Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,732
- Last 24h
- 378
- Critical, 7 days
- 341
- Known exploited
- 1,779
97,880 results · Clear filters · Feed
-
High 8.1
MOVEit Transfer Authentication bypass in LDAP sign-on
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
-
High 8.2
Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet …
-
High 8.8
MOVEit Transfer Secure Messaging Authentication Bypass
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
-
High 8.8
MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation
Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
-
High 7.2
Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is …
-
High 8.7
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop…
-
High 7.0CVE-2026-53613 Public exploit
util-linux mount target TOCTOU allows local privilege escalation
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before…
-
High 7.0
util-linux mount hook_owner TOCTOU allows local privilege escalation
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount …
-
High 7.5
NGINX Ingress Controller vulnerability
Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected path…
-
High 7.5
NGINX Ingress Controller vulnerability
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-…
-
High 8.1
NGINX map directive and regex matching vulnerability
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same re…
-
High 8.8
NGINX Gateway Fabric vulnerability
Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic "<realm>";. A na…
-
High 8.1CVE-2026-97205 Public exploit
NGINX ngx_http_core_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a U…
-
High 8.1CVE-2026-15176 Public exploit
NGINX ngx_http_core_module vulnerability
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achi…
-
High 8.1
Gitea API token scope escalation through HTTP signatures
Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope infor…
-
High 8.8CVE-2026-73802 Public exploit
Gitea Runner host isolation bypass through container options
Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being f…
-
High 8.8
Gitea reusable workflow secret exposure in pull_request_target
Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository a…
-
High 7.5
Gitea external renderer argument injection and code execution
Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options tha…
-
High 8.8
Gitea second-factor bypass through OpenID identity linking
Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtai…
-
High 8.8
Gitea fork workflow approval bypass through review events
Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequentl…
-
High 8.1
Gitea fork workflow approval bypass through concurrency cancellation
Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocke…
-
High 7.2
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.…
-
High 7.8
@offactory/compress-fonts before 1.1.1 OS Command Injection via Font File Names
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_p…
-
High 8.1
Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl()
Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which exec…
-
High 7.8
Turnpress through 0.4.2 OS Command Injection via Crafted .docx File Names
Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true…
-
High 7.8
xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote …
-
High 8.8
@runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can i…
-
High 7.8
buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name
buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a mali…
-
High 7.8
MyReport Updater through 2.1.1 Local Privilege Escalation via Updater Service
MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRP…
-
High 8.1
Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious referenc…
-
High 8.6
Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to f…
-
High 7.5
Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-node…
-
High 7.5
Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /…
-
High 8.8
Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId
Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a v…
-
High 8.1
SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API
SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and co…
-
High 8.1
NullHub through 2026.5.29 Missing Authentication for /api Management API
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authori…
-
High 7.1
jshERP through 3.6 Missing Authorization via /user/batchSetStatus
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable ever…
-
High 7.1
L-SMASH through 2.14.5 Double Free in HEVC and H.264 Importer Probe
L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream…
-
High 7.5
Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access
Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, …
-
High 8.1
Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can …