Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,171
- Last 24h
- 698
- Critical, 7 days
- 364
- Known exploited
- 1,779
26,207 results · Clear filters · Feed
-
Critical 9.8
pypdftk through 0.5 OS Command Injection via PDF and Output Paths
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters inter…
-
Critical 9.8
webp-converter before 3.0.0 OS Command Injection via File Names and Options
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux …
-
Critical 9.8CVE-2026-110634 Public exploit
git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions tha…
-
Critical 9.8
Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120…
-
Critical 9.8
vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain su…
-
Critical 9.8
office-converter through 1.0.2 OS Command Injection via fileName in generatePdf
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell me…
-
Critical 9.8
Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce
SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microso…
-
Critical 9.8
Missing Authentication for Critical Function in TR7 Cyber Defense's TR7 ASP
Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.…
-
Critical 9.8
OS Command in TR7 Cyber Defense's TR7 ASP
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issu…
-
Critical 9.8
WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
-
Critical 9.8
WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7.
-
Critical 9.3
Stored XSS Vulnerability in JTL-Shop
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the ad…
-
Critical 9.2
Unauthorised disclosure of information on Copart’s online billing service
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details …
-
Critical 9.8CVE-2026-104748 Public exploit
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX actio…
-
Critical 9.9
SQL Command Injection Vulnerability in JTL-WMS
A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.
-
Critical 10.0
File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing the…
-
Critical 9.8
JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid …
-
Critical 9.8
AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php
The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standa…
-
Critical 9.2
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code executio…
KEV Oct 23, 2026 -
Critical 9.8CVE-2026-97657 Public exploit
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recove…
-
Critical 9.8
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparat…
-
Critical 9.8
Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter
The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the s…
-
Critical 9.8
Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.
-
Critical 9.1
Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filte…
-
Critical 9.8
Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registe…
-
Critical 9.9
Legacy Update ActiveX control accepts unauthorized hosting origins
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's ho…
-
Critical 9.6
Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary cod…
-
Critical 9.6
Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrar…
-
Critical 9.6
Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to poten…
-
Critical 9.6
Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially e…
-
Critical 9.6
Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code o…
-
Critical 9.6
Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code o…
-
Critical 9.6
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outsi…
-
Critical 9.6
Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially…
-
Critical 10.0
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
-
Critical 9.0
ColdFusion | Improper Input Validation (CWE-20)
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond…
-
Critical 10.0
ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Expl…
-
Critical 9.1
ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Expl…
-
Critical 9.3
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories…
-
Critical 9.9
ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitr…