Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,255
- Last 24h
- 595
- Critical, 7 days
- 357
- Known exploited
- 1,779
35,501 results · Clear filters · Feed
-
High 8.0CVE-2025-7766 Public exploit
Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference
Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.
-
Medium 6.3CVE-2025-8018 Public exploit
code-projects Food Ordering Review System reservation_page.php sql injection
A vulnerability was found in code-projects Food Ordering Review System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /user/reservation_page.php. The manipulation of the argument reg_Id leads to s…
-
High 8.8CVE-2015-10140 Public exploit
Ajax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion
The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files.
-
Medium 5.3CVE-2025-6082 Public exploit
Birth Chart Compatibility <= 2.0 - Unauthenticated Full Path Exposure
The Birth Chart Compatibility plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to insufficient protection against directly accessing the plugin's index.php file, which causes an error exposing t…
-
High 7.8
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() …
KEV Sep 4, 2025 -
Critical 9.8CVE-2012-10020 Public exploit
FoxyPress <= 0.4.2.1 - Arbitrary File Upload
The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files …
-
Critical 9.8CVE-2015-10137 Public exploit
Website Contact Form With File Upload <= 1.3.4 - Arbitrary File Upload
The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_file()' function in versions up to, and including, 1.3.4. This makes it possible for unauthenticated atta…
-
Medium 6.1CVE-2025-51860 Public exploit
Stored Cross-Site Scripting (XSS) in TelegAI (telegai.com) 2025-05-26 in its chat component and character container com…
-
Medium 6.5CVE-2025-51864 Public exploit
A reflected cross-site scripting (XSS) vulnerability exists in AIBOX LLM chat (chat.aibox365.cn) through 2025-05-27, al…
-
Medium 6.5CVE-2025-51458 Public exploit
SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary …
-
Medium 6.5CVE-2025-51867 Public exploit
Insecure Direct Object Reference (IDOR) vulnerability in Deepfiction AI (deepfiction.ai) thru June 3, 2025, allowing at…
-
Medium 6.5CVE-2025-51859 Public exploit
Stored Cross-Site Scripting (XSS) vulnerability in Chaindesk thru 2025-05-26 in its agent chat component. An attacker c…
-
High 8.8CVE-2025-51865 Public exploit
Ai2 playground web service (playground.allenai.org) LLM chat through 2025-06-03 is vulnerable to Insecure Direct Object…
-
High 8.8CVE-2025-51482 Public exploit
Remote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai Letta 0.7.12 allows re…
-
Medium 6.9
Ollama vulnerable to Cross-Domain Token Exposure
Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.
-
Medium 6.1CVE-2025-51862 Public exploit
Insecure Direct Object Reference (IDOR) vulnerability in TelegAI (telegai.com) thru 2025-05-26 in its chat component. A…
-
Medium 6.1CVE-2025-51858 Public exploit
Self Cross-Site Scripting (XSS) vulnerability in ChatPlayground.ai through 2025-05-24, allows attackers to execute arbi…
-
Medium 6.1CVE-2025-51863 Public exploit
Self Cross Site Scripting (XSS) vulnerability in ChatGPT Unli (ChatGPTUnli.com) thru 2025-05-26 allows attackers to exe…
-
Medium 4.4CVE-2025-2301 Public exploit
IDOR in Akbim Software's Online Exam Registration
Authorization Bypass Through User-Controlled Key vulnerability in Akbim Software Online Exam Registration allows Exploitation of Trusted Identifiers. This issue affects Online Exam Registration: before 14.03.2025.
-
Medium 6.1CVE-2024-55040 Public exploit
Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker…
-
High 7.5CVE-2025-51869 Public exploit
Insecure Direct Object Reference (IDOR) vulnerability in Liner thru 2025-06-03 allows attackers to gain sensitive infor…
-
High 7.5CVE-2025-51868 Public exploit
Insecure Direct Object Reference (IDOR) vulnerability in Dippy (chat.dippy.ai) v2 allows attackers to gain sensitive in…
-
Medium 5.4CVE-2025-51396 Public exploit
A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web s…
-
Medium 5.4CVE-2025-51398 Public exploit
A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows at…
-
Medium 5.4CVE-2025-51397 Public exploit
A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attacker…
-
Medium 5.4CVE-2025-51401 Public exploit
A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attack…
-
Medium 5.4CVE-2025-51400 Public exploit
A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows atta…
-
Medium 6.5CVE-2025-51403 Public exploit
A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4…
-
Low 3.7CVE-2025-54352 Public exploit
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RP…
-
Medium 6.5
Microsoft SharePoint Server Spoofing Vulnerability
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
-
Medium 5.3CVE-2025-7892 Public exploit
IDnow App de.idnow AndroidManifest.xml improper export of android application components
A vulnerability classified as problematic has been found in IDnow App up to 9.6.0 on Android. This affects an unknown part of the file AndroidManifest.xml of the component de.idnow. The manipulation leads to improper export of android application components. …
-
Critical 9.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a c…
KEV Jul 20, 2025 -
High 8.9CVE-2025-47917 Public exploit
Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance wi…
-
Low 3.5CVE-2025-7840 Public exploit
Campcodes Online Movie Theater Seat Reservation System Reserve Your Seat Page index.php cross site scripting
A vulnerability was found in Campcodes Online Movie Theater Seat Reservation System 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php?page=reserve of the component Reserve Your Seat Page. The manipulation of the a…
-
Critical 9.8CVE-2015-10138 Public exploit
Work The Flow File Upload <= 2.5.2 - Arbitrary File Upload
The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery-File-Upload-9.5.0 server and test files in versions up to, and including, 2.5.2. This makes it possible for unauthenti…
-
High 8.8CVE-2015-10139 Public exploit
WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation
The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wp_ajax_import_data' AJAX action. This makes it possible for authenticated attackers to change otherwise restricted settings and potentially create a new…
-
High 7.2CVE-2015-10133 Public exploit
Subscribe to Comments <= 2.1.2 - Local File Includion
The Subscribe to Comments for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.2 via the Path to header value. This allows authenticated attackers, with administrative privileges and above, to include and execute arbitrary…
-
Critical 9.8CVE-2015-10135 Public exploit
WPshop 2 – E-Commerce < 1.3.9.6 - Arbitrary File Upload
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on…
-
Critical 9.8CVE-2012-10019 Public exploit
Front-end Editor < 2.3 - Arbitrary File Upload
The Front End Editor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the upload.php file in versions before 2.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affecte…
-
Critical 9.8CVE-2016-15043 Public exploit
WP Mobile Detector <= 3.5 - Arbitrary File Upload
The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file in versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to upload arbitrary files on…