Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,962
- Last 24h
- 1,963
- Critical, 7 days
- 354
- Known exploited
- 1,779
35,501 results · Clear filters · Feed
-
High 8.8CVE-2026-4342 Public exploit
ingress-nginx comment-based nginx configuration injection
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets acc…
-
Critical 9.8CVE-2026-32194 Public exploit
Microsoft Bing Images Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.
-
Critical 9.1CVE-2026-32238 Public exploit
OpenEMR has Remote Code Execution in backup functionality
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection vulnerability in the backup functionality that can be exploited by authenticated attackers. The vuln…
-
Critical 10.0
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Ap…
-
High 7.3
BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access control…
-
Critical 9.0CVE-2026-27540 Public exploit
WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files. This issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.
-
Critical 9.8CVE-2026-27542 Public exploit
WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Privilege Escalation. This issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.
-
High 7.3CVE-2025-69720 Public exploit
The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in pro…
-
Medium 6.5CVE-2026-32743 Public exploit
PX4 Autopilot: Stack-based Buffer Overflow via Oversized Path Input in MAVLink Log Request Handling
PX4 is an open-source autopilot stack for drones and unmanned vehicles. Versions 1.17.0-rc2 and below are vulnerable to Stack-based Buffer Overflow through the MavlinkLogHandler, and are triggered via MAVLink log request. The LogEntry.filepath buffer is 60 by…
-
High 8.6
Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint
Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly…
-
Critical 10.0CVE-2026-32731 Public exploit
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
ApostropheCMS is an open-source content management framework. Prior to version 3.5.3 of `@apostrophecms/import-export`, The `extract()` function in `gzip.js` constructs file-write paths using `fs.createWriteStream(path.join(exportPath, header.name))`. `path.j…
-
Low 3.6CVE-2026-32722 Public exploit
Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata
Memray is a memory profiler for Python. Prior to Memray 1.19.2, Memray rendered the command line of the tracked process directly into generated HTML reports without escaping. Because there was no escaping, attacker-controlled command line arguments were inser…
-
High 8.8CVE-2026-32321 Public exploit
ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration
ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 within the `actions/ajax.php` endpoint. Due to insufficient input sanitization of the `userid` parame…
-
High 7.3CVE-2026-2991 Public exploit
KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2. This is due to the `patientSocialLogin()` function not verifying the social provider access token …
-
High 8.8CVE-2026-22730 Public exploit
CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter
A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization.
-
High 7.7CVE-2026-32606 Public exploit
IncusOS has a LUKS encryption bypass due to insufficient TPM policy
IncusOS is an immutable OS image dedicated to running Incus. Prior to 202603142010, the default configuration of systemd-cryptenroll as used by IncusOS through mkosi allows for an attacker with physical access to the machine to access the encrypted data witho…
-
High 7.7CVE-2026-31891 Public exploit
Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()
Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected by a a SQL Injection vulnerability in the MongoLite Aggregation Optimizer. Any deployment where the `/a…
-
Medium 6.3CVE-2026-29057 Public exploit
Next.js: HTTP request smuggling in rewrites
Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encodin…
-
High 7.5CVE-2026-30345 Public exploit
A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitr…
-
Medium 5.4CVE-2026-30048 Public exploit
NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget thru 1.4.4. User-supplied input is not properly sanitized before being stored and rendered in the chat conversation history. This allows an attacker to inject arbitrary …
-
Medium 6.1CVE-2026-30695 Public exploit
A Cross-Site Scripting (XSS) vulnerability exists in the web-based configuration interface of Zucchetti Axess access co…
-
Medium 5.3CVE-2026-27978 Public exploit
Next.js: null origin can bypass Server Actions CSRF checks
Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, `origin: null` was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (s…
-
Medium 5.4CVE-2026-20643 Public exploit
A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Backgro…
-
Critical 9.1CVE-2026-25769 Public exploit
Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization
Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution (RCE) vulnerability due to Deserialization of Untrusted Data). All Wazuh deployments using cluster mode (m…
-
High 7.8CVE-2026-3888 Public exploit
Local Privilege Escalation in snapd
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS…
-
Critical 9.1CVE-2026-23489 Public exploit
Fields GLPI plugin vulnerable to RCE in dropdown generation
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.
-
Medium 4.7CVE-2026-4253 Public exploit
Tenda AC8 Web UploadCfg route_set_user_policy_rule os command injection
A security flaw has been discovered in Tenda AC8 16.03.50.11. This affects the function route_set_user_policy_rule of the file /cgi-bin/UploadCfg of the component Web Interface. The manipulation of the argument wans.policy.list1 results in os command injectio…
-
Medium 4.3CVE-2026-2461 Public exploit
Missing authorization check allows unauthorized modification of other users' comments on a board
Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisor…
-
High 8.4CVE-2026-4255 Public exploit
DLL Injection Privilege Escalation
A DLL search order hijacking vulnerability in Thermalright TR-VISION HOME on Windows (64-bit) allows a local attacker to escalate privileges via DLL side-loading. The application loads certain dynamic-link library (DLL) dependencies using the default Windows …
-
High 7.1CVE-2026-21005 Public exploit
Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with S…
-
Medium 6.9CVE-2026-21004 Public exploit
Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of ser…
-
Medium 5.9CVE-2026-21002 Public exploit
Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to ins…
-
Medium 5.9CVE-2026-21001 Public exploit
Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privile…
-
High 8.8CVE-2025-50881 Public exploit
The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code E…
-
Medium 5.3CVE-2025-69727 Public exploit
An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components …
-
Medium 6.5CVE-2025-68971 Public exploit
In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attac…
-
High 8.5CVE-2026-3227 Public exploit
Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N
A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to…
-
Medium 5.2CVE-2026-32707 Public exploit
PX4 autopilot has a stack buffer overflow in tattu_can due to unbounded memcpy in frame assembly loop
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, tattu_can contains an unbounded memcpy in its multi-frame assembly loop, allowing stack memory overwrite when crafted CAN frames are processed. In deployments where tattu_can is enabl…
-
High 8.6CVE-2026-32635 Public exploit
Angular has XSS in i18n attribute bindings
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Ang…
-
Critical 9.9CVE-2026-32621 Public exploit
Apollo Federation has prototype pollution via incomplete key sanitization
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in c…