Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,431
- Last 24h
- 768
- Critical, 7 days
- 374
- Known exploited
- 1,779
26,232 results · Clear filters · Feed
-
Critical 9.6
Out of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute…
-
Critical 9.6
Buffer overflow in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code ou…
-
Critical 9.6
Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbi…
-
Critical 9.6
Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code out…
-
Critical 9.6
Use after free in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbi…
-
Critical 9.8
An issue in Actions Semiconductor Co. Ltd Tool- Media Player Utilities v.4.46 allows a physically proximate attacker ex…
-
Critical 9.8
An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token se…
-
Critical 9.8
An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers c…
-
Critical 9.1
OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512…
-
Critical 9.0
ntp: write path traversal
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the …
-
Critical 9.8
Astro: Remote code execution through AVIF image optimization
A vulnerability in `libheif`, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized. Projects are affected when an attacker can cause Astro to process an untrusted AVIF image. The fix was …
-
Critical —
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
A vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled.
-
Critical 9.0
Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attri…
-
Critical 9.2
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from…
-
Critical 9.9
Adobe Experience Manager | Incorrect Authorization (CWE-863)
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. A low-privi…
-
Critical 9.9
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identit…
-
Critical 9.1
ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit th…
-
Critical 9.9
ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)
ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vu…
-
Critical 9.9CVE-2026-84869 Exploited
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
KEV Sep 11, 2026 -
Critical 10.0
In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could…
-
Critical 10.0
In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due t…
-
Critical 10.0
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit…
-
Critical 9.8
Skype for Business Remote Code Execution Vulnerability
External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.
-
Critical 9.3
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the pag…
-
Critical 9.3
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the pag…
-
Critical 9.8
In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead t…
-
Critical 9.8
In multiple locations, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote…
-
Critical 9.8
In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the c…
-
Critical 9.8
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.
-
Critical 9.0
Spring Cloud Azure Elevation of Privilege Vulnerability
Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.8
Windows iSCSI Security Feature Bypass Vulnerability
Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network.
-
Critical 9.8
Microsoft Failover Cluster Remote Code Execution Vulnerability
Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Imaging Component Remote Code Execution Vulnerability
Out-of-bounds write in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
-
Critical 9.8
Windows Hyper-V Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Shell Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows HTTP Print Provider Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows HTTP Print Provider allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows DHCP Server Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.