Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,810
- Last 24h
- 356
- Critical, 7 days
- 341
- Known exploited
- 1,779
26,177 results · Clear filters · Feed
-
Critical 9.8
WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
-
Critical 9.8
WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.
-
Critical 9.8
WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
-
Critical 9.8
WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
-
Critical 9.8
WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
-
Critical 9.8CVE-2026-93680 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.
-
Critical 9.8
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
-
Critical 9.9CVE-2026-107327 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.
-
Critical 9.9CVE-2026-107328 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.
-
Critical 9.9CVE-2026-107329 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
-
Critical 9.8CVE-2026-110186 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
-
Critical 9.8
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitr…
-
Critical 9.3
WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126.
-
Critical 9.8
Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with thi…
-
Critical 9.8
Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash
A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
-
Critical 9.1
Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.
When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This c…
-
Critical 9.3
SQL Injection Vulnerability in Radius Xenia M2M Platform
This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerability by sup…
-
Critical 9.8
Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload
The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote …
-
Critical 9.9
Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal
The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones con…
-
Critical 9.8
LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's p…
-
Critical 9.0
Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP o…
-
Critical 9.8
Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token
The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback…
-
Critical 9.8
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially…
-
Critical 9.4
Unrestricted Command Execution via system.execute
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arb…
-
Critical 9.8
The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacke…
-
Critical 9.8
An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.
-
Critical 9.1
Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exporte…
-
Critical 9.1
Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to anot…
-
Critical 9.1
Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an expor…
-
Critical 9.8
An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in th…
-
Critical 9.1
Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows …
-
Critical 9.1
Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's S…
-
Critical 9.1
Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized att…
-
Critical 9.1
Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in ano…
-
Critical 9.1
Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an …
-
Critical 9.1
Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported componen…
-
Critical 9.1
Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an export…
-
Critical 9.8
An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another u…
-
Critical 9.1
Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read n…
-
Critical 9.1
Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers …