35,485 results · Clear filters · Feed
-
Critical 9.3CVE-2026-102428 Public exploit
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.
-
High 8.5CVE-2026-63277 Public exploit
RCE via calcext:data-mappings, sql provider and jdbc connector
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that l…
-
High 7.5CVE-2026-105314 Public exploit
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload cal…
-
Medium 6.5CVE-2026-105306 Public exploit
Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration
A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker wi…
-
High 7.4CVE-2026-105221 Public exploit
Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify G…
-
Critical 9.3CVE-2026-103355 Public exploit
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue …
-
Medium 5.3CVE-2026-97332 Public exploit
User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)
The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated …
-
Critical 10.0
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os comma…
KEV Oct 14, 2026 -
High 7.3
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper auth…
KEV Oct 14, 2026 -
High 8.8CVE-2026-96451 Public exploit
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
-
Critical 9.8CVE-2026-105105 Public exploit
Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltration
CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject space…
-
Critical 9.1CVE-2026-92084 Public exploit
Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does n…
-
High 7.5CVE-2026-101160 Public exploit
WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating
The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fai…
-
High 7.5CVE-2026-101161 Public exploit
WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode
The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when th…
-
Medium 6.4CVE-2026-101162 Public exploit
WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings
The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews…
-
Critical 9.9CVE-2026-105080 Public exploit
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-conv…
-
Medium 5.3CVE-2026-105030 Public exploit
Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API
Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard API handlers lacking visibility filters. Attackers can supply a known or guessed …
-
Critical 9.8CVE-2026-84411 Public exploit
MikroTik RouterOS Integer Underflow
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution …
-
High 7.1CVE-2026-104991 Public exploit
Phproject < 1.8.7 Missing Authorization via Issues REST API
Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments, single_comments_post) that allows authenticated API key holders to bypass the security.restrict_access confidentia…
-
High 8.8CVE-2026-96940 Public exploit
Microsoft Exchange Server Elevation of Privilege Vulnerability
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
Critical 10.0CVE-2026-103956 Public exploit
Missing authentication for critical function in Loom for AWS
Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration crede…
-
High 8.8CVE-2026-59265 Public exploit
Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover
A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user. This issue is expected to be fixed in version 4.1.17, which …
-
High 8.8CVE-2026-104851 Public exploit
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Templa…
-
Critical 9.5CVE-2026-104849 Public exploit
Tinypool: Prototype Pollution Gadget to RCE in run() options
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace th…
-
Critical 9.1CVE-2026-103648 Public exploit
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader
Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.
-
Critical 9.9
Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user wi…
-
Critical 9.8CVE-2026-94541 Public exploit
WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes i…
-
Critical 9.8CVE-2026-19660 Public exploit
Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter
The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to the `init` action, accepts a base64-encoded `paypal_param` GET parameter with no IPN…
-
Critical 9.8CVE-2026-14378 Public exploit
DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow
The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the `revert_switch` handler trusting the attacker-controlled `original_user_id` coo…
-
Medium 5.9CVE-2026-104356 Public exploit
PictShare < 3.7.1 Predictable Delete Code via rand()
PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG st…
-
High 8.2CVE-2026-104051 Public exploit
PictShare < 3.7.1 Sensitive Information Disclosure via info API
PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and uploader metadata by calling the API::info() endpoint which returns the complete raw metadata object without a f…
-
Critical 9.8
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8…
KEV Oct 1, 2026 -
High 7.4CVE-2026-15911 Public exploit
Confluent Kafka Python Improper TLS Certificate Validation
Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.
-
Critical 9.3CVE-2026-103922 Public exploit
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates …
-
High 7.5CVE-2026-63686 Public exploit
Apache HTTP Server: mod_xml2enc crash on charset conversion failure
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds…
-
High 7.5CVE-2026-63292 Public exploit
Apache HTTP Server: mod_vhost_alias stack overflow
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header ex…
-
Critical 9.3CVE-2026-13043 Public exploit
WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access
A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to …
-
Medium 6.3CVE-2026-103690 Public exploit
itsourcecode Leave Management System controller.php sql injection
A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from r…
-
Critical 9.8CVE-2026-103752 Public exploit
WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.
-
High 7.6CVE-2026-62059 Public exploit
WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1.