Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,013
- Last 24h
- 791
- Critical, 7 days
- 351
- Known exploited
- 1,779
35,501 results · Clear filters · Feed
-
High 8.5CVE-2026-22610 Public exploit
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in …
-
High 8.1CVE-2026-22594 Public exploit
Ghost has Staff 2FA bypass
Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.
-
Critical 9.1
React Router has Path Traversal in File Session Storage
React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/no…
-
High 7.6CVE-2025-59057 Public exploit
React Router has XSS Vulnerability
React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags whi…
-
Medium 6.3CVE-2026-22024 Public exploit
CryptoLib Memory Leak in KMC Encrypt Function Leads to Resource Exhaustion
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the …
-
Medium 4.7CVE-2025-15495 Public exploit
BiggiDroid Simple PHP CMS editsite.php unrestricted upload
A vulnerability was found in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/editsite.php. The manipulation of the argument image results in unrestricted upload. The attack can be launched remotely. The exploit has been made…
-
Critical 9.8CVE-2025-14598 Public exploit
CVE-2025-14598
BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQL commands to be executed on the backend database.
-
Medium 6.5CVE-2025-14172 Public exploit
WP Page Permalink Extension <= 1.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flush
The WP Page Permalink Extension plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.4. This is due to missing authorization checks on the `cwpp_trigger_flush_rewrite_rules` function hooked to `wp_ajax_cwpp_tri…
-
High 8.8CVE-2025-69194 Public exploit
Wget2: arbitrary file write via metalink path traversal in gnu wget2
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the s…
-
Medium 6.4CVE-2025-14893 Public exploit
IndieWeb <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' Parameter
The IndieWeb plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Telephone' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attac…
-
Critical 9.8CVE-2025-14736 Public exploit
Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'ge…
-
High 8.2CVE-2025-67070 Public exploit
A vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an unauthenticated attacker…
-
Critical 9.0CVE-2025-59470 Public exploit
This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a ma…
-
High 7.3CVE-2026-22241 Public exploit
Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbit…
-
Critical 9.3
OWASP CRS has multipart bypass using multiple content-type parts
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the …
-
Critical 10.0CVE-2026-21877 Public exploit
n8n is vulnerable to Remote Code Execution via Arbitrary File Write
n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instan…
-
Critical 9.8CVE-2025-67325 Public exploit
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticate…
-
Critical 9.8CVE-2025-61246 Public exploit
indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action.php via the proId para…
-
High 7.5CVE-2025-65518 Public exploit
Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability …
-
Medium 6.8CVE-2025-65731 Public exploit
An issue was discovered in D-Link Router DIR-605L (Hardware version F1; Firmware version: V6.02CN02) allowing an attack…
-
Critical 10.0
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an u…
-
High 8.3CVE-2026-21857 Public exploit
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not val…
-
High 8.8CVE-2025-68705 Public exploit
RustFS Path Traversal Vulnerability
RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in the /rustfs/rpc/read_file_stream endpoint. This issue has been patched in version 1.0.0-alpha.79.
-
Medium 6.8CVE-2026-22187 Public exploit
Bio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache Files
Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo files associated wit…
-
High 8.1CVE-2025-69080 Public exploit
WordPress Gecko theme <= 1.9.8 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko gecko allows PHP Local File Inclusion.This issue affects Gecko: from n/a through <= 1.9.8.
-
Medium 4.3CVE-2025-12030 Public exploit
ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification
The ACF to REST API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.4. This is due to insufficient capability checks in the update_item_permissions_check() method, which only verifies that the c…
-
Medium 5.3CVE-2025-15474 Public exploit
AuntyFey Smart Combination Lock BLE Connection Flood DoS
AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy (BLE) range to cause a denial of service by repeatedly initiating BLE connections. Sustained connect…
-
Medium 6.8CVE-2025-66837 Public exploit
A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafte…
-
Medium 6.5CVE-2025-66838 Public exploit
In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, …
-
High 8.8
Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinc…
-
Critical 9.8CVE-2025-15001 Public exploit
FS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover
The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their password. Thi…
-
Critical 9.2CVE-2025-68428 Public exploit
jsPDF has Local File Inclusion/Path Traversal vulnerability
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loa…
-
Critical 9.4CVE-2025-64424 Public exploit
Colify has command injection vulnerability in project git source
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low …
-
High 8.6CVE-2025-14124 Public exploit
Team < 5.0.11 - Unauthenticated SQLi
The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
-
High 7.5CVE-2025-67303 Public exploit
ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)
An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web…
-
Medium 6.9CVE-2025-34171 Public exploit
CasaOS <= 0.4.15 Unauthenticated File and Debug Data Exposure
CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image endpoint can be abused with a user-controlled path par…
-
High 8.8
Langflow Missing Authentication on Critical API Endpoints
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user co…
-
Critical 9.2CVE-2026-21440 Public exploit
AdonisJS Path Traversal in Multipart File Handling
AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through ve…
-
Critical 9.8CVE-2025-14998 Public exploit
Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possib…
-
Medium 5.3CVE-2024-55374 Public exploit
REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.