Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,354
- Last 24h
- 664
- Critical, 7 days
- 338
- Known exploited
- 1,779
97,596 results · Clear filters · Feed
-
High 7.6
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VO…
-
High 7.5
SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An una…
-
High 7.5
Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthentica…
-
High 7.5
An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered,…
-
High 7.5
Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthentic…
-
High 8.9
Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory c…
-
High 8.7
Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ec_…
-
High 7.2
Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c …
-
High 7.5
Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP Decryption
Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to …
-
High 7.2
Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwr…
-
High 8.1
Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw_remove_sts
Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS …
-
High 7.2
Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c th…
-
High 8.0CVE-2026-125399 Public exploit
Fluxion before 6.39 OS Command Injection via Crafted SSID
Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID …
-
High 8.8
Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution
Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt…
-
High 7.1
Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated user…
-
High 7.8
Ghostscript before 10.08.0 -dSAFER Bypass via .putgstringcopy .forceput Recovery
Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that tri…
-
High 7.1
NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() tha…
-
High 7.1
MailEnable Enterprise Premium before 10.62 contains a heap overflow vulnerability in the IMAP X-FB-FETCH command that a…
-
High 7.2
Webmin through 2.670 OS Command Injection via Samba User Account Options
Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags pa…
-
High 7.1
Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderControl…
-
High 7.1
INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbi…
-
High 8.6
Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-admini…
-
High 7.1
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users …
-
High 7.5
OmniAgent Bash Approval Gate Bypass via find -execdir in Safe-Command Allowlist
OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that treats any command starting with find as safe without inspecting -execdir arguments. Prompt-injected agents can run find with -execdir to i…
-
High 8.1
frab through 0.9.1 Privilege Escalation via conference_users_attributes in UsersController
frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conference_users_attributes. Attackers can abuse UsersController#update or #create, which skip …
-
High 7.1
DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated user…
-
High 7.2
Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role Assignment
Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate…
-
High 7.2
Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to imper…
-
High 7.2
Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation …
-
High 7.3
SourceCodester Smart Attendance System with QR Code Scanner Admin Account Creation create_admin.php getMessage missing authentication
A vulnerability has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This impacts the function getMessage of the file create_admin.php of the component Admin Account Creation. Such manipulation of the argument e leads to missing …
-
High 7.3
SourceCodester Smart Attendance System with QR Code Scanner Password Reset reset_password.php password recovery
A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password…
-
High 7.5
Mongoose: Connection-level sanitizeFilter not applied
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditi…
-
High 7.5
Unsafe reflection in the error mitigation schema validation in Amazon Braket Schemas before 1.32.2 might allow a remote…
-
High 8.2
Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting dotted paths in $__set…
-
High 8.3
Novu provides an API for sending notifications through multiple channels. Prior to 3.15.0, the conditions filter webhoo…
-
High 7.5
The NXP ENET-QOS Ethernet driver's receive work handler eth_nxp_enet_qos_rx() in drivers/ethernet/eth_nxp_enet_qos hand…
-
High 7.8
The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread->arch.ptables during thread se…
-
High 7.5
Rack: Multipart parsing allows DoS via unbounded scan buffer growth
Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can …
-
High 8.8
AsyncSSH: SFTPServer Chroot Escape
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes o…
-
High 7.0
zizmor: Debug logging prints available GitHub credentials in cleartext
zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHU…