Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,962
- Last 24h
- 1,951
- Critical, 7 days
- 354
- Known exploited
- 1,779
35,501 results · Clear filters · Feed
-
High 7.7CVE-2026-29053 Public exploit
Ghost Vulnerable to Remote Code Execution via Malicious Themes
Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.
-
Medium 5.8CVE-2024-43035 Public exploit
Fonoster is vulnerable to directory traversal
Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.…
-
High 8.8CVE-2025-70995 Public exploit
An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execut…
-
High 8.8CVE-2026-26416 Public exploit
An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users …
-
High 8.1CVE-2026-26417 Public exploit
A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Cli…
-
High 7.5CVE-2026-26418 Public exploit
Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows re…
-
Critical 9.3CVE-2026-2835 Public exploit
HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing
An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Tran…
-
Critical 9.1CVE-2026-29000 Public exploit
pac4j-jwt JwtAuthenticator Authentication Bypass
pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public ke…
-
High 8.6CVE-2025-66024 Public exploit
XWiki Blog Application home page vulnerable to Stored XSS via Post Title
The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting (XSS) via the Blog Post Title. The vulnerability arises because the po…
-
High 8.6CVE-2026-0847 Public exploit
Path Traversal in nltk/nltk
A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitiz…
-
Critical 10.0
Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to ins…
KEV Mar 19, 2026 -
Critical 10.0
Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying oper…
KEV Sep 9, 2026 -
High 7.5CVE-2026-28695 Public exploit
Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::cre…
-
High 7.8CVE-2026-23231 Public exploit
netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hook…
-
Critical 9.8CVE-2025-66678 Public exploit
An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allo…
-
Medium 6.6CVE-2025-70342 Public exploit
erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.js…
-
High 7.8CVE-2025-70341 Public exploit
Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.
-
Critical 10.0
FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RC…
-
Critical 9.2CVE-2026-27971 Public exploit
Qwik affected by unauthenticated RCE via server$ Deserialization
Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP …
-
Medium 5.1CVE-2026-24415 Public exploit
OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contains Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize use…
-
Medium 4.3CVE-2026-3494 Public exploit
MariaDB Server Audit Plugin Comment Handling Bypass
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen…
-
Critical 9.8CVE-2025-59059 Public exploit
Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator
Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue.
-
Critical 9.8
User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to improper privilege management in all versions up to, and including, 5.1.2. Th…
-
High 7.1CVE-2025-66680 Public exploit
An issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to del…
-
Medium 6.5CVE-2026-2256 Public exploit
Command injection vulnerability in ModelScope's ms-agent
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input.
-
High 8.4CVE-2026-0047 Public exploit
In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information du…
-
High 7.8CVE-2026-0023 Public exploit
In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership du…
-
Medium 6.2CVE-2026-0014 Public exploit
In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input …
-
High 8.4CVE-2026-0013 Public exploit
In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confus…
-
High 8.4CVE-2026-0010 Public exploit
In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This co…
-
Critical 9.8CVE-2026-0006 Public exploit
In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead …
-
High 7.5CVE-2026-3180 Public exploit
Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordEmail’ and the ’cgl_mail’ parameter in all versions up to, and including, 28.1.4 due to insufficient …
-
High 7.8
Integer Overflow or Wraparound in Graphics
Memory corruption while using alignments for memory allocation.
KEV Mar 3, 2026 -
High 8.6CVE-2026-28286 Public exploit
ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when…
-
Critical 9.8CVE-2026-26720 Public exploit
An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts mo…
-
High 7.3CVE-2026-3395 Public exploit
MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection
A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injectio…
-
High 7.5CVE-2025-13673 Public exploit
Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and lack of suffic…
-
Critical 9.3CVE-2026-28517 Public exploit
openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or san…
-
Critical 9.3CVE-2026-28516 Public exploit
openDCIM <= 23.04 SQL Injection in Config::UpdateParameter
openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without pre…
-
Critical 9.3CVE-2026-28515 Public exploit
openDCIM <= 23.04 Missing Authorization in install.php
openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any …