Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,212
- Last 24h
- 643
- Critical, 7 days
- 363
- Known exploited
- 1,779
98,063 results · Clear filters · Feed
-
High 7.1CVE-2026-98180 Public exploit
drm/msm: RCU-free the scheduler-containing ring and VM objects
In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msm_ringbuffer and struct msm_gem_vm embed a struct drm_gpu_scheduler. msm_ringbuffer_destroy() and the VM free call…
-
High 7.5
smb: client: cancel reconnect work in clean_demultiplex_info()
In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in clean_demultiplex_info() clean_demultiplex_info() cancels server->echo delayed work but not server->reconnect, which can cause a use-after-free when the …
-
High 7.5
smb: client: fix rlist race and missing initialization
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next and ->prev to NULL instead of pointing to itself, making list_emp…
-
High 7.5
smb: client: fix use-after-free of iface in cifs_try_adding_channels()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifs_try_adding_channels() cifs_try_adding_channels() iterates ses->iface_list with list_for_each_entry_safe_from(), which captures the next entry …
-
High 8.8
smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()'s handling of compoun…
-
High 7.1
smb: client: fix potential OOB read in smb3_enum_snapshots()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3_enum_snapshots() If snapshot_array_size is smaller than GMT_TOKEN_SIZE, smb3_enum_snapshots() sets ret_data_len to sizeof(struct smb_snapshot_array…
-
High 7.8
drm/ttm: fix swapped-out resources never leaving their bulk_move range
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulk_move range ttm_tt_swapout() returns the number of pages swapped out on success and a negative error code on failure; for a populate…
-
High 8.2
Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping
Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak.Ciphers.…
-
High 8.5
WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability
Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.
-
High 7.5
WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.17 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions.
-
High 7.1
WordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.
-
High 8.8
WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.
-
High 8.8
WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.
-
High 7.1
WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.
-
High 7.2
WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability
Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.
-
High 7.1
WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
-
High 8.1
WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
-
High 7.1
WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.
-
High 8.1
WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
-
High 7.3
WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
-
High 7.1
WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.
-
High 7.1
WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
-
High 7.2
WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
-
High 7.5
WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.
-
High 7.5
WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.
-
High 8.5
WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in WPO365 <= 44.1 versions.
-
High 8.1
WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This issue affects SMS Alert Order Notifications: from n/a through 4.0.0.
-
High 7.3
WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.
-
High 7.1
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.
-
High 8.8
WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.
-
High 7.5
WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.
-
High 7.2
WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.
-
High 7.5
WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
-
High 7.1
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.
-
High 7.1
WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.
-
High 7.1
WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5.
-
High 7.1
WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.
-
High 8.5
WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability
Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.
-
High 8.5
WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability
Subscriber SQL Injection in ListingPro <= 2.9.12 versions.
-
High 7.5
WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions.