Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,816
- Last 24h
- 2,074
- Critical, 7 days
- 349
- Known exploited
- 1,779
4,271 results · Clear filters · Feed
-
High 8.1CVE-2026-54520 Public exploit
AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directory
AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through pat…
-
High 8.3CVE-2026-54597 Public exploit
ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with module_support write permission and access to a credential record can perform time-based blind SQL inj…
-
High 8.1CVE-2026-54596 Public exploit
ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter h…
-
High 8.8CVE-2026-28326 Public exploit
SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability
SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.
-
High 7.5CVE-2026-85721 Public exploit
AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentD…
-
High 8.8CVE-2026-92592 Public exploit
Craft CMS before 4.18.6 Remote Code Execution via signed cookie
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose (Yii…
-
High 7.0CVE-2026-91097 Public exploit
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, o…
-
High 8.4CVE-2026-79298 Public exploit
An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcke…
-
High 8.8CVE-2026-91737 Public exploit
Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code insid…
-
High 8.7CVE-2026-18110 Public exploit
Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username
Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a …
-
High 7.5CVE-2026-91940 Public exploit
crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy
crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image_sa…
-
High 7.5CVE-2026-79551 Public exploit
Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.
-
High 7.5CVE-2026-51134 Public exploit
The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' paramet…
-
High 7.3CVE-2026-18116 Public exploit
Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications
Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add events t…
-
High 7.5CVE-2026-84543 Public exploit
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27,…
-
High 7.8CVE-2026-43783 Public exploit
A race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A malicious app may be a…
-
High 7.8CVE-2026-84568 Public exploit
A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS …
-
High 7.8CVE-2026-43786 Public exploit
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia…
-
High 8.8CVE-2026-65374 Public exploit
A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Se…
-
High 8.8CVE-2026-89020 Public exploit
MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path Leading to Privilege Escalation
MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 5…
-
High 7.2CVE-2026-90932 Public exploit
LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE
LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService (e.g. BackupService::deleteBackup()) concatenate the user-supplied backup_file/filename value direct…
-
High 7.7CVE-2026-31278 Public exploit
An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.…
-
High 7.8CVE-2026-89754 Public exploit
mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk->action escaping walk_pmd_range() If ->pmd_entry() sets walk->action = ACTION_AGAIN, the pmd_none() check is retried. The PMD entry may be cleared at the point of …
-
High 7.8CVE-2026-81000 Public exploit
net: tun: bound receive headroom
In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request fro…
-
High 7.5CVE-2026-72708 Public exploit
SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html
SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open…
-
High 7.5CVE-2026-89013 Public exploit
Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php
Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with h…
-
High 8.8CVE-2026-38056 Public exploit
ST Engineering iDirect iQ-Series Terminals Missing Authorization
A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole c…
-
High 8.8CVE-2026-79987 Public exploit
Low-privilege RCE through element-search eager loading
A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.
-
High 8.8CVE-2026-88009 Public exploit
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sa…
-
High 7.0CVE-2026-88008 Public exploit
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend acce…
-
High 8.3CVE-2026-88861 Public exploit
Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when…
-
High 7.5CVE-2026-77771 Public exploit
miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing…
-
High 7.5CVE-2025-57231 Public exploit
Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local fil…
-
High 7.5CVE-2026-73786 Public exploit
Unauthenticated Network-Based Denial of Service in CPPM systems
A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote attacker to conduct a Denial-of-Service (DoS) attack. Successful exploitation could allow an attacker to cause instability and degrade performance of the vulne…
-
High 8.1CVE-2026-87930 Public exploit
MaxSite CMS through 109.6 PHP Object Injection via ci_session
MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods…
-
High 8.8CVE-2026-80914 Public exploit
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready iso_conn_ready() looks up the BIS listener socket with iso_get_sock(), which takes a reference, and then, without re-ch…
-
High 7.1CVE-2026-79617 Public exploit
Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter
Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus LightDM Greeter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus LightDM Gr…
-
High 8.8CVE-2026-80099 Public exploit
Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret
Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the `authenticate()` method — registered on the `rest_authentication_errors` filter and therefore ev…
-
High 8.8
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code i…
KEV Sep 9, 2026 -
High 8.7CVE-2026-86076 Public exploit
n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind t…