Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,516
- Last 24h
- 717
- Critical, 7 days
- 313
- Known exploited
- 1,779
26,234 results · Clear filters · Feed
-
Critical 9.8
Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to st…
-
Critical 9.1
OpenSIPS: Global Buffer Overflow in construct_uri
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buf…
-
Critical 9.1
OpenSIPS: Buffer Overflow in Base64 Encode Transformation
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. The size check for {s.b64encode} only verifies that the input fits wi…
-
Critical 9.8
Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call
Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call. The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a…
-
Critical 9.8
OpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copy
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routing script. Function s…
-
Critical 9.8
MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie
MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowl…
-
Critical 9.8
MaxSite CMS Unauthenticated RCE via Install Endpoint
MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. A…
-
Critical 9.2
Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The endpoint decrypts the …
-
Critical 9.5
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist valid…
-
Critical 9.8
MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php
MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving …
-
Critical 9.8
Keysight IxChariot-related products stack-based buffer overflow
Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet and execute arbitrary code with administrative privileges.
-
Critical 9.8
Keysight IxChariot Endpoint stack-based buffer overflow
Keysight IxChariot Endpoint before 9.5.102 contains a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet to crash the endpoint or potentially execute arbitrary code.
-
Critical 9.8
Keysight IxChariot Endpoint heap-based buffer overflow
Keysight IxChariot Endpoint before 9.5.102 contains a heap-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet to crash the endpoint or potentially execute arbitrary code.
-
Critical 9.8
Atlas-Livre Unauthenticated Access via Admin Controllers Missing Exit
Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attac…
-
Critical 9.8
In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to re…
-
Critical 9.5
Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbi…
-
Critical 9.8
NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an o…
-
Critical 9.4
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Nod…
-
Critical 9.8
Authentication bypass via spoofed HTTP headers Orchestrator REST API
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to vie…
-
Critical 9.8
Authentication bypass via spoofed HTTP headers Orchestrator REST API
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to vie…
-
Critical 9.4
Flowise RCE via SQLite Record Manager Node
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalCo…
-
Critical 10.0CVE-2026-64633 Public exploit
A vulnerability allowing remote unauthenticated code execution on the agent host.
-
Critical 9.0
A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lea…
-
Critical 9.5CVE-2026-58073 Public exploit
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent a…
-
Critical 9.4
Flowise: Remote Code Execution Vulnerability in CSVAgent
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.r…
-
Critical 9.2
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split(',').pop() and interpolated i…
-
Critical 9.1
OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music
OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:…
-
Critical 9.4CVE-2026-69254 Public exploit
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.…
-
Critical 9.8CVE-2026-69098 Public exploit
kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization
kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can…
-
Critical 9.0
Flowise Sandbox Escape to RCE
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that c…
-
Critical 9.6
Stack-based Buffer Overflow in WLAN Firmware
Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
-
Critical 9.3
Stored Clickhouse SQL Injection Through Customer Usage Attribution
OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subject…
-
Critical 9.0CVE-2026-69251 Scanner template
Flowise RCE via TypeORM DataSource
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in packages/com…
-
Critical 9.8
Puwell IP Camera 2.x - 4.x Unauthenticated Access via TCP Port 23456
Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device functions by sending protocol-conforming packets over TCP port 23456 without credentials. Attackers can e…
-
Critical 9.8CVE-2026-61515 Public exploit
Puwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShell
Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on…
-
Critical 9.1
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA …
-
Critical 9.1
Hardcoded Cryptographic Key in Bilin Software's HUMANIST Digital Human Resources
Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable. This issue affects HUMANIST Digital Human Resources: from 26.0 before 2…
-
Critical 9.8
Unrestricted File Upload in Bilin Software's HUMANIST Digital Human Resources
Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload a Web Shell to a Web Server. This issue affects HUMANIST Digital Human Resources: from 26.0 before …
-
Critical 9.8
Query Console SQL Injection Leading to Sensitive Data Disclosure in Bilin Software's HUMANIST Digital Human Resources
Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injection. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.
-
Critical 9.1
Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)
The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traff…