Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,438
- Last 24h
- 747
- Critical, 7 days
- 375
- Known exploited
- 1,779
26,236 results · Clear filters · Feed
-
Critical 9.8
MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders
MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft malicious encoded strings with mismatched declared and actual field …
-
Critical 9.8
MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts
MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction() where dimension, piece, and degree counts from encoded BHV_IPF payloads are used as allocation sizes and loop bounds without validation. Attackers can supply crafted pay…
-
Critical 9.1
MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment
MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehic…
-
Critical 9.1
MOOS-IvP through 24.8.1 uFldShoreBroker Bridge Route Injection via Unverified Node Ping
MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.
-
Critical 9.8
MOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfiguration
MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARE_CMD messages with cmd=output or cmd=input parameters to…
-
Critical 9.1
MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing
MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input ro…
-
Critical 9.8
MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write
MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server …
-
Critical 9.8
MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS
MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY_MOOS messages containing backticks or command substitution syntax to execut…
-
Critical 9.8
MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names
MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted r…
-
Critical 9.8
MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAR
MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbi…
-
Critical 9.1
D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection
A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file_sharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack c…
-
Critical 9.9
D-Link DNS-340L CGI dropbox.cgi os command injection
A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback_url/sync_interval results in os comman…
-
Critical 9.1
D-Link DNS-340L Add-On Center addon_center.cgi os command injection
A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of the component Add-On Center. Such manipulation of the argument f_name/f_url/f_flag/f_login_user lead…
-
Critical 10.0
MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip
MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes…
-
Critical 9.6
Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote a…
-
Critical 9.6
Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code …
-
Critical 9.6
Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute…
-
Critical 9.1
Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access…
-
Critical 9.1
python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when a…
-
Critical 9.8
Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access…
-
Critical 9.8
R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint
R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly …
-
Critical 9.1CVE-2026-58400 Exploited
GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling J…
-
Critical 9.8
WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.
-
Critical 9.8
WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.
-
Critical 9.3
WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability
Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.
-
Critical 9.3
WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.
-
Critical 9.8CVE-2026-84753 Public exploit
WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.
-
Critical 9.8
WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
-
Critical 9.3
Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS
Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke …
-
Critical 9.8
CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessio…
-
Critical 9.5
MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials
MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate…
-
Critical 9.8
Tenda HG10 Boa Web Server formLogin buffer overflow
A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be …
-
Critical 9.5
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication poli…
-
Critical 9.3
Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0
Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors.
-
Critical 9.5
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `J2StoreControllerApps`'s `appTask` delegation path instantiates app-plugin controllers with no ACL check anywhe…
-
Critical 9.8
WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash
WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can …
-
Critical 9.2
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed w…
-
Critical 9.4
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting…
-
Critical 9.9
TOTOLINK CP450 cstecgi.cgi buffer overflow
A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument topicurl results in buffer overflow. Remote exploitation of the attack is possible.
-
Critical 9.8
Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.