Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,354
- Last 24h
- 680
- Critical, 7 days
- 357
- Known exploited
- 1,779
97,596 results · Clear filters · Feed
-
High 8.5
WatchGuard Endpoint Protection Local Privilege Escalation in Console-Service Communication Allows SYSTEM Code Execution
A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting…
-
High 7.0
VNote 3.11.0 before 4.12.0 OS Command Injection via Tasks Magic Variables
VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a…
-
High 8.7
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108,…
-
High 8.5
Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server befo…
-
High 7.1
Akamai CLI before 2.0.6 contains a path traversal vulnerability that allows malicious packages to write files outside t…
-
High 8.3
Out-of-bounds write for some Intel(R) Performance Counter Monitor (Intel(R) PCM) within Ring 3: User Applications may a…
-
High 8.5
Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ri…
-
High 8.5
Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may…
-
High 8.5
Out-of-bounds write for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation …
-
High 8.7
LiveDocs is a primary-source-first documentation for AI agents. Prior to version 0.7.0, fetch_docs and introspect (kind…
-
High 7.4
rabbitmq-c: amqp_decode_bytes size_t integer overflow bypasses bounds check on 32-bit (OOB read)
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) <= encoded.len overflows when o + len > SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field leng…
-
High 8.8
WordPress WPIDE – File Manager & Code Editor plugin <= 3.6.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in XplodedThemes WPIDE – File Manager & Code Editor wpide allows Cross Site Request Forgery.This issue affects WPIDE – File Manager & Code Editor: from n/a through 3.6.4.
-
High 8.8
Missing Authentication Vulnerability in NETGEAR Nighthawk RAX30 models
A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi network to obtain sensitive information and tamper with device configuration, including administrator credentials, withou…
-
High 7.5
Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding
### Summary RSASSA-PKCS1-v1_5 signature verification (`publicKey.verify()` with the default scheme, also used by X.509 certificate and PKCS#7 verification) accepted non-canonical BER encodings of the DigestInfo, such as NULL parameters with content and non-mi…
-
High 7.2CVE-2026-105425 Public exploit
OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versi…
-
High 7.1
Cross-organization access to saved-search alerts in FlockOS
Missing authorization checks in the visual alert feature of FlockOS, Flock's hosted public safety platform, prior to 2026-09-28, allowed an authenticated user with permission to manage saved searches in their own organization to read, modify or delete another…
-
High 8.6
In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provide…
-
High 8.1
Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of pri…
-
High 8.8
A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (vers…
-
High 7.7
Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary …
-
High 8.3
Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whit…
-
High 7.1
Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api…
-
High 7.1
Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read adminis…
-
High 7.7
In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Serv…
-
High 7.0
Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receive…
-
High 7.5
A flaw was found in flightctl. A TLS handshake is performed synchronously in the HTTP server’s connection-context callb…
-
High 8.8
Use-after-free in the Audio/Video component
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45.
-
High 8.8
Incorrect boundary conditions in the Graphics component
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the Layout component
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the CSS Parsing and Computation component
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the SVG component
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the Layout: Positioned component
Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the DOM: Editor component
Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the DOM: HTML Parser component
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Incorrect boundary conditions in the Graphics: CanvasWebGL component
Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Incorrect boundary conditions, use-after-free in the Graphics component
Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
High 8.8
Use-after-free in the Graphics component
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
High 8.8
Incorrect boundary conditions in the WebRTC component
Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
High 8.8
Incorrect boundary conditions in the Graphics: WebRender component
Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
High 8.8
Use-after-free in the CSS Transitions and Animations component
Use-after-free in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.