Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,811
- Last 24h
- 2,095
- Critical, 7 days
- 348
- Known exploited
- 1,779
35,501 results · Clear filters · Feed
-
Critical 9.8CVE-2026-88899 Public exploit
knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header
knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system.
-
High 8.8CVE-2026-88009 Public exploit
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sa…
-
High 7.0CVE-2026-88008 Public exploit
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend acce…
-
Critical 9.8CVE-2026-88877 Public exploit
Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotatio…
-
High 8.3CVE-2026-88861 Public exploit
Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when…
-
Low 2.4CVE-2026-0303 Public exploit
Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File
A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file.
-
High 7.5CVE-2026-77771 Public exploit
miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing…
-
Critical 10.0CVE-2026-77770 Public exploit
miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary o…
-
Critical 9.8CVE-2026-57967 Public exploit
Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache Activ…
-
Critical 9.8CVE-2026-18351 Public exploit
Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_t…
-
High 7.5CVE-2025-57231 Public exploit
Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local fil…
-
Medium 5.4CVE-2026-36392 Public exploit
FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can injec…
-
High 7.5CVE-2026-73786 Public exploit
Unauthenticated Network-Based Denial of Service in CPPM systems
A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote attacker to conduct a Denial-of-Service (DoS) attack. Successful exploitation could allow an attacker to cause instability and degrade performance of the vulne…
-
High 8.1CVE-2026-87930 Public exploit
MaxSite CMS through 109.6 PHP Object Injection via ci_session
MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods…
-
High 8.8CVE-2026-80914 Public exploit
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready iso_conn_ready() looks up the BIS listener socket with iso_get_sock(), which takes a reference, and then, without re-ch…
-
Critical 9.9CVE-2026-67401 Public exploit
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailT…
-
High 7.1CVE-2026-79617 Public exploit
Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter
Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus LightDM Greeter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus LightDM Gr…
-
Critical 9.8
Improper Certificate Validation in Quantum Security Gateway
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
KEV Sep 22, 2026 -
Medium 6.2CVE-2026-86547 Public exploit
mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTER
mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb bytecode files with OP_ENTER instructions at the top level to crash the embeddi…
-
High 8.8CVE-2026-80099 Public exploit
Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret
Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the `authenticate()` method — registered on the `rest_authentication_errors` filter and therefore ev…
-
Critical 9.2CVE-2026-21096 Public exploit
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote atta…
-
Medium 5.4CVE-2026-87575 Public exploit
Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social e…
-
High 8.8
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code i…
KEV Sep 9, 2026 -
Critical 9.6CVE-2026-87492 Public exploit
Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially ex…
-
Medium 4.3CVE-2026-79387 Public exploit
SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary u…
-
High 8.7CVE-2026-86076 Public exploit
n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind t…
-
High 7.8CVE-2026-49881 Public exploit
In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in th…
-
High 8.8CVE-2026-28618 Public exploit
In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote co…
-
High 8.8CVE-2026-28609 Public exploit
In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to r…
-
High 7.8
Windows Update Stack Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
KEV Sep 8, 2026 -
High 7.8CVE-2026-69328 Public exploit
Windows Storage Elevation of Privilege Vulnerability
Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.
-
Medium 5.5CVE-2026-83991 Public exploit
Windows Cloud Files Mini Filter Driver Tampering Vulnerability
Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally.
-
High 8.6CVE-2026-80097 Public exploit
Microsoft Authenticator Elevation of Privilege Vulnerability
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
-
High 7.1CVE-2026-69451 Public exploit
Windows Management Instrumentation Elevation of Privilege Vulnerability
Use after free in Windows Management Instrumentation allows an authorized attacker to elevate privileges over a network.
-
High 7.2CVE-2026-74239 Public exploit
XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows
XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by …
-
Medium 6.5CVE-2026-73321 Public exploit
XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser
XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious p…
-
Medium 6.1CVE-2026-73320 Public exploit
XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint
XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enume…
-
Medium 6.1CVE-2026-73319 Public exploit
XenForo < 2.3.13 XSS via Dynamic Redirect Handler
XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation…
-
Low 3.8CVE-2026-73318 Public exploit
XenForo < 2.3.13 Missing Authorization via force-agreement Controller
XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permi…
-
Low 2.7CVE-2026-73317 Public exploit
XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher
XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job clas…