Skip to content
OpenAdvisories

Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.

Tracked
410,454
Last 24h
752
Critical, 7 days
370
Known exploited
1,779
All Critical High Medium Low Exploited only Public exploit

26,236 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-82856

    @hulumi/policies before 1.3.2 OIDC Trust Policy Bypass

    @hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security …

    hulumi policies @hulumi/policies npm
  • Critical 9.8
    CVE-2026-82855

    @hulumi/policies before 1.3.2 Evidence Validation Bypass

    @hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence f…

    hulumi policies @hulumi/policies npm
  • Critical 9.8
    CVE-2026-82854

    Nodemailer before 8.0.4 SMTP Command Injection via envelope.size

    Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into …

    nodemailer nodemailer node-nodemailer nodemailer Debian Ubuntu npm
  • Critical 9.4
    CVE-2026-19410

    Google Cloud Build Comment Control Bypass via Webhook Suppression

    An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerab…

    Google Cloud Google Cloud Build
  • Critical 9.8
    CVE-2026-58574

    Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with…

    Dell PowerStore 7000T PowerStore 1200T PowerStore 3200Q
  • Critical 9.9
    CVE-2026-82616

    TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow

    A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remot…

    Toto Link NR1800X
  • Critical 9.8
    CVE-2026-38577 Public exploit

    Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.

  • Critical 9.8
    CVE-2026-79408

    An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path ar…

  • Critical 9.8
    CVE-2026-51699

    Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker…

  • Critical 9.1
    CVE-2026-51730

    Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

  • Critical 9.1
    CVE-2026-51725

    Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

  • Critical 9.8
    CVE-2026-51709

    Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

  • Critical 9.1
    CVE-2026-51690

    Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker…

  • Critical 9.8
    CVE-2026-51740

    Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attack…

  • Critical 9.1
    CVE-2026-51679

    Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att…

  • Critical 9.8
    CVE-2026-51718

    Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

  • Critical 9.8
    CVE-2026-51738

    Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

  • Critical 9.8
    CVE-2026-51728

    Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

  • Critical 9.1
    CVE-2026-51681

    Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attac…

  • Critical 9.1
    CVE-2026-51726

    Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a…

  • Critical 9.1
    CVE-2026-51701

    Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated …

  • Critical 9.1
    CVE-2026-51697

    Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacke…

  • Critical 9.1
    CVE-2026-51713

    Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a…

  • Critical 9.1
    CVE-2026-51711

    Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

  • Critical 9.1
    CVE-2026-51689

    Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attac…

  • Critical 9.8
    CVE-2026-51670

    Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att…

  • Critical 9.1
    CVE-2026-51152

    Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.build_request() i…

  • Critical 9.8
    CVE-2026-51715

    Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated …

  • Critical 9.1
    CVE-2026-51669

    Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacke…

  • Critical 9.1
    CVE-2026-51731

    Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacke…

  • Critical 9.1
    CVE-2026-51700

    Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

  • Critical 9.8
    CVE-2026-51674

    Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att…

  • Critical 9.8
    CVE-2026-51691

    Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a…

  • Critical 9.1
    CVE-2026-51720

    Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticat…

  • Critical 9.1
    CVE-2026-51710

    Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a…

  • Critical 9.8
    CVE-2026-51724

    Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att…

  • Critical 9.1
    CVE-2026-51687

    Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

  • Critical 9.1
    CVE-2026-51692

    Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

  • Critical 9.1
    CVE-2026-51672

    Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta…

  • Critical 9.1
    CVE-2026-51722

    Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…