Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,514
- Last 24h
- 734
- Critical, 7 days
- 315
- Known exploited
- 1,779
26,233 results · Clear filters · Feed
-
Critical 9.8
WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.
-
Critical 9.8
WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.
-
Critical 9.3
WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability
Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.
-
Critical 9.8
WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.
-
Critical 9.3CVE-2026-28001 Public exploit
WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
-
Critical 10.0
WordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.
-
Critical 9.8
WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combin…
-
Critical 9.0
Flowise before 3.1.3 Sandbox Escape to RCE
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function …
-
Critical 9.0
Flowise before 3.1.3 Remote Code Execution via Custom MCP
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments…
-
Critical 9.0
Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV
Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfusca…
-
Critical 9.0
Flowise before 3.1.3 Prompt Injection RCE via CSV Agent
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.read_json() …
-
Critical 9.0
Flowise before 3.1.3 Remote Code Execution via Airtable Agent
Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send cr…
-
Critical 9.4
Flowise before 3.1.3 Sandbox Escape via Puppeteer
Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying…
-
Critical 9.3
Priority – CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control
: Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to…
-
Critical 9.3
Priority – CWE-306: Missing Authentication for Critical Function
: Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwal…
-
Critical 9.1
Priority – CWE-602: Client-Side Enforcement of Server-Side Security
: Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Pri…
-
Critical 9.1
Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
: Exposure of Sensitive Information to an Unauthorized Actor : Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generato…
-
Critical 10.0
Priority - CWE-287: Improper Authentication
: Improper Authentication vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3.
-
Critical 10.0
Link Factory - Backdoor
The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator p…
-
Critical 9.8
Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass
The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated us…
-
Critical 9.8
UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd
UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/handlers.go:249`), reachable as `POST /api/upsnap/init-superuser`. The vulnerable c…
-
Critical 9.8
PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document
PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document. For an HTML string or file source, the constructor collects every <meta name="pdf-webkit-KEY" content="VALUE"> element in the document he…
-
Critical 9.6
UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd
UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-contro…
-
Critical 9.6
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB const…
-
Critical 9.0
Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image
A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the `Collector.ImageOverride` field. This allows the at…
-
Critical 9.1
kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. …
-
Critical 10.0
IBM Engineering Requirements Management DOORS Next is impacted by vulnerability in Reviews delete request
IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities.
-
Critical 9.8CVE-2026-73519 Public exploit
WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret
WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack…
-
Critical 9.8
CVE-2026-18749
The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leak…
-
Critical 9.8
MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names
The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling a…
-
Critical 9.9
Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the ar…
-
Critical 9.9
Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker…
-
Critical 9.9
Root RCE via image backup.yaml symlink
A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists a…
-
Critical 9.2
Shescape: Shell injection via unescaped parentheses on Windows with CMD
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shel…
-
Critical 9.9
Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that lev…
-
Critical 9.8
IBM i is Affected By Multiple Vulnerabilities in the Debug Server
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.
-
Critical 9.9
Project restriction bypass via instance migration config override
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new confi…
-
Critical 9.9
Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge
An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD perfo…
-
Critical 9.9
Cross-project cluster migration bypasses project restrictions via cluster notification flag
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/…
-
Critical 9.9
ScadaLTS Authenticated Remote Code Execution
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitatio…