Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,787
- Last 24h
- 2,072
- Critical, 7 days
- 348
- Known exploited
- 1,779
35,501 results · Clear filters · Feed
-
High 7.1CVE-2026-93485 Public exploit
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.
-
Medium 6.1CVE-2026-79294 Public exploit
Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arb…
-
High 8.3CVE-2026-93453 Public exploit
SOGo before 5.12.11 Password Reset Token Interception via Origin Header
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a…
-
Medium 4.8CVE-2026-54645 Public exploit
CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_copy rich-text fields from $GLOBALS['RAW']['POST'] and removes only script elements before the values are store…
-
Medium 6.1CVE-2026-54644 Public exploit
CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System
CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. …
-
High 7.2CVE-2026-54647 Public exploit
CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. A…
-
High 7.2CVE-2026-54646 Public exploit
CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping emb…
-
High 8.8CVE-2026-54519 Public exploit
AI Agent Automation: Missing ownership checks in memory APIs allow cross-user memory read and deletion
AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a ca…
-
High 8.1CVE-2026-54520 Public exploit
AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directory
AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through pat…
-
High 8.3CVE-2026-54597 Public exploit
ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with module_support write permission and access to a credential record can perform time-based blind SQL inj…
-
High 8.1CVE-2026-54596 Public exploit
ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter h…
-
Critical 9.8CVE-2026-45140 Public exploit
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or e…
-
High 8.8CVE-2026-28326 Public exploit
SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability
SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.
-
High 7.5CVE-2026-85721 Public exploit
AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentD…
-
Critical 9.2CVE-2026-79752 Public exploit
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-c…
-
Critical 10.0CVE-2026-92956 Public exploit
vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host…
-
Critical 9.0CVE-2026-92935 Public exploit
vm2 NodeVM Remote Code Execution via Array-Shaped Require
vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'object' && requireOpts !== null`, so an array-shaped `require` value (for example `r…
-
Critical 9.8CVE-2026-87796 Public exploit
Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This make…
-
Medium 6.1CVE-2021-3030 Public exploit
Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme …
-
High 8.8CVE-2026-92592 Public exploit
Craft CMS before 4.18.6 Remote Code Execution via signed cookie
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose (Yii…
-
Critical 10.0
Cisco Identity Services Engine Authentication Bypass Vulnerability
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vul…
KEV Sep 16, 2026 -
Critical 9.9CVE-2026-20329 Public exploit
Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Exceptional Conditions Handling Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has con…
-
High 7.0CVE-2026-91097 Public exploit
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, o…
-
Medium 5.3CVE-2026-19607 Public exploit
Keycloak-services: keycloak-services: broker-originated username collision causes account lockout
A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matchin…
-
Critical 9.8CVE-2026-91843 Public exploit
Stack overflow in login process to the Security Management and Log Servers
A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.
-
Critical 9.1CVE-2026-81642 Public exploit
Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA…
-
Medium 6.8CVE-2026-76555 Public exploit
WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite Wor…
-
Critical 9.8CVE-2026-12793 Public exploit
JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before …
-
Medium 4.7CVE-2026-92247 Public exploit
synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload
A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be ini…
-
High 8.4CVE-2026-79298 Public exploit
An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcke…
-
Critical 9.8CVE-2026-51990 Public exploit
An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary…
-
High 8.8CVE-2026-91737 Public exploit
Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code insid…
-
Critical 9.8CVE-2026-54337 Public exploit
Fireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue.
-
Medium 5.9CVE-2026-69212 Public exploit
Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect changes authority, but authority comparison excludes the URI scheme. A same-author…
-
Critical 9.8CVE-2026-89026 Public exploit
Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to …
-
High 8.7CVE-2026-18110 Public exploit
Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username
Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a …
-
High 7.5CVE-2026-91940 Public exploit
crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy
crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image_sa…
-
Critical 9.4CVE-2026-77179 Public exploit
Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback
On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbit…
-
Critical 9.1CVE-2026-52824 Public exploit
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_this_to_something_unique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony u…
-
Critical 9.1CVE-2026-90847 Public exploit
EFM ipTIME C200E System Setup iux_set.cgi os command injection
A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exp…