Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,215
- Last 24h
- 645
- Critical, 7 days
- 362
- Known exploited
- 1,779
26,207 results · Clear filters · Feed
-
Critical 9.2CVE-2026-19445 Public exploit
Use-after-free of a server-side SSLContext when sni_callback switches contexts
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original …
-
Critical 9.3
In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User I…
-
Critical 10.0CVE-2026-102427 Public exploit
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in th…
-
Critical 9.8
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service
LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __r…
-
Critical —
Next.js: Remote Code Execution in next/og ImageResponse
## Impact The Node.js `ImageResponse` implementation from `next/og` is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image ge…
-
Critical 10.0CVE-2026-76570 Public exploit
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values…
-
Critical 9.8CVE-2026-18782 Public exploit
SQL Injection in Trex Digital Manufacturing's Trex MES
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.
-
Critical 9.4CVE-2026-93903 Public exploit
LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case"…
-
Critical 9.8
Multiple Vulnerabilities in Dolusoft Software's SOPLOG
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1.
-
Critical 9.8
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling …
KEV Sep 30, 2026 -
Critical 9.8
WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability
Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.
-
Critical 9.8
WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
-
Critical 9.3
WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability
Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.
-
Critical 9.8
WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.
-
Critical 10.0CVE-2026-96349 Public exploit
WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.
-
Critical 9.0
WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.
-
Critical 9.2
Authentication Bypass in sogo_yhn
sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can su…
-
Critical 9.3
Authentication Bypass in sogo_yhn
sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arb…
-
Critical 9.1
Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.…
-
Critical 9.8
Apache WSS4J: SAML Sender-Vouches Authentication Bypass
An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommend…
-
Critical 9.1
Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signat…
-
Critical 9.1
Apache MINA SSHD: Asynchronous authentication can bypass signature verification
Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of th…
-
Critical 9.1
Apache MINA SSHD: LDAP injection in sshd-ldap
Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support fo…
-
Critical 9.1
Apache MINA SSHD: LDAP password authentication ineffective
A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-…
-
Critical 9.8
DigiWin｜EasyFlow .NET - Missing Authentication
EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.
-
Critical 9.8
DigiWin｜EasyFlow .NET - Insecure Deserialization
EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
-
Critical 9.2
Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade
Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker in a network position between client and server to impersonate the OPC UA server and to read, forge or modify …
-
Critical 9.1
WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability
Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass. This issue affects GiveWP: from n/a through 4.16.9.
-
Critical 9.8
Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload
The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code ex…
-
Critical 9.9
zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection
A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be…
-
Critical 9.8
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote att…
-
Critical 9.0CVE-2026-103056 Public exploit
AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR
AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated us…
-
Critical 9.8
Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows …
-
Critical 9.8
In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through Su…
-
Critical 9.1
DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/a…
-
Critical 9.8
In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through …
-
Critical 9.1
DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data…
-
Critical 9.8
In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available too…
-
Critical 9.8
Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.
-
Critical 9.8
DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.