25,538 results · Clear filters · Feed
-
Critical 10.0CVE-2026-84295 Public exploit
Improper Authentication in Progress WS_FTP Server
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
-
Critical 9.3
Out-of-bounds write when parsing AR Vendor Block requests
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comp…
-
Critical 9.2
Logon bypass (trust of attacker-controlled completed-methods list)
Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8…
-
Critical 9.8
WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.
-
Critical 9.8
WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.
-
Critical 9.8
WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.
-
Critical 9.8
WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
-
Critical 9.8
WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.
-
Critical 9.8
WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
-
Critical 9.8
WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
-
Critical 9.8
WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.
-
Critical 9.8
WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.
-
Critical 9.8
WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.
-
Critical 9.8
WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
-
Critical 9.8
WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.
-
Critical 9.8
WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.
-
Critical 9.8
WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
-
Critical 9.8
WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.
-
Critical 9.8
WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Mission <= 1.22 versions.
-
Critical 9.8
WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.
-
Critical 9.8
WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.
-
Critical 9.8
WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
-
Critical 9.8
WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
-
Critical 9.8
WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
-
Critical 10.0
WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
-
Critical 9.8
WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
-
Critical 9.8
WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.
-
Critical 9.8
WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
-
Critical 9.8
WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
-
Critical 9.8
WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
-
Critical 9.8CVE-2026-93680 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.
-
Critical 9.8
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
-
Critical 9.9CVE-2026-107327 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.
-
Critical 9.9CVE-2026-107328 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.
-
Critical 9.9CVE-2026-107329 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
-
Critical 9.8CVE-2026-110186 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
-
Critical 9.8
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitr…
-
Critical 9.3
WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126.
-
Critical 9.8
Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with thi…
-
Critical 9.8
Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash
A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.