25,541 results · Clear filters · Feed
-
Critical 10.0
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vul…
-
Critical 10.0
Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Functio…
-
Critical 9.1
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the int…
-
Critical 9.1
Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code parameter and passes it to `adb shell input …
-
Critical 9.8
Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove_all and /api…
-
Critical 9.6
OS command injection in Progress Software Autonomous REST Connector GenAI Agents
An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execu…
-
Critical 9.8
Mitigation bypass in the File Handling component
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.
-
Critical 9.8
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithm…
-
Critical 9.8
RDMA/siw: Bound fragmented header copies by the remaining length
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most …
-
Critical 9.3
WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability
Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
-
Critical 9.3
WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability
Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.
-
Critical 9.3
WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability
Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.
-
Critical 9.8
WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.
-
Critical 9.3
WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in brewlabs SendPress Newsletters sendpress allows Blind SQL Injection.This issue affects SendPress Newsletters: from n/a through 1.26.1.20.
-
Critical 9.3
WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1.
-
Critical 10.0
WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
-
Critical 10.0
WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.
-
Critical 9.3
WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability
Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.
-
Critical 9.8
WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.
-
Critical 9.9
WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability
Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.
-
Critical 9.9
WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
-
Critical 9.9
WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.
-
Critical 9.8
WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.
-
Critical 9.3
WordPress Booknetic plugin < 5.10.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Booknetic Booknetic booknetic allows Blind SQL Injection.This issue affects Booknetic: from n/a before 5.10.3.
-
Critical 10.0
WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
-
Critical 9.9
WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability
Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.
-
Critical 9.3
WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BookingWP WooCommerce Appointments woocommerce-appointments allows Blind SQL Injection.This issue affects WooCommerce Appointments: from n/a through 5.3.2.
-
Critical 9.3
Information Disclosure Vulnerability in Schmooze dating mobile Application
This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and …
-
Critical 9.9
Tenda AC5 Wifi setWifi stack-based overflow
A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It …
-
Critical 9.8
Missing authentication for critical function in the aas-edge-client REST API
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
-
Critical 10.0CVE-2026-105484 Public exploit
TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name …
-
Critical 9.8
Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network)…
-
Critical 9.1
Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveN…
-
Critical 9.8
CVE-2026-82989
There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints
-
Critical 9.6
Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL
Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plai…
-
Critical 9.3
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Sof…
KEV Oct 15, 2026 -
Critical 9.3
openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.
-
Critical 9.9CVE-2026-105740 Scanner template
Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command …
-
Critical 9.9CVE-2026-105697 Public exploit
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c…
-
Critical 9.9
Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through child_process.exec. A user who can edi…