Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,536
- Last 24h
- 358
- Critical, 7 days
- 308
- Known exploited
- 1,781
26,234 results · Clear filters · Feed
-
Critical 9.6
Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sand…
-
Critical 9.6
Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code ins…
-
Critical 9.6
Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandb…
-
Critical 9.6
Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a …
-
Critical 9.6
Out of bounds write in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially pe…
-
Critical 9.6
Out of bounds read in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a s…
-
Critical 9.6
Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially p…
-
Critical 9.6
Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a san…
-
Critical 9.6
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker t…
-
Critical 9.6CVE-2026-14382 Public exploit
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker t…
-
Critical 9.8CVE-2026-58457 Public exploit
Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp
Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenticated OS command injection vulnerability that allows network-adjacent attackers to execute arbitrary shell commands by injecting unsanitized input through the smacfilter_conf hand…
-
Critical 10.0CVE-2026-50160 Scanner template
Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is confi…
-
Critical 9.8
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text_to_subtitles.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in text_to_subtitles.php (line 19) without sanitization: exec(\"php jobs/text_to_subtitles.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. A…
-
Critical 9.8
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe.php (line 15) without sanitization: exec(\"php jobs/transcribe.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthentica…
-
Critical 9.8
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe_amazon.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_amazon.php (line 15) without sanitization: exec(\"php jobs/transcribe_amazon.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. A…
-
Critical 9.8
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate_text.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate_text.php (line 18) without sanitization: exec(\"php jobs/translate_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unau…
-
Critical 9.8
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech_text.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech_text.php (line 18) without sanitization: exec(\"php jobs/speech_audio_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unau…
-
Critical 9.8
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac.php (line 18) without sanitization: exec(\"php jobs/speech_audio_mac.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthe…
-
Critical 9.8
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_text.php (line 18) without sanitization: exec(\"php jobs/speech_audio_mac_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. …
-
Critical 9.8
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in complex_start.php (line 14) without sanitization: exec(\"php jobs/complex.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthentica…
-
Critical 9.8
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech.php (line 18) without sanitization: exec(\"php jobs/speech_audio.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticate…
-
Critical 9.8
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in text.php (line 15) without sanitization: exec(\"php jobs/text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote a…
-
Critical 9.8
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate.php (line 14) without sanitization: exec(\"php jobs/translate.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticate…
-
Critical 9.8
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\"php jobs/subtitle_rendering.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unaut…
-
Critical 9.8
Guardian Language-System Unauthenticated SQL Injection via id Parameter in job_info.php
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info.php (line 16): SELECT * FROM jobs where id = '\".$_GET['id'].\"'. No authentication is required. An unauthenticated attacker can perform error-based SQL in…
-
Critical 9.8
JAIOTlink C492A-W6 4.8.30.57701411 Hard-coded Credentials via anyka_ipc
JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adjacent attackers to gain unauthorized access by using the default admin username with an empty password accepted by the a…
-
Critical 9.8
NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication. A successful exploit o…
-
Critical 9.8CVE-2026-57517 Public exploit
Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter
Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers c…
-
Critical 9.8
PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service
PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteObj, without any authentication requirement. By exploiting the MarshalByRefObject object unmarshall…
-
Critical 9.0
NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function…
-
Critical 9.8
PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service
PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by exploiting an exposed .NET Remoting TCP service on port 22222 via PGImageExchQueue.exe without any authe…
-
Critical 9.8
HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion
HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated …
-
Critical 9.0
NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function…
-
Critical 9.1
Feast: unauthenticated arbitrary file write
A vulnerability has been identified in the Feast Feature Server’s `/save-document` endpoint that allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Although the system attempts to restrict file locations, these…
-
Critical 9.8
WordPress PrivateContent plugin <= 9.9.2 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. This issue affects PrivateContent: from n/a through 9.9.2.
-
Critical 9.8
net: rds: clear i_sends on setup unwind
In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teardown path is written so it can run during partial startup and on repeated shutdown attempts. It uses NULL pointers to disting…
-
Critical 9.0
SSRF with API key leak in pretix-oppwa
The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The integration of Oppwa, following their official documentation, includes a step where the user is redirect…
-
Critical 9.1
@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values
@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical req…
-
Critical 9.0
Unauthenticated command injection in Control-M/Server communication command
A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to c…
-
Critical 9.8
SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly valida…