35,505 results · Clear filters · Feed
-
Medium 5.9CVE-2026-66754 Public exploit
Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding
Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decod…
-
Low 3.7CVE-2026-66753 Public exploit
tiny-http 0.12.0 HTTP Response Splitting via Header Injection
tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into HTTP header values on both request and response sides due to insufficient validation in header pars…
-
Medium 5.4CVE-2026-66752 Public exploit
tiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handling
tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditio…
-
Medium 5.4CVE-2026-66751 Public exploit
Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room
Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room …
-
Medium 4.3CVE-2026-66750 Public exploit
Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in t…
-
Medium 6.5CVE-2026-66749 Public exploit
Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup
Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted…
-
High 8.8CVE-2026-66748 Public exploit
Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field
Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom fi…
-
High 8.7CVE-2026-59248 Public exploit
Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS
Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder …
-
Critical 9.8CVE-2026-43805 Public exploit
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Seq…
-
High 7.1CVE-2026-43813 Public exploit
A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, mac…
-
High 7.8CVE-2026-39875 Public exploit
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sono…
-
High 7.8CVE-2026-64747 Public exploit
A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, i…
-
High 7.1CVE-2026-64725 Public exploit
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS…
-
Critical 9.8CVE-2026-43682 Public exploit
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8…
-
High 7.8CVE-2026-28912 Public exploit
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.…
-
High 8.8CVE-2026-65616 Public exploit
Potential privilege escalation to JFrog administrator privileges
Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.
-
High 8.1
Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
KEV Sep 11, 2026 -
Critical 9.8CVE-2026-55579 Public exploit
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on …
-
Critical 9.9
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shel…
-
High 7.5CVE-2026-66731 Public exploit
facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS
facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by sending a negative chunk size value. Attackers can send a single POST …
-
High 7.5CVE-2026-66730 Public exploit
facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser
facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial clos…
-
High 7.5CVE-2026-66729 Public exploit
facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser
facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attac…
-
Critical 9.8
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polli…
KEV Aug 5, 2026 -
Critical 9.3CVE-2026-59550 Public exploit
WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability
Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.
-
Critical 9.8
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying craft…
-
Medium 6.3CVE-2026-14856 Public exploit
Stored Cross-Site Scripting (XSS) in TastyIgniter Media Manager
A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious S…
-
Low 1.8CVE-2026-40000 Public exploit
Path Traversal Vulnerability in ZTE Blade A75 5G
The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fileprovide…
-
High 7.0CVE-2026-65893 Public exploit
Arbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP Camera
This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with physical access could exploit this vulnerability by placing arbitrary code on removable media and triggering their execution throu…
-
High 7.8CVE-2026-64531 Public exploit
net: openvswitch: reject oversized nested action attrs
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbeh…
-
High 8.2CVE-2026-9830 Public exploit
BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug
The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read cus…
-
Critical 9.8CVE-2026-13714 Public exploit
Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shi…
-
High 8.1CVE-2026-13152 Public exploit
Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation
The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user…
-
Critical 9.1CVE-2025-50455 Public exploit
SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyA…
-
Medium 4.9CVE-2026-51564 Public exploit
An issue in the redirect parameter in Milk admin <=0.9.8 allows remote attackers to redirect users to arbitrary externa…
-
Medium 6.1CVE-2026-51565 Public exploit
Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attacke…
-
High 7.5CVE-2026-63720 Public exploit
datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free…
-
Unscored —CVE-2026-64507 Public exploit
x86/bugs: Enable IBPB flush on BPF JIT allocation
In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip…
-
High 7.8CVE-2026-64468 Public exploit
binder: fix UAF in binder_free_transaction()
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the t->to_proc is read under the t->lock. However, once the t->lock is dropped, the to_proc can die in parallel. Thi…
-
High 8.1
WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents ha…
-
High 8.1CVE-2026-66374 Public exploit
Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) rec…