35,485 results · Clear filters · Feed
-
High 7.5CVE-2026-73577 Public exploit
Apache OFBiz: Unauthenticated path-suffix view authorization bypass
Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., …
-
Critical 9.8CVE-2026-83542 Public exploit
Apache OFBiz: Unauthenticated RCE via login-page widget injection
Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overridin…
-
Critical 9.1CVE-2026-117691 Public exploit
Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An a…
-
Critical 9.8CVE-2026-100109 Public exploit
Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated att…
-
Critical 9.4CVE-2026-123025 Public exploit
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-…
-
High 8.7CVE-2026-123014 Public exploit
iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker t…
-
Medium 4.7CVE-2026-122158 Public exploit
InvoiceShelf MemberService.php create access control
A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies[].i…
-
Critical 10.0CVE-2026-122051 Public exploit
Edimax BR-6208AC mp command injection
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and …
-
High 7.7CVE-2026-109518 Public exploit
APT RCE via hard link reuse
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…
-
Critical 9.8CVE-2026-122006 Public exploit
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server…
-
High 8.1CVE-2026-114550 Public exploit
libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability
libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to expl…
-
High 7.8CVE-2026-115878 Public exploit
Stanza: RCE via pickle deserialization in the lemmatizer
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trai…
-
High 8.1CVE-2026-54161 Public exploit
upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed…
-
Critical 9.8CVE-2026-44267 Public exploit
Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access ha…
-
High 8.1CVE-2026-11800 Public exploit
Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion
A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized acces…
-
High 7.5CVE-2026-115290 Public exploit
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted…
-
High 8.8CVE-2026-107441 Public exploit
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 co…
-
High 7.1CVE-2026-106991 Public exploit
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or st…
-
Critical 9.8CVE-2026-86596 Public exploit
s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?'…
-
High 7.5CVE-2026-58882 Public exploit
In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could l…
-
Critical 9.8CVE-2026-58868 Public exploit
In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This co…
-
Medium 5.4CVE-2026-120491 Public exploit
Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page
Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA se…
-
High 7.2CVE-2026-120318 Public exploit
Product Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAX
Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the…
-
Critical 9.3
Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modifi…
KEV Nov 10, 2026 -
High 8.8CVE-2026-120232 Public exploit
Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption
A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the function sub_23908 in the library shield.sys of the component Kernel Driver. Such manipulation leads to memory corruption. The attack can only be…
-
Medium 6.5CVE-2026-116296 Public exploit
Gitea archived repository release, milestone and label modification
The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release…
-
Low 3.5CVE-2026-120218 Public exploit
Typemill SvgSanitizer.php saveImage cross site scripting
A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the file system/typemill/Models/SvgSanitizer.php. Executing a manipulation can lead to cross site scripting. The attack may be performed from…
-
Critical 9.8CVE-2026-120209 Public exploit
AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoad…
-
Critical 9.8CVE-2026-116512 Public exploit
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsaniti…
-
Medium 5.4CVE-2026-120019 Public exploit
W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate…
-
High 8.1
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the s…
KEV Nov 3, 2026 -
High 7.9CVE-2026-62958 Public exploit
libriscv: Out of bounds read vuln in the ELF parser (Denial of service)
libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-hea…
-
High 8.2CVE-2026-116244 Public exploit
pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the operating-system account r…
-
Critical 9.3CVE-2026-39732 Public exploit
WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability
Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.
-
Critical 10.0CVE-2026-112816 Public exploit
Improper certificate validation in the HTTPS listener in LXD
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed v…
-
Medium 6.3CVE-2026-104623 Public exploit
Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster
A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible olde…
-
Medium 6.4CVE-2026-119712 Public exploit
PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents
PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTM…
-
High 7.2CVE-2026-118238 Public exploit
CVE-2026-118238
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, whi…
-
Critical 9.5CVE-2026-116366 Public exploit
Unauthenticated RCE vulnerability against ClickHouse Server
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
-
Critical 9.8CVE-2026-103039 Public exploit
Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unr…