Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,536
- Last 24h
- 359
- Critical, 7 days
- 308
- Known exploited
- 1,781
26,234 results · Clear filters · Feed
-
Critical 9.1
Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs…
-
Critical 10.0CVE-2026-13768 Public exploit
Gardyn IoT Hub Use of Hard-coded Credentials
Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a …
-
Critical 9.2
WatchGuard Firebox Race Condition and Use-After-Free in Mobile VPN with IKEv2 LDAP Authentication
WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context o…
-
Critical 9.3
Microsoft 365 Copilot Elevation of Privilege Vulnerability
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.9
Azure OpenAI Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.
-
Critical 9.9
Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
-
Critical 9.4
fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection
fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separator…
-
Critical 9.8
AutoBangumi < 3.2.8 - Hard-coded Default Credentials via add_default_user()
AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the databas…
-
Critical 9.1
Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosure
Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by exploiting AES-GCM initialization vector reuse across the server lifetime. Attackers can collect m…
-
Critical 9.8
Yonyou KSOA 9.0 Unauthenticated File Upload RCE via ImageUpload Servlet
Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filen…
-
Critical 9.8
Redsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mob
Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious files through the PtFjk.mob servlet endpoint. Attackers can submit a multipart POST request with a J…
-
Critical 9.9
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.
-
Critical 9.8
Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php
Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit() after an authentication redirect in loader.php combined with unsanitized i…
-
Critical 10.0
obs-service-tar_scm: command injection via mercurial handler
A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services
-
Critical 9.0
A malicious actor with access to the network and under certain network configurations could exploit an Improper Access …
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in U…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection v…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerabilit…
-
Critical 10.0CVE-2026-50746 Public exploit
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Conn…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerabilit…
-
Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability…
-
Critical 9.8
Improper Access Control in TR7's WAF-ASP
Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. WAF-ASP allows Authentication Abuse. This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117.
-
Critical 9.8
Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-su…
-
Critical 9.3
WordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.
-
Critical 9.3
WordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerability
Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions.
-
Critical 9.8
WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions.
-
Critical 9.6
WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.8.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions.
-
Critical 10.0
WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
-
Critical 9.0
WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability
Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.
-
Critical 9.8
WordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.
-
Critical 9.1
WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability
Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.
-
Critical 9.9
WordPress Zegen theme <= 1.1.9 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions.
-
Critical 9.1
ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_cont…
-
Critical 9.8
ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session id…
-
Critical 9.4
Path Traversal in Altium Git Service Allows Remote Code Execution
A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. The service accepts a sequence of post-clone file-manipulation operations that use user-supplied paths without validation, allowing an authen…
-
Critical 9.6
Use after free in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandb…
-
Critical 9.6
Use after free in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandb…
-
Critical 9.6
Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sand…
-
Critical 9.6
Use after free in Dawn in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform …
-
Critical 9.6
Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sand…