25,519 results · Clear filters · Feed
-
Critical 9.6
Use after free in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitr…
-
Critical 9.6
Buffer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code out…
-
Critical 9.6
Use after free in Passwords in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social enginee…
-
Critical 9.6
Link following in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engine…
-
Critical 9.6
Use after free in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbit…
-
Critical 9.6
Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary …
-
Critical 9.8
Portabase: Unauthenticated path traversal in TUS webhook overwrites AES-256-GCM master key
Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler (app/api/tus/hooks/route.ts) allo…
-
Critical 9.1
A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAn…
-
Critical 9.8
blueprintUE Self-Hosted Edition before 4.3.7 Empty MariaDB Root Password via Docker Compose
blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker h…
-
Critical 9.8
NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin
NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public supe…
-
Critical 9.3
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiA…
-
Critical 9.0
A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, Fo…
-
Critical 9.4
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiM…
-
Critical 9.0
A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0…
-
Critical 9.6
A numeric truncation error vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS …
-
Critical 9.3
A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 throug…
-
Critical 9.1
A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 th…
-
Critical 9.8CVE-2026-126170 Public exploit
A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.…
-
Critical 9.4
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiM…
-
Critical 9.8CVE-2026-126147 Public exploit
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.…
-
Critical 9.1
A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7…
-
Critical 9.1
A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, Forti…
-
Critical 9.1
A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, Forti…
-
Critical 9.1
A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 th…
-
Critical 9.8CVE-2026-126148 Public exploit
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
Critical 9.6
Fider: Cross-Tenant Authentication Bypass via Missing tenant_id Filter in getVerificationByKey
Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This comp…
-
Critical 9.8
OpsTree REMS through 1.0.0 Authentication Bypass via is_local_auth Flag
OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin acc…
-
Critical 9.9CVE-2026-110697 Public exploit
Quay: quay: sql like wildcard injection in robot listing leaks cross-tenant robot tokens
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and…
-
Critical 9.0
Critical Remote Code Execution (RCE) vulnerability reported in Windchill
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
-
Critical 9.8
Quay: red hat quay: unauthenticated registry signing-key takeover via service key rotation
A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens …
-
Critical 9.1
Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay El…
-
Critical 9.1CVE-2026-126537 Public exploit
Ninja Forms - File Uploads <= 3.3.36 - Unauthenticated Arbitrary File Deletion via 'files[].data.file_path' Parameter via 'extra.saveProgress'
The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36. The flaw spans NF_FU_Fields_Upload::process() in includes…
-
Critical 10.0CVE-2026-78287 Public exploit
WordPress STAGGS plugin <= 3.3.0 - Remote Code Execution (RCE) vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in Staggs STAGGS staggs allows Remote Code Inclusion.This issue affects STAGGS: from n/a through 3.3.0.
-
Critical 9.4
Path traversal in host label synchronization allows code execution on the central site from a remote site
Path traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an attacker in control of a remote site in a distributed monitoring setup to write arbitrary files on the central site and thereby execute code …
-
Critical 9.4
Arbitrary file write and code execution via crafted Synthetic Monitoring agent data
Path traversal in the Synthetic Monitoring "Robotmk" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls the agent output of a monitored host's check output for a host to inject a crafted robot output to define the co…
-
Critical 9.4
Arbitrary file write and code execution via excluded node roles in Kubernetes special agent
Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user via crafted node roles in th…
-
Critical 9.3CVE-2026-112174 Public exploit
Privilege escalation in Enter’s Iperius Backup
Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistent…
-
Critical 9.8
Security For WooCommerce <= 1.0.16 - Unauthenticated Privilege Escalation via REST API Options Update and User Token Disclosure
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including admini…
-
Critical 9.8
Askany < 2.2.0 - Unauthenticated Arbitrary File Upload
The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when vis…
-
Critical 9.6
Somatic Framework <= 1.8.14 - Subscriber+ Arbitrary File Deletion
The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can l…