Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,171
- Last 24h
- 698
- Critical, 7 days
- 364
- Known exploited
- 1,779
26,207 results · Clear filters · Feed
-
Critical 9.6
NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction
NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product passes the caller-controlled product_number to src/netlicensi…
-
Critical 9.1
joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated…
-
Critical 9.3
runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox
runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deseri…
-
Critical 9.1
Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate …
-
Critical 9.8
Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the applica…
-
Critical 9.9
Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate …
-
Critical 10.0CVE-2026-110958 Public exploit
Wavlink WN530HG4B api.cgi heap-based overflow
A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made pu…
-
Critical 9.4
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users t…
-
Critical 9.9CVE-2026-57155 Public exploit
OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to cons…
-
Critical 10.0
Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It …
-
Critical 9.1
EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the app…
-
Critical 9.8
WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
-
Critical 9.8
WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13.
-
Critical 9.3
WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
-
Critical 9.3CVE-2026-99999 Public exploit
ipv4: validate checksum_start before completing checksum
In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of…
-
Critical 9.3
WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4.
-
Critical 9.8CVE-2026-98432 Public exploit
ipv4: free inet_opt and ireq_opt after an RCU grace period
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu…
-
Critical 9.8
WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
-
Critical 9.3
WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.
-
Critical 9.3
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path c…
-
Critical 9.3
Unauthenticated remote code execution vulnerability
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7…
-
Critical 9.3
Pre-Authentication Command Injection
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Stat…
-
Critical 9.4
Import Symlink Following Remote Code Execution Vulnerability in QuMagie
An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability i…
-
Critical 9.3
Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer
A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following vers…
-
Critical 9.3
Authentication bypass in Stela by Diaple Networking
Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSte…
-
Critical 9.4
An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, M…
-
Critical 9.2
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX…
-
Critical 9.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client …
-
Critical 9.8
Multiple jail filesystem root escapes
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory fi…
-
Critical 9.8
User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated…
-
Critical 9.8
10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation…
-
Critical 9.5
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensi…
-
Critical 9.8
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic f…
-
Critical 9.8CVE-2026-104586 Public exploit
AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.
-
Critical 9.1
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim'…
-
Critical 9.1
Token Signing Key Allows Unauthenticated Administrative Access
When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the defau…
-
Critical 9.1
Password Reset Functionality Missing Brute-Force Protection
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solut…
-
Critical 9.8
WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, …
-
Critical 9.8
WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo=…
-
Critical 9.8
WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and i…