Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,693
- Last 24h
- 433
- Critical, 7 days
- 344
- Known exploited
- 1,779
26,167 results · Clear filters · Feed
-
Critical 9.8
CVE-2026-16306
Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted `imodular:// UR…
-
Critical 9.1
Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller
SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference…
-
Critical 9.4CVE-2026-120446 Scanner template
madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API
madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/ten…
-
Critical 9.8CVE-2026-120442 Scanner template
ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to …
-
Critical 9.1
Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds o…
-
Critical 9.8
Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via …
-
Critical 9.8
Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass
Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security san…
-
Critical 9.1
Apache Syncope: Delegated administration boundaries can be bypassed for Realm update
Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.0.…
-
Critical 9.8
Apache Syncope: Remote Code Execution via Flowable JUEL expression
Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression…
-
Critical 9.3
Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modifi…
KEV Nov 10, 2026 -
Critical 9.1
@fastify/http-proxy vulnerable to prefix escape via decoded route parameters
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream pa…
-
Critical 9.4
Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful e…
-
Critical 10.0
WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection
A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is …
-
Critical 10.0
WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection
A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The …
-
Critical 9.9
Termix-SSH Termix transferToHost path traversal
A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated rem…
-
Critical 10.0
Linksys E8450 portal.cgi strcpy stack-based overflow
A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. Th…
-
Critical 9.9
WAVLINK WN536AX6-A protocol.csp host_black os command injection
A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has bee…
-
Critical 10.0
WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow
A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launche…
-
Critical 10.0
WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection
A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injec…
-
Critical 10.0
WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection
A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can …
-
Critical 9.8
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module. When processing a…
-
Critical 10.0
WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection
A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command inj…
-
Critical 10.0
WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection
A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. I…
-
Critical 9.9
WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead to os comma…
-
Critical 9.9
WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection
A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument file_id results in os command injection. T…
-
Critical 9.9
WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The attack can be execute…
-
Critical 9.8
Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials
Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials. An external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredential…
-
Critical 9.3
WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.
-
Critical 9.9
Prefab UI Pyodide sandbox escape to host RCE
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the l…
-
Critical 9.9
WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possibl…
-
Critical 9.9
WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection
A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit ha…
-
Critical 9.1
WAVLINK WN553X1-B ioos sub_416B50 os command injection
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The …
-
Critical 9.9
WAVLINK WN553X1-B ioos Service sub_416D88 os command injection
A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument group_id/group_name can lead to os command injection. Th…
-
Critical 9.9
Beta9 host filesystem exposure via volume path traversal
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the iden…
-
Critical 9.9
Beta9 container escape via unvalidated sandbox file paths
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.bet…
-
Critical 9.9
Beta9 build sandbox escape via chroot-only isolation
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its…
-
Critical 9.9
WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection
A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in os command injection.…
-
Critical 9.1
Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal
A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack may …
-
Critical 9.9
Oray Pugongying X5 Pro API Authorization run_async_task improper authorization
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. Th…
-
Critical 9.1
Gitea public-only package token access to private OCI blobs
The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction, but checked the source blob only against the full account permissions of the token owner. A `public-only` token with `write:package` scope…