25,525 results · Clear filters · Feed
-
Critical 10.0CVE-2026-76964 Public exploit
Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)
SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected fu…
-
Critical 9.8
INDOTALENT WHMS before 10.20261109 Hard-Coded JWT Signing Key Authentication Bypass
INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tok…
-
Critical 9.8
INDOTALENT WHMS before 10.20261109 Default Administrator Credentials via UserAdminSeeder
INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates admin@root.com with password 123456. Attackers can log in with these credentials…
-
Critical 9.8
Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret
Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrar…
-
Critical 9.8
SQL injection leading to privilege escalation
An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search, allowing stacked query execution and enabling escalation to an administrator. Note that this only affects MySQL/MariaDB. Impact * SQL injection…
-
Critical 9.8
Mongoose: sanitizeFilter not applied on countDocuments
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application th…
-
Critical 9.4
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar._safe_extractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special ta…
-
Critical 9.8CVE-2026-123807 Public exploit
Signal K Server: Unauthenticated path traversal in resources-provider v2 API leads to JWT secret disclosure, admin impersonation and remote code execution
Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId acc…
-
Critical 9.3CVE-2026-56712 Public exploit
Replicate Cog through 0.23.1 SSRF via cog.File and cog.Path URL Inputs
Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Cog process to make server-side HTTP requests by submitting prediction inputs with attacker-controlled URLs that are not validated against the…
-
Critical 9.1
Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys
Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again w…
-
Critical 9.8CVE-2026-123270 Scanner template
CVE-2026-123270
Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (RCE). In streams mode, the management HTTP API is exposed on `0.0.0.0:4195`, but authentication is disabled by default a…
-
Critical 9.9
SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications
SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOr…
-
Critical 9.8
Tasmota 16.0.0 Heap Out-of-Bounds Write via Device Groups UDP
Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages o…
-
Critical 9.3
Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remot…
-
Critical 9.1
CVE-2026-121688
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the sa…
-
Critical 9.8
CVE-2026-121687
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication. 1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join…
-
Critical 9.8
CVE-2026-121686
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemet…
-
Critical 9.8
CVE-2026-121685
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials…
-
Critical 10.0
Remote Code Execution via Unrestricted File Upload in WidzialniCMS
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to …
-
Critical 10.0CVE-2026-110468 Public exploit
Remote Code Execution via Unrestricted File Upload in WidzialniCMS
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload ar…
-
Critical 9.8CVE-2026-124079 Public exploit
rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 RCE via Unauthenticated Redis Queue Poisoning
rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel H…
-
Critical 9.2
AIS update mechanism executes unverified code
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
-
Critical 9.1CVE-2026-123753 Public exploit
Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints
Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault,…
-
Critical 10.0CVE-2026-115252 Public exploit
Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option
The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users …
-
Critical 9.1
Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documents
Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the docume…
-
Critical 9.1
Apache Allura: OAuth1 rebinding
OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: through 1.22.0. Users are recommended to upgrade to version 1.22.1, which fixes the issue.
-
Critical 9.8CVE-2026-68982 Public exploit
Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation
Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitra…
-
Critical 9.1
Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier
The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, …
-
Critical 9.9
Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add_expmac os command injection
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument…
-
Critical 9.5
[Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string-injected webhook body when GITHUB_WEBHOOK_SECRET is unset
The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely…
-
Critical 10.0
Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument ex…
-
Critical 9.8
Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authentication
A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attac…
-
Critical 9.8
WP Duplicate <= 1.1.11 - Unauthenticated Arbitrary File Upload via Authentication Bypass
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achi…
-
Critical 9.8
EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication Bypass
The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticat…
-
Critical 9.8
Grand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Code
The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the s…
-
Critical 9.3
Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and V…
-
Critical 9.3
Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through …
-
Critical 9.8
D-Link DIR-878 HNAP prog.cgi GetCAPTCHAsetting heap-based overflow
A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be ini…
-
Critical 9.1
WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.
-
Critical 9.8
Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the…