Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,469
- Last 24h
- 754
- Critical, 7 days
- 368
- Known exploited
- 1,779
26,236 results · Clear filters · Feed
-
Critical 9.8
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi En…
-
Critical 9.0
A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vuln…
-
Critical 10.0
A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability f…
-
Critical 9.0
A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of C…
-
Critical 9.8
Grav before 1.0.18 Authentication Bypass via Scoped API Key
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than ve…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerabilit…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerabilit…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerabilit…
-
Critical 9.0
A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug…
-
Critical 9.8
TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter
TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerabilit…
-
Critical 9.1CVE-2026-77542 Public exploit
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabili…
-
Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability…
-
Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabili…
-
Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabili…
-
Critical 10.0
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Pr…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability …
-
Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabili…
-
Critical 9.8
OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings
The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system compromise from local or remote (if the daemon is running as root) or a full account take…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability …
-
Critical 9.1
Arbitrary file overwrite and deletion local and remote in OpenRGB
Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3.
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerabilit…
-
Critical 9.8
Thinking Software Technology｜EFence - Arbitrary File Upload
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
-
Critical 9.8CVE-2026-18431 Public exploit
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input val…
-
Critical 9.3
Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software
Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data a…
-
Critical 9.8
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible f…
-
Critical 9.8
Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, pas…
-
Critical 9.8
An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 allows atta…
-
Critical 9.8
Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. Thi…
-
Critical 9.1
An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the RTL and netlist can lead to unexpected…
-
Critical 9.8
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_…
-
Critical 9.8
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support …
-
Critical 9.8
The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql par…
-
Critical 9.8
The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechani…
-
Critical 9.8
Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update…
-
Critical 9.1
The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 i…
-
Critical 9.8
DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' para…
-
Critical 9.1
Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().
-
Critical 9.8
The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnera…
-
Critical 9.8
In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an ar…