Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,516
- Last 24h
- 736
- Critical, 7 days
- 315
- Known exploited
- 1,779
26,234 results · Clear filters · Feed
-
Critical 10.0
WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.
-
Critical 9.8
WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.
-
Critical 9.9
WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability
Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.
-
Critical 9.3
WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability
Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.
-
Critical 9.3
WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.
-
Critical 9.8
WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.
-
Critical 9.3
WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability
Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.
-
Critical 9.8
WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.
-
Critical 9.8
WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.
-
Critical 9.1CVE-2026-53976 Scanner template
OpenChamber 1.11.7 Path Traversal File Read via allowOutsideWorkspace Parameter
OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query paramet…
-
Critical 9.8
OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec
OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn(…
-
Critical 9.1
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Informat…
-
Critical 9.8
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Inject…
-
Critical 9.8
SQLi in Loca Software's CMS
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about …
-
Critical 9.6
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfrest…
-
Critical 9.1
Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client…
-
Critical 9.1
Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known …
-
Critical 9.1
Apache CXF: Self-issued ID token claims validation skipped
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued …
-
Critical 9.8
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization c…
-
Critical 9.8
Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized ob…
-
Critical 10.0
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized acce…
KEV Sep 24, 2026 -
Critical 9.8
Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potential…
-
Critical 9.4
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass…
-
Critical 9.8
smb: client: fix double-free in SMB2_close() replay
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails before the next send, cle…
-
Critical 9.1
WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number
The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addre…
-
Critical 9.1
Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle
The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files st…
-
Critical 9.8CVE-2026-67689 Public exploit
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `o…
-
Critical 9.8
ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module…
-
Critical 9.3
FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-w…
-
Critical 9.6
Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution
Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authen…
-
Critical 9.9
boringproxy 0.10.0 SSH authorized_keys Injection via Tunnel Creation
boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a percent-encoded ne…
-
Critical 10.0
PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name
PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or val…
-
Critical 9.0
In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS …
-
Critical 9.1
Cisco SD-WAN Software Security Hardening Release - Improper Link Resolution Before File Access
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple inter…
-
Critical 9.9CVE-2026-20303 Public exploit
Cisco Catalyst SD-WAN Security Hardening Release - Input Validation Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple inter…
-
Critical 9.9
Cisco Catalyst SD-WAN Security Hardening Release - Access Control Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that address multiple inte…
-
Critical 9.8
Cisco IOS XE Software Security Hardening Release
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple inter…
-
Critical 9.0
Cisco IOS XE Software Security Hardening Release
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple inter…
-
Critical 9.3
Cross-site scripting in Progress MarkLogic Server Query Console
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser s…
-
Critical 9.9
Privilege escalation in Progress MarkLogic Server Hadoop integration
An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the …