Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 405,733
- Last 24h
- 448
- Critical, 7 days
- 312
- Known exploited
- 1,769
4,230 results · Clear filters · Feed
-
High 7.5
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an al…
KEV Nov 6, 2026 -
High 7.7CVE-2026-111770 Public exploit
Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Se…
-
High 8.2CVE-2026-77622 Public exploit
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
Sliver is a command and control framework. Prior to 1.7.6, an HTTP(S) listener using the PNG encoder accepts attacker-controlled PNG dimensions without an effective decoded-size or pixel limit in util/encoders/images.go, while the listener nonce space impleme…
-
High 7.6CVE-2026-34157 Public exploit
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands …
-
High 7.1CVE-2026-87008 Public exploit
Code Graph RAG structural tools follow out-of-root symlinks
Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies…
-
High 7.7CVE-2026-69137 Public exploit
SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's server_url directly to curl without host, address,…
-
High 8.1CVE-2026-123158 Public exploit
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentic…
-
High 8.7CVE-2026-123014 Public exploit
iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker t…
-
High 7.7CVE-2026-109518 Public exploit
APT RCE via hard link reuse
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…
-
High 8.1CVE-2026-114550 Public exploit
libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability
libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to expl…
-
High 8.1CVE-2026-54161 Public exploit
upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed…
-
High 7.5CVE-2026-115290 Public exploit
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted…
-
High 8.8CVE-2026-107441 Public exploit
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 co…
-
High 7.1CVE-2026-106991 Public exploit
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or st…
-
High 7.5CVE-2026-58882 Public exploit
In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could l…
-
High 7.2CVE-2026-120318 Public exploit
Product Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAX
Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the…
-
High 8.8CVE-2026-120232 Public exploit
Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption
A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the function sub_23908 in the library shield.sys of the component Kernel Driver. Such manipulation leads to memory corruption. The attack can only be…
-
High 8.1
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the s…
KEV Nov 3, 2026 -
High 7.9CVE-2026-62958 Public exploit
libriscv: Out of bounds read vuln in the ELF parser (Denial of service)
libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-hea…
-
High 8.2CVE-2026-116244 Public exploit
pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the operating-system account r…
-
High 7.2CVE-2026-118238 Public exploit
CVE-2026-118238
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, whi…
-
High 8.1CVE-2026-108097 Public exploit
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10,…
-
High 7.5CVE-2026-117183 Public exploit
A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape th…
-
High 7.5CVE-2026-117184 Public exploit
An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a craf…
-
High 8.7CVE-2026-92744 Public exploit
Delinea Privilege Manager agent unauthenticated remote code execution vulnerability
Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.
-
High 7.1CVE-2026-61989 Public exploit
WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.
-
High 7.8CVE-2026-114148 Public exploit
ASP.NET Core Elevation of Privilege Vulnerability
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
-
High 8.8CVE-2026-107326 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
-
High 7.5CVE-2026-119025 Public exploit
open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows
open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint valu…
-
High 8.5CVE-2026-115965 Public exploit
WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.
-
High 7.7CVE-2026-100105 Public exploit
Alerting contact point authorization bypass via schema downgrade
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect ale…
-
High 7.1CVE-2026-115596 Public exploit
WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Reflected XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.4.
-
High 7.1CVE-2026-63286 Public exploit
Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are st…
-
High 8.8CVE-2026-109384 Public exploit
The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload
The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a …
-
High 8.8CVE-2026-111585 Public exploit
Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow
An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83 may allow a malicious remote host to cause a denial of service or, depending on the platform, pot…
-
High 7.8CVE-2026-117561 Public exploit
sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substi…
-
High 7.5CVE-2026-112621 Public exploit
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.…
-
High 8.8CVE-2026-112688 Public exploit
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7,…
-
High 8.4CVE-2026-112689 Public exploit
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS…
-
High 7.8CVE-2026-112487 Public exploit
A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequ…