Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,670
- Last 24h
- 94
- Critical, 7 days
- 297
- Known exploited
- 1,781
26,256 results · Clear filters · Feed
-
Critical 9.8
In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL…
-
Critical 9.1CVE-2026-25548 Public exploit
InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion (LFI) and Log Poisoning attack. An aut…
-
Critical 9.8
ChaosPro 2.0 - Buffer Overflow
ChaosPro 2.0 contains a buffer overflow vulnerability in the configuration file path handling that allows attackers to execute arbitrary code by overwriting the Structured Exception Handler. Attackers can craft a malicious configuration file with carefully co…
-
Critical 9.8
Win10 MailCarrier 2.51 - 'POP3 User' Remote Buffer Overflow
MailCarrier 2.51 contains a buffer overflow vulnerability in the POP3 USER command that allows remote attackers to execute arbitrary code. Attackers can send a crafted oversized buffer to the POP3 service, overwriting memory and potentially gaining remote sys…
-
Critical 9.8
WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Buffer OverFlow
WMV to AVI MPEG DVD WMV Convertor 4.6.1217 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the license name and license code fields. Attackers can craft a malicious payload of 6000 bytes to trigger a bin…
-
Critical 9.8
Ayukov NFTP client 1.71 - 'SYST' Buffer Overflow
Ayukov NFTP client 1.71 contains a buffer overflow vulnerability in the SYST command handling that allows remote attackers to execute arbitrary code. Attackers can send a specially crafted SYST command with oversized payload to trigger a buffer overflow and e…
-
Critical 9.8
Aida64 6.10.5200 - Buffer Overflow
Aida64 Engineer 6.10.5200 contains a buffer overflow vulnerability in the CSV logging configuration that allows attackers to execute malicious code by crafting a specially designed payload. Attackers can exploit the vulnerability by creating a malformed log f…
-
Critical 9.8CVE-2026-27180 Public exploit
MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without …
-
Critical 9.8
MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval
MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, all…
-
Critical 9.8
MajorDoMo Command Injection in rc/index.php via Race Condition
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command…
-
Critical 9.3
InvoicePlane has Unauthenticated Path Traversal in Guest Controller
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the `get_file` method of the `Guest` module's `Get` controller in InvoicePlane up to and including through 1.6.3. The …
-
Critical 10.0
Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution
A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to cra…
-
Critical 9.5
An Insecure Deserialization vulnerability has been discovered in OpenText™ Directory Services.
Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to remote code execution, denial of service, or privilege escalation. This issue affects Directory Services: before 24.4.16,…
-
Critical 9.3
Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow
An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target dev…
-
Critical 9.3
Incorrect management of session invalidation vulnerability in Graylog Web Interface
Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. The application generates a new 'sessionId' each time a user authenticates, but does not invalidate p…
-
Critical 9.8CVE-2025-65791 Public exploit
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user …
-
Critical 9.4
SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dis…
-
Critical 9.1
Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Gener…
-
Critical 9.8
UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the te…
-
Critical 9.8
code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user managemen…
-
Critical 9.8
CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that a…
-
Critical 9.8CVE-2025-70149 Public exploit
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID param…
-
Critical 9.8
Honeywell CCTV Products Missing Authentication for Critical Function
The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address.
-
Critical 10.0
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. Th…
KEV Feb 18, 2026 -
Critical 9.8
Glory RBG-100 Recycler System Hard-coded OS Credentials
Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authentication to the underlying Linux system. Multiple local user accounts, including accounts with administrative privilege…
-
Critical 9.6
OpenS100 Portrayal Engine Unrestricted Lua Standard Library Access
OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL_openlibs() without sandboxing or capability restri…
-
Critical 9.3
LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE
LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD (prefill-decode) disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads() …
-
Critical 9.9
Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authentic…
-
Critical 9.9CVE-2025-70830 Public exploit
A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows au…
-
Critical 9.8
Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids
Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defaults to using the uuidgen command to generate a UUID, with a fallback to using Perl's built-in rand …
-
Critical 9.8
Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely
Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to the built-in rand() function, and the PID.
-
Critical 9.8
EFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted upload
A vulnerability was found in EFM iptime A6004MX 14.18.2. Affected is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been made publi…
-
Critical 10.0
Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge
The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge …
-
Critical 9.8
JUNG eNet SMART HOME server 2.2.1/2.3.1 Use of Default Credentials
eNet SMART HOME server 2.2.1 and 2.3.1 ships with default credentials (user:user, admin:admin) that remain active after installation and commissioning without enforcing a mandatory password change. Unauthenticated attackers can use these default credentials t…
-
Critical 9.3
Stack Overflow in processing requests over INC interface on RH850 side of Infotainment ECU
The Infotainment ECU manufactured by Bosch uses a RH850 module for CAN communication. RH850 is connected to infotainment over the INC interface through a custom protocol. There is a vulnerability during processing requests of this protocol on the V850 side wh…
-
Critical 9.8
Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all versions up …
-
Critical 9.8
Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration
The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the user_role parameter during user registration. This makes it possible for unauthenticated at…
-
Critical 9.8
midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action
The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'export' AJAX action in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to…
-
Critical 9.8
Known affected by Account Takeover via Password Reset Token Leakage
Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows an…
-
Critical —
`polymarket-client-sdks` was removed from crates.io for malicious code
It appeared to be typosquatting existing crate [`polymarket-client-sdk`](https://crates.io/crates/polymarket-client-sdk) (`sdks` vs `sdk`) and attempting to steal credentials from local files. The malicious crate had 1 version published on 2026-02-09 and had …