35,505 results · Clear filters · Feed
-
Critical 9.8CVE-2026-61515 Public exploit
Puwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShell
Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on…
-
Critical 9.8CVE-2026-64564 Public exploit
sctp: don't free the ASCONF's own transport in DEL-IP processing
In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, se…
-
High 7.8CVE-2026-64563 Public exploit
rhashtable: clear stale iter->p on table restart
In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two restart paths when resuming a walk. When iter->walker.tbl is valid, it re-validates iter->p against the …
-
High 8.8CVE-2026-64561 Public exploit
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the…
-
Medium 6.5CVE-2026-8508 Public exploit
An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions throu…
-
High 7.2CVE-2026-6837 Public exploit
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware version…
-
Medium 5.3CVE-2026-58041 Public exploit
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to con…
-
Medium 6.2CVE-2026-58045 Public exploit
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:…
-
Medium 5.9CVE-2026-58042 Public exploit
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Re…
-
Low 3.7CVE-2026-58044 Public exploit
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…
-
High 7.5CVE-2026-56846 Public exploit
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memo…
-
Medium 6.3CVE-2026-69243 Public exploit
AIOHTTP: HTTP request smuggling via WebSocket upgrade
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to exec…
-
High 7.2CVE-2026-67599 Public exploit
ClearOS 7.9 OS Command Injection via Log Viewer filter parameter
ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell …
-
High 7.4CVE-2026-67598 Public exploit
Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php
Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, a…
-
High 7.0CVE-2026-18718 Public exploit
Ghidra Swift Demangler Analyzer Arbitrary Code Execution via Project State
Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-…
-
Critical 9.8
Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpR…
-
Medium 6.2CVE-2026-15430 Public exploit
CVE-2026-15430
Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected l…
-
Critical 10.0
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by…
-
Critical 10.0CVE-2026-69083 Public exploit
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via u…
-
Critical 9.3CVE-2026-18574 Public exploit
Authentication Bypass in Check Point Security Management Server
An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the S…
-
Medium 6.5CVE-2026-63563 Public exploit
Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication…
-
Medium 6.9CVE-2026-8794 Public exploit
PaperCut NG/MF: User enumeration via timing attack
PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes …
-
Medium 6.9CVE-2026-8793 Public exploit
PaperCut NG/MF: Insufficient brute-force protection
PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering acc…
-
Critical 9.3CVE-2026-58062 Public exploit
Stapled OCSP response accepted without binding to the checked certificate
In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) a…
-
Medium 6.1CVE-2026-38444 Public exploit
osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value i…
-
Critical 9.8CVE-2026-52102 Public exploit
An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to ex…
-
High 8.2
Incomplete patch leads to administrative account takeover
An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1
KEV Aug 3, 2026 -
Critical 9.8CVE-2026-65321 Public exploit
PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS
PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_h…
-
Medium 6.5CVE-2026-68582 Public exploit
Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path witho…
-
High 7.5CVE-2026-16540 Public exploit
Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint
The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on…
-
Medium 6.5CVE-2026-9335 Public exploit
Improper Handling of HDF5 ExternalLinks in keras-team/keras
A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe…
-
High 8.2
Unauthenticated administrative account takeover
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.
KEV Aug 4, 2026 -
High 7.2CVE-2026-67340 Public exploit
ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a Jav…
-
Critical 9.8CVE-2026-15964 Public exploit
Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change
The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function — registered on `wp_ajax_nopriv_ssoprocess_a…
-
Medium 5.3CVE-2026-14840 Public exploit
YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and…
-
High 7.2CVE-2026-13157 Public exploit
Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload
The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administ…
-
High 7.2CVE-2026-13158 Public exploit
Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload
The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site admi…
-
Critical 9.8CVE-2026-68771 Public exploit
ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can…
-
Critical 9.4CVE-2026-58048 Public exploit
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.
-
High 7.5CVE-2026-52856 Public exploit
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.