35,505 results · Clear filters · Feed
-
Medium 6.5CVE-2026-27145 Public exploit
Inefficient candidate hostname parsing in crypto/x509
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…
-
Low 2.1CVE-2026-48598 Public exploit
CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection
Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values. Tesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{…
-
Critical 9.8CVE-2026-5076 Public exploit
ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 7.3.1. The plugin stores a plaintext copy of the password reset key in the `arm_reset_password_key` user meta field when a us…
-
Medium 4.3CVE-2026-10702 Public exploit
JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3.
-
Medium 6.3CVE-2026-49943 Public exploit
CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask match…
-
Critical 9.8CVE-2026-47117 Public exploit
OpenMed < 1.5.2 Remote Code Execution via PII Model Loading
OpenMed before 1.5.2 contains a remote code execution vulnerability in the PII privacy-filter model loading path. The privacy-filter dispatcher used broad substring matching on the user-supplied model_name parameter, allowing a value such as attacker/foo-priv…
-
Medium 6.3CVE-2026-7299 Public exploit
CVE-2026-7299
Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code ex…
-
Critical 9.8CVE-2026-8206 Public exploit
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is u…
-
High 7.1CVE-2026-24090 Public exploit
Missing Authentication for Critical Function in HLOS
Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.
-
High 8.2CVE-2026-24088 Public exploit
Missing Authentication for Critical Function in Boot
Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader.
-
High 7.8CVE-2026-0091 Public exploit
In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell …
-
High 7.8CVE-2026-0075 Public exploit
In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead …
-
High 7.8CVE-2026-0009 Public exploit
In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escala…
-
High 8.4
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to…
KEV Jun 2, 2026 -
High 7.3CVE-2026-10290 Public exploit
code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection
A weakness has been identified in code-projects Hotel and Tourism Reservation System 1.0. The affected element is an unknown function of the file tour.php of the component GET Parameter Handler. Executing a manipulation of the argument tour can lead to sql in…
-
Medium 4.3CVE-2026-10289 Public exploit
code-projects Hotel and Tourism Reservation System tour.php cross site scripting
A security flaw has been discovered in code-projects Hotel and Tourism Reservation System 1.0. Impacted is an unknown function of the file /ht/tour.php. Performing a manipulation of the argument name /email /people /number results in cross site scripting. The…
-
High 7.3CVE-2026-10288 Public exploit
code-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication
A vulnerability was identified in code-projects Hotel and Tourism Reservation System 1.0. This issue affects the function password_verify of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Password leads to improper a…
-
Medium 4.3CVE-2026-45729 Public exploit
ThorVG: Null pointer dereference in SVG loader causes crash via 6-byte malformed input
Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to version 1.0.5, a null pointer dereference in SvgLoader::run() allows any caller that passes untrusted SVG data to Picture::load() to crash the process with a 6-byte payload. …
-
High 7.5CVE-2024-52011 Public exploit
launch-editor vulnerable to command injection via the crafted request on Windows
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a …
-
High 8.1CVE-2026-45156 Public exploit
Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This …
-
High 7.1CVE-2026-46243 Public exploit
smb: client: reject userspace cifs.spnego descriptions
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as ke…
-
Critical 10.0CVE-2026-45131 Public exploit
CloudPirates Open Source Helm Charts: GitHub Actions pull_request_target workflow allows secret exfiltration via fork pull requests
CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (pull-request.yaml) executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets includin…
-
Critical 10.0CVE-2026-45132 Public exploit
CloudPirates Open Source Helm Charts: GitHub Actions workflow leaks PAT and SSH signing key via unsafe credential handling
CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (generate-schema.yaml) exposes sensitive credentials (Personal Access Token and SSH signing key) to fork-controlled code due to unsafe chec…
-
Critical 9.2
Poly Voice – Possible Remote Control of Certain Poly Devices
In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.
-
Critical 9.6CVE-2026-48866 Public exploit
WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal. This issue affects Gravity Forms: from n/a through 2.10.0.1.
-
High 7.3CVE-2026-10243 Public exploit
code-projects Smart Parking System Admin Endpoint missing authentication
A security vulnerability has been detected in code-projects Smart Parking System 1.0. Affected is an unknown function of the component Admin Endpoint. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit…
-
High 8.1
Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials insta…
-
High 8.1CVE-2026-42588 Public exploit
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console…
-
Critical 9.1CVE-2026-48188 Public exploit
SQL Injection via MySQL Quote Method
An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue only affects the system if the MySQL/MariaDB server is config…
-
Medium 6.5CVE-2026-48208 Public exploit
Denial-of-Service via SVG Rendering in Ticket
An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when…
-
Critical 9.8CVE-2026-10187 Public exploit
Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow
A vulnerability was detected in Totolink N300RH 6.1c.1353_B20190305. Affected by this issue is the function setWiFiBasicConfig of the file wireless.so of the component Web Management Interface. Performing a manipulation of the argument KeyStr results in stack…
-
Medium 6.3CVE-2026-10170 Public exploit
code-projects Visitor Management System phone_0.php sql injection
A flaw has been found in code-projects Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /vms/php/phone_0.php. This manipulation of the argument phone causes sql injection. The attack may be initiated remotely. Th…
-
High 7.8CVE-2026-46242 Public exploit
eventpoll: fix ep_remove struct eventpoll / struct file UAF
In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_…
-
High 8.8CVE-2026-7465 Public exploit
Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access an…
-
High 7.5CVE-2026-7459 Public exploit
Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint
The Simple History – Track, Log, and Audit WordPress Changes plugin for WordPress is vulnerable to authenticated (Subscriber+) account takeover in all versions up to, and including, 5.26.0 via the event reaction endpoints (react_to_event() / unreact_to_event(…
-
High 7.3CVE-2026-10110 Public exploit
code-projects Student Details Management System index.php sql injection
A vulnerability was detected in code-projects Student Details Management System 1.0. This affects an unknown function of the file /index.php. Performing a manipulation of the argument roll results in sql injection. The attack is possible to be carried out rem…
-
High 7.5CVE-2026-44648 Public exploit
SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, st…
-
Medium 5.4CVE-2026-9811 Public exploit
Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector
A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before inje…
-
High 7.6CVE-2026-9809 Public exploit
Mautic has Stored Cross-Site Scripting (XSS) in Projects Component
A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without pr…
-
Critical 9.9CVE-2026-9558 Public exploit
Mautic has Server-Side Template Injection (SSTI) in Theme Templates
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse th…