35,507 results · Clear filters · Feed
-
Critical 9.8CVE-2025-57529 Public exploit
YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due t…
-
Medium 6.1CVE-2025-70849 Public exploit
Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)
Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy (CSP) or adequate Co…
-
Medium 6.5CVE-2025-70559 Public exploit
Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in …
-
None 0.0CVE-2025-61638 Public exploit
Sanitizer::validateAttributes data-XSS
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/C…
-
Critical 9.8
vLLM leaks a heap address when PIL throws an error
vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this l…
-
High 8.5CVE-2026-22226 Public exploit
Command Injection Vulnerability on TP-Link Archer BE230 and AX73
A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration module on TP-Link Archer BE230 v1.2 and Archer AX73 v2. Successful exploitation could allow an attacker to gain full administrative control of …
-
Medium 6.8CVE-2026-1232 Public exploit
Anti-Tamper Bypass in BeyondTrust Privilege Management for Windows
A medium-severity vulnerability has been identified in BeyondTrust Privilege Management for Windows versions <=25.7. Under certain conditions, a local authenticated user with elevated privileges may be able to bypass the product’s anti-tamper protections, whi…
-
High 8.0CVE-2025-9974 Public exploit
Insufficient Input Validation on WEBUI in Nokia ONT/Beacon product
The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged authenticated a…
-
Medium 6.5CVE-2026-20404 Public exploit
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Critical 9.8CVE-2025-15030 Public exploit
User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access t…
-
High 8.8
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl
OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.
-
Medium 6.5CVE-2025-36001 Public exploit
IBM Db2 Denial of Service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service using a specially crafted SQL statement including XML that performs uncontrolled recursion.
-
Critical 9.7CVE-2026-25130 Public exploit
Cybersecurity AI vulnerable to command Injection through argument injection in find_file Agent tool
Cybersecurity AI (CAI) is a framework for AI Security. In versions up to and including 0.5.10, the CAI (Cybersecurity AI) framework contains multiple argument injection vulnerabilities in its function tools. User-controlled input is passed directly to shell c…
-
Critical 9.2CVE-2025-24293 Public exploit
Active Storage allowed transformation methods that were potentially unsafe
# Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allow for the circumven…
-
High 8.6CVE-2025-4686 Public exploit
Time-Based Blind SQLi in Kodmatic Computer's Online Exam and Assessment
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co. Online Exam and Assessment allows SQL Injection. This issue affects Online Exam a…
-
Low 2.7CVE-2026-25050 Public exploit
Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy
Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src…
-
High 8.8CVE-2026-24854 Public exploit
Church CRM has SQL injection in PaddleNumEditor.php
ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor.php` in ChurchCRM prior to version 6.7.2. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection …
-
High 7.2CVE-2026-0709 Public exploit
Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input valid…
-
Critical 10.0CVE-2026-1699 Public exploit
In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_ta…
-
Low 3.2CVE-2026-25211 Public exploit
Llama Stack exposes secret in initialization log
Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.
-
High 7.1CVE-2026-25126 Public exploit
PolarLearn's unvalidated vote direction allows vote count manipulation
PolarLearn is a free and open-source learning program. Prior to version 0-PRERELEASE-15, the vote API route (`POST /api/v1/forum/vote`) trusts the JSON body’s `direction` value without runtime validation. TypeScript types are not enforced at runtime, so an at…
-
Critical 9.4CVE-2026-25047 Public exploit
deepHas vulnerable to Prototype Pollution via constructor.prototype
deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was f…
-
Critical 9.8
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
KEV Apr 8, 2026 -
Critical 9.8
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
KEV Jan 29, 2026 -
High 8.5CVE-2026-1457 Public exploit
Authenticated RCE Vulnerability Due to Buffer Overflow on TP-Link VIGI C385
An authenticated buffer handling flaw in TP-Link VIGI C385 V1 Web API lacking input sanitization, may allow memory corruption leading to remote code execution. Authenticated attackers may trigger buffer overflow and potentially execute arbitrary code with ele…
-
High 7.3CVE-2025-15545 Public exploit
Insufficient Backup File Upload Input Validation on TP-Link Archer RE605X
The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the injected tag is interpreted by a shell, allowing execution of arbitrary commands with root privileges. Suc…
-
High 7.8CVE-2025-69604 Public exploit
An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to i…
-
High 8.8CVE-2025-69516 Public exploit
A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactic…
-
Critical 10.0CVE-2026-24897 Public exploit
Authenticated Remote Code Execution via Arbitrary File Upload
Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user‑supplied paths when creating shares. By spec…
-
High 8.7CVE-2026-22243 Public exploit
EGroupware has SQL Injection in Nextmatch Filter Processing
EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.20260113 and 26.0.20260113, specifically in the `Nextmatch` filter processing. The flaw allows authenti…
-
Critical 9.8
Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal
The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. This makes it possible for unauthenticated attac…
-
Critical 9.8
SolarWinds Web Help Desk Authentication Bypass Vulnerability
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.
-
Critical 9.8
SolarWinds Web Help Desk Authentication Bypass Vulnerability
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.
-
Critical 9.8
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
KEV Feb 3, 2026 -
High 8.1
SolarWinds Web Help Desk Security Control Bypass Vulnerability
SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.
KEV Feb 12, 2026 -
Critical 9.9CVE-2026-24841 Public exploit
Dokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket Endpoint
Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameters are direct…
-
Medium 4.8CVE-2025-70336 Public exploit
A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote att…
-
Medium 6.5CVE-2026-24134 Public exploit
StudioCMS has an Authorization Bypass Through User-Controlled Key
StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "Visitor" role to acce…
-
Critical 10.0CVE-2026-23830 Public exploit
SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor
SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Function` constr…
-
Medium 5.1CVE-2026-24688 Public exploit
pypdf has possible Infinite Loop when processing outlines/bookmarks
pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has b…