.8
IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.
-
Critical 9.6
Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath
Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod…
-
Critical 9.9
Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call() in apps/webapp/app/v3/services/createD…
-
Critical 9.8
Tenda CH7 ATE Module Kylin HandleCmd command injection
A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injecti…
-
Critical 9.4
IBM WebSphere Application Server Liberty is affected by an authenication bypass
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.
-
Critical 9.4
Vitest: Browser Mode provider commands bypass the file-access permission gate
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied fil…
-
Critical 9.8
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of CVE-2026-44966 fix)
Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __proto__, and prototype only in the #set assignment handler in src/compile/set.ts, while property-read…
-
Critical 9.6
OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grant
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIED_AUTH privilege but did not evalua…
-
Critical 9.1
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex() path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied …
-
Critical 9.8
CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal
CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. At…
-
Critical 9.1
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
-
Critical 9.1
Public-only repository tokens can update private PR head branches
Public-only repository tokens can update private PR head branches
-
Critical 9.1
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
-
Critical 9.1
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
-
Critical 9.6
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
-
Critical 9.8
Privilege Escalation via Access Token Scope Escalation in API
Privilege Escalation via Access Token Scope Escalation in API
-
Critical 9.1
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
-
Critical 9.1
Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template
Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template. validate runs HTML::Ti…
-
Critical 9.1
HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template
HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template. add_error …
-
Critical 9.8
Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_o…
-
Critical 9.8
Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that es…
-
Critical 9.1
rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header
rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly…
-
Critical 9.8
WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.
-
Critical 9.3
WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability
Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.
-
Critical 9.3
WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability
Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.
-
Critical 9.8
WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability
Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.
-
Critical 9.3
WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.
-
Critical 9.8
WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.
-
Critical 9.3
WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability
Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.
-
Critical 9.3
WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability
Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.
-
Critical 9.8
WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.
-
Critical 9.3
WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.
-
Critical 9.8
WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.
-
Critical 9.3
WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability
Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.
-
Critical 10.0
WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability
Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.
-
Critical 9.8
WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.