4,269 results · Clear filters · Feed
-
High 8.1CVE-2026-87930 Public exploit
MaxSite CMS through 109.6 PHP Object Injection via ci_session
MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods…
-
High 8.8CVE-2026-80914 Public exploit
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready iso_conn_ready() looks up the BIS listener socket with iso_get_sock(), which takes a reference, and then, without re-ch…
-
High 7.1CVE-2026-79617 Public exploit
Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter
Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus LightDM Greeter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus LightDM Gr…
-
High 8.8
Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret
Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the `authenticate()` method — registered on the `rest_authentication_errors` filter and therefore ev…
-
High 8.8
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code i…
KEV Sep 9, 2026 -
High 8.7CVE-2026-86076 Public exploit
n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind t…
-
High 7.8CVE-2026-49881 Public exploit
In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in th…
-
High 8.8CVE-2026-28618 Public exploit
In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote co…
-
High 8.8CVE-2026-28609 Public exploit
In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to r…
-
High 7.8
Windows Update Stack Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
KEV Sep 8, 2026 -
High 7.8CVE-2026-69328 Public exploit
Windows Storage Elevation of Privilege Vulnerability
Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.
-
High 8.6CVE-2026-80097 Public exploit
Microsoft Authenticator Elevation of Privilege Vulnerability
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
-
High 7.1CVE-2026-69451 Public exploit
Windows Management Instrumentation Elevation of Privilege Vulnerability
Use after free in Windows Management Instrumentation allows an authorized attacker to elevate privileges over a network.
-
High 7.2CVE-2026-74239 Public exploit
XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows
XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by …
-
High 7.5CVE-2026-73316 Public exploit
XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid web…
-
High 8.6CVE-2026-73315 Public exploit
XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate…
-
High 7.5CVE-2026-73314 Public exploit
XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook
XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth_algo header value. Whe…
-
High 7.4CVE-2026-73312 Public exploit
XenForo < 2.3.13 Refresh Token Replay via Expired Access Token
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit th…
-
High 7.4CVE-2026-73311 Public exploit
XenForo < 2.3.13 OAuth2 Authorization Code Reuse
XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization …
-
High 7.4CVE-2026-73309 Public exploit
XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint
XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can explo…
-
High 7.5CVE-2026-78837 Public exploit
A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensiti…
-
High 8.4CVE-2026-19843 Public exploit
389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor
A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create …
-
High 7.1CVE-2026-86283 Public exploit
MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data
MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller's access control list (ACL). The CollectionsController::view() action correctly resolved collect…
-
High 7.5CVE-2026-86259 Public exploit
OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parame…
-
High 8.7CVE-2026-67281 Public exploit
Unauthenticated file read in Mikrotik RouterOS
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that…
-
High 8.9CVE-2026-48019 Public exploit
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticat…
-
High 8.1CVE-2026-85625 Public exploit
sift 17.1.3 Prototype Pollution Remote Code Execution via $where
sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is …
-
High 7.9CVE-2026-85649 Public exploit
(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the …
-
High 7.5CVE-2026-85612 Public exploit
OpenPanel before 2.3.0 SSRF via favicon and og endpoints
OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrar…
-
High 7.1CVE-2022-35499 Public exploit
In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injec…
-
High 8.1CVE-2026-78839 Public exploit
An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploadin…
-
High 8.3CVE-2026-85048 Public exploit
Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the…
-
High 7.5CVE-2026-85045 Public exploit
Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside…
KEV Sep 4, 2026 -
High 8.8CVE-2026-71963 Public exploit
Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection
Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an at…
-
High 7.7CVE-2026-85168 Public exploit
n8n before 1.123.73 Remote Code Execution via Git Node
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-d…
-
High 8.1CVE-2026-19219 Public exploit
DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders t…
-
High 8.1CVE-2026-80467 Public exploit
Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticate…
-
High 7.8
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerab…
KEV Sep 2, 2026 -
High 8.8CVE-2026-71981 Public exploit
Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can p…