2,895 results · Clear filters · Feed
-
Critical 9.8CVE-2026-72422 Public exploit
ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE conn->preauth_info is shared connection state (struct preauth_integrity_info, kmalloc-96) that is allocated and fr…
-
Critical 10.0CVE-2026-73678 Public exploit
MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()
MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ e…
-
Critical 9.9CVE-2026-19681 Public exploit
Command Injection
An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying op…
-
Critical 9.9CVE-2026-19626 Public exploit
Remote Code Execution
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-s…
-
Critical 9.3CVE-2026-73665 Public exploit
FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to…
-
Critical 9.3CVE-2026-73663 Public exploit
FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound param…
-
Critical 9.3CVE-2026-28001 Public exploit
WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
-
Critical 9.8CVE-2026-73519 Public exploit
WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret
WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack…
-
Critical 9.4CVE-2026-73296 Public exploit
Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP s…
-
Critical 9.8CVE-2026-18366 Public exploit
Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, esc…
-
Critical 9.8
DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header
DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoi…
-
Critical 9.1
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user in…
KEV Sep 24, 2026 -
Critical 9.8CVE-2026-62878 Public exploit
Windows DNS Server Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.
-
Critical 10.0CVE-2026-58115 Public exploit
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running I…
-
Critical 9.8CVE-2026-72550 Public exploit
Friendica Friendica - SQL Injection
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a …
-
Critical 10.0CVE-2026-58231 Public exploit
Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise …
-
Critical 9.1CVE-2026-19516 Public exploit
CVE-2026-19516 CVE Record
A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configur…
-
Critical 9.9
Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update requ…
-
Critical 10.0
Metabase SQL injection via password reset endpoint
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
KEV Aug 11, 2026 -
Critical 9.8CVE-2026-28672 Public exploit
Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8.
-
Critical 9.8
Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload
The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to up…
-
Critical 9.8CVE-2026-15038 Public exploit
InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite
The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their o…
-
Critical 9.0CVE-2026-71851 Public exploit
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), in…
-
Critical 9.8CVE-2026-19264 Public exploit
Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover
Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route req…
-
Critical 9.8
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macO…
KEV Aug 18, 2026 -
Critical 10.0
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized acce…
KEV Sep 24, 2026 -
Critical 9.8CVE-2026-67689 Public exploit
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `o…
-
Critical 9.9CVE-2026-20303 Public exploit
Cisco Catalyst SD-WAN Security Hardening Release - Input Validation Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple inter…
-
Critical 9.8CVE-2026-66747 Public exploit
ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root un…
-
Critical 9.6CVE-2026-70376 Public exploit
Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.
-
Critical 10.0CVE-2026-64633 Public exploit
A vulnerability allowing remote unauthenticated code execution on the agent host.
-
Critical 9.5CVE-2026-58073 Public exploit
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent a…
-
Critical 9.4CVE-2026-69254 Public exploit
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.…
-
Critical 9.8CVE-2026-69098 Public exploit
kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization
kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can…
-
Critical 9.8CVE-2026-61515 Public exploit
Puwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShell
Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on…
-
Critical 9.8CVE-2026-64564 Public exploit
sctp: don't free the ASCONF's own transport in DEL-IP processing
In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, se…
-
Critical 9.8
Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpR…
-
Critical 10.0
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by…
-
Critical 10.0CVE-2026-69083 Public exploit
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via u…
-
Critical 9.3CVE-2026-18574 Public exploit
Authentication Bypass in Check Point Security Management Server
An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the S…