Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,438
- Last 24h
- 750
- Critical, 7 days
- 377
- Known exploited
- 1,779
26,236 results · Clear filters · Feed
-
Critical 9.3
An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentic…
-
Critical 9.8
MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor
MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor. parse_assertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST->new …
-
Critical 9.8
Negotiate ambient user conn reuse
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated con…
-
Critical 9.1
HTTP/2 server push UAF
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
-
Critical 9.8
Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step
Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the …
-
Critical 9.9
Tenda HG10 Boa formgponConf os command injection
A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remote exploitation of the …
-
Critical 9.8
Tenda HG10 formURL buffer overflow
A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. Th…
-
Critical 9.8CVE-2026-75816 Public exploit
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionP…
-
Critical 9.8
MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers t…
-
Critical 10.0
pre-authentication remote code execution
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
KEV Sep 8, 2026 -
Critical 9.1
Tenda CP3 Redirect.cpp SetRedirectEnable privileges management
A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible.
-
Critical 10.0
Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection
A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may be launched r…
-
Critical 9.1
Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injection
A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The attack may be in…
-
Critical 9.1
Tenda CP3 NetCheckPing.cpp os command injection
A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface_name/host causes os command injection. The attack can be initiated remotely.
-
Critical 9.1
Tenda CP3 Kylin system.c SystemAsh os command injection
A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to…
-
Critical 9.2
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticate…
KEV Sep 10, 2026 -
Critical 9.2
SSH user impersonation possible in Mikrotik RouterOS
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker …
-
Critical 9.1
WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter
WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. At…
-
Critical 9.8
WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previousl…
-
Critical 9.8
Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route
Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /screenshot-logi…
-
Critical 9.8CVE-2026-10196 Public exploit
Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form_submission' f…
-
Critical 9.8
AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server
AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash comman…
-
Critical 9.8
Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control
Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to …
-
Critical 9.8
Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenti…
-
Critical 9.1
Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator
The `/v1/agents/import` endpoint and `AgentRegistry.import_agent()` in local-operator versions before 0.47.5 trust the `id` field inside `agent.yml` of an uploaded agent profile archive when constructing the destination directory. A crafted `id` containing di…
-
Critical 9.8
SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication
The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin bef…
-
Critical 9.8CVE-2026-13447 Public exploit
MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which d…
-
Critical 9.8
Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log
The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debu…
-
Critical 9.4
YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.
-
Critical 9.1
YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorizati…
-
Critical 9.6
IXON VPN Client CRLF Injection
Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, wit…
-
Critical 9.1
A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing fun…
-
Critical 9.1
A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allo…
-
Critical 9.1
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the Soni…
-
Critical 9.8
IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed
IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to …
-
Critical 9.6
IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC obje…
-
Critical 9.8CVE-2026-44402 Public exploit
Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid cre…
-
Critical 9.4
FastChat Unauthenticated Worker Registration SSRF and Model Spoofing
FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under vict…
-
Critical 9.8
SadTalker OS Command Injection via Audio Filename
SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to br…
-
Critical 9.8CVE-2026-85688 Scanner template
TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer
TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or …