Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,536
- Last 24h
- 357
- Critical, 7 days
- 304
- Known exploited
- 1,781
26,234 results · Clear filters · Feed
-
Critical 9.6
OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, cache store poisoning leads to Remote Code Execution (RCE). This vulnerability is fixed in 17.3.3 and 17.4.1.
-
Critical 9.9CVE-2026-52782 Public exploit
OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unau…
-
Critical 9.9
OpenProject: SQL injection in timestamps functionality
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a SQL injection in timestamps functionality. OpenProject baseline comparison allows callers to request historic work-package attributes using the timestamp…
-
Critical 9.6
mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes .tool-versions files through the Tera template engine during parsing, with the exec() function registered, enabling arbitrary command execution. Unlike .mise.to…
-
Critical 9.0
Dokku: OS Command Injection via app.json managed Cron
Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can …
-
Critical 9.0
Dokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:add
Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary directories without sanitizing member paths or preventing symlink traversal. GNU tar creates symlinks during ext…
-
Critical 9.0
Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval
Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to the host and then interpolates their filenames, unescaped, into a single-quoted shell string that is l…
-
Critical 9.0
Dokku: OS Command Injection via App Name in Git Pre-Receive Hook
Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receiv…
-
Critical 9.8
Server side template inject (SSTI) in Edgewall Genshi Template Engine
Server side template inject (SSTI) in the expression evaluation component in Genshi Template Engine version 0.7.9 allows a remote attacker to achieve remote code execution (RCE) via crafted template expressions.
-
Critical 9.6
Unprotected temporary directories in Wolfram Cloud may result in privilege escalation
The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the the JVM initialization exists in the vulnerable directory durin…
-
Critical 9.1
WordPress TemplateSpare plugin <= 4.2.0 - Arbitrary File Upload vulnerability
Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.
-
Critical 9.3CVE-2026-56070 Scanner template
WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability
Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.
-
Critical 9.3
WordPress JetEngine plugin <= 3.8.10.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.
-
Critical 9.3
WordPress JetSmartFilters plugin <= 3.8.3 - SQL Injection vulnerability
Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.
-
Critical 9.3CVE-2026-56062 Scanner template
WordPress Quotes llama plugin <= 3.1.5 - SQL Injection vulnerability
Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.
-
Critical 9.9
WordPress Travel Booking theme <= 2.2.5 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.
-
Critical 9.9
WordPress Quform plugin <= 2.23.0 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.
-
Critical 9.8
WordPress Uncanny Automator Pro plugin <= 7.3.0.6 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.
-
Critical 9.3
WordPress 워드프레스 결제 심플페이 plugin <= 5.5.6 - SQL Injection vulnerability
Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.
-
Critical 9.8
WordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.
-
Critical 9.3
WordPress Library Management System plugin <= 3.5.7 - SQL Injection vulnerability
Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.
-
Critical 9.8
WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.
-
Critical 9.8
WordPress Paytium plugin <= 5.0.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions.
-
Critical 9.9
WordPress Booster for WooCommerce plugin <= 8.0.1 - Arbitrary File Upload vulnerability
Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.
-
Critical 9.8
WordPress Easy Elements for Elementor – Addons & Website Templates plugin <= 1.4.9 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Easy Elements for Elementor – Addons & Website Templates <= 1.4.9 versions.
-
Critical 9.3
WordPress GeoDirectory plugin <= 2.8.162 - SQL Injection vulnerability
Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.
-
Critical 9.3
WordPress Real Estate 7 theme <= 3.5.9 - SQL Injection vulnerability
Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.
-
Critical 9.3
WordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS wpDataTables wpdatatables allows Blind SQL Injection.This issue affects wpDataTables: from n/a through 7.4.
-
Critical 9.3
WordPress JetBooking plugin <= 4.0.4.1 - SQL Injection vulnerability
Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.
-
Critical 9.1
Apache IoTDB: Path Traversal Vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.6 and 2.0.7, which…
-
Critical 9.1
Apache IoTDB: Path Traversal Vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6. Users are recommended to upgrade to version 1.3.6 and 2.0.6, which…
-
Critical 9.8
GV-LPC2011/LPC2211 - unauthorized stack-based buffer overflow vulnerability (vlsvr)
An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient length validation when processing remote login data. A remote attacker may explo…
-
Critical 9.8
GV-LPC2011/LPC2211 - unauthorized buffer overflow via RTSP Digest username (ssvr)
An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when parsing RTSP Digest authentication fields. A remote attacker…
-
Critical 9.8
GV-LPC2011/LPC2211 - unauthorized buffer overflow via AuthMode/AuthValue path (ssvr)
An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing RTSP custom authentication data. A remote attacke…
-
Critical 9.8
GV-LPC2011/LPC2211 - unauthorized buffer overflow vulnerability (thttpd)
An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing web request parameters in a specific request pa…
-
Critical 10.0CVE-2025-71338 Public exploit
Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API
Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and over…
-
Critical 9.8
Flowise - Unsandboxed Remote Code Execution via Custom MCP
Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentic…
-
Critical 9.8CVE-2025-71334 Scanner template
Flowise - Arbitrary File Access via Missing Chat Flow ID Validation
Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the …
-
Critical 9.3
Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files …
-
Critical 9.1
Flowise - Authentication Bypass via Unprotected Registration Endpoint
Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authentic…