Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,165
- Last 24h
- 698
- Critical, 7 days
- 369
- Known exploited
- 1,779
26,207 results · Clear filters · Feed
-
Critical 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functi…
-
Critical 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functi…
-
Critical 9.1
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (v…
-
Critical 9.1
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (v…
-
Critical 9.1
An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLIN…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOL…
-
Critical 9.1
A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X20…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTO…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLI…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R…
-
Critical 9.1
An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK…
-
Critical 9.1
A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.…
-
Critical 9.1
A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLIN…
-
Critical 9.1
A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000…
-
Critical 9.1
A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-…
-
Critical 9.1
FTP wildcard write callback mixup
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of …
-
Critical 9.1
wolfSSL public-key pinning bypass
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a m…
-
Critical 9.1
cross-origin reuse of a Negotiate connection
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.
-
Critical 9.1
leaking host credentials to HTTP proxy
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:…
-
Critical 9.1
Negotiate credentials sent to redirected origin
When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.
-
Critical 9.9
Missing authorization in the WhatsApp channel in Kiro Crew
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew vi…
-
Critical 9.1
FTP connection reuse inherits client-certificate
An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a ne…
-
Critical —
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.4 include the `emSign ECC Root CA - G3` root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private k…
-
Critical —
certifi bundles emSign root CAs with compromised intermediate CA keys
Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with…
-
Critical 9.1
Stanza injection in XMPP chat
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanza…
-
Critical 9.1
Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting
XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.
-
Critical 9.9
Argo CD: A Kustomize Helm config home can run commands in the repo-server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directorie…
-
Critical 9.9
Argo CD: A Kustomize remote ref can run commands in the repo-server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options …
-
Critical 9.9
Argo CD: A Jsonnet import can read files from the repo-server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository …
-
Critical 9.8
Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen().…
-
Critical 9.1
Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArti…
-
Critical 9.9
aaPanel File Manager common.py ExecShell os command injection
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. Th…
-
Critical 9.3
SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the …
-
Critical 9.9
Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess …
-
Critical 9.3
Apache CouchDB: Admin credentials leading to code execution as operating system user
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes th…
-
Critical 9.3
Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus dr…
-
Critical 9.1
Apache Tomcat: AJP response mix-up
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second requ…
-
Critical 9.1
Apache Tomcat: HTTP/2 request/response mix-up after error during async processing
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 th…