Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,172
- Last 24h
- 684
- Critical, 7 days
- 364
- Known exploited
- 1,779
26,207 results · Clear filters · Feed
-
Critical 9.6
Visual Studio Code Remote Code Execution Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
-
Critical 10.0CVE-2026-103849 Public exploit
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the vict…
-
Critical 9.3
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the pag…
-
Critical 9.1
Adobe Commerce | Improper Input Validation (CWE-20)
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitatio…
-
Critical 9.8
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does no…
-
Critical 9.3
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the pag…
-
Critical 9.3
Remote Code Execution (RCE) vulnerability identified in the OpenText™ EnCase SAFE Agents
The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allo…
-
Critical 9.0
Potential command execution on the host running JFrog CLI.
Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.
-
Critical 9.4CVE-2026-106173 Public exploit
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.…
-
Critical 9.4CVE-2026-105445 Public exploit
Docker Hub account conversion could reassign an active personal access token to another user
An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the …
-
Critical 9.1
Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFile
Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and fileName parameters t…
-
Critical 10.0
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation res…
-
Critical 9.1
OpenCATS: Authenticated RCE in the Import module
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type …
-
Critical 9.9
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used duri…
-
Critical 9.9
An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensiti…
-
Critical 9.6
RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page
RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malici…
-
Critical 9.0
Cronicle: Stored XSS in admin Activity Log via account full_name field
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applyin…
-
Critical 9.3
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 …
-
Critical 9.9
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authen…
-
Critical 9.8
BUG-000187331 Portal for ArcGIS has a security vulnerability
A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
-
Critical 9.1
FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which pass…
-
Critical 9.3
Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user…
-
Critical 9.8
x86/AMD: ineffectual Zenbleed workaround
The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted conditional was introduced, resulting in the workaround to not be applied when needed and vice v…
-
Critical 10.0
Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-beari…
-
Critical 9.6
DragonflyDB stream RDB deserialization double-free
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared …
-
Critical 9.8
MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform ad…
-
Critical 9.3
CVFS Command Execution
CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
-
Critical 9.1
Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding
Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writ…
-
Critical 9.0
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send Distribut…
-
Critical 9.1
Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basenam…
-
Critical 9.1
NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unau…
-
Critical 10.0
NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remot…
-
Critical 9.8
Mitigation bypass in the DOM: Core & HTML component
Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
-
Critical 9.8
Invalid pointer, undefined behavior in the DOM: Notifications component
Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
-
Critical 9.1
Same-origin policy bypass in the DevTools component
Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
-
Critical 9.6
Sandbox escape in the DOM: Content Processes component
Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
-
Critical 9.6
Site isolation issue in the DOM: Web Authentication component
Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
-
Critical 9.6
Sandbox escape due to uninitialized memory in the DOM: Web Serial component
Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
Critical 9.6
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
Critical 9.6
Sandbox escape due to use-after-free in the Networking component
Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.