Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,405
- Last 24h
- 690
- Critical, 7 days
- 338
- Known exploited
- 1,779
97,628 results · Clear filters · Feed
-
High 7.5
Chartbrew: Private chart data disclosure via forgeable CB_SECRET share tokens
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chart share and embed tokens were signed with CB_SECRET, including known or shipped-default values in stock source a…
-
High 7.0
Chartbrew: SSRF guard bypass via IPv6 NAT64/DNS64 addresses in API Data Connection outbound policy (validateOutboundUrl)
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, the outbound URL guard recognized ordinary IPv4, IPv6, and IPv4-mapped IPv6 destinations but did not recognize IPv4 …
-
High 8.2
Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body. The streaming read c…
-
High 7.5
plist.js before 5.0.1 Uncontrolled Resource Consumption via Binary Parser
plist.js (npm package 'plist') before 5.0.1 contains an uncontrolled resource consumption vulnerability in the binary property-list parser (parseBinary) that allows unauthenticated attackers to crash a Node.js process by exploiting unmemoized recursive resolu…
-
High 7.5
esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal
esm.sh is a no-build content delivery network (CDN) for web development. Prior to server version 137_7, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result re…
-
High 8.1
Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server
Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is run…
-
High 8.8
Tetragon: Unauthenticated Tetragon gRPC admin API accessible from hostNetwork pods
Tetragon is an eBPF-based security observability and runtime enforcement project. Versions before 1.7.0 can use a Helm default that exposes the privileged Tetragon gRPC API through an unauthenticated TCP listener on localhost:54321. An attacker who can run or…
-
High 7.8
pytorch/serve: Local privilege escalation through insecure temporary path
In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.
-
High 7.7
LXD has project restriction bypass for custom volume copy across projects
Reported from https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f ### Summary Missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom…
-
High 7.7
LXD has project restriction bypass in instance copy across projects
Reported from https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg ### Summary Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance i…
-
High 8.8CVE-2026-33050 Public exploit
GeoNode: OS command injection via uploaded file layer name
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute…
-
High 8.1CVE-2026-124040 Public exploit
CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State
CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseud…
-
High 7.5
ChatWiki before 2.10.0 Unauthenticated Document Disclosure via getLibRawFileOnePage
ChatWiki before 2.10.0 contains a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage route that allows unauthenticated attackers to read other tenants' documents. Attackers can enumerate sequential admin_user_id and file id query par…
-
High 7.5
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an al…
KEV Nov 6, 2026 -
High 8.3
Hisense VIDAA Smart TV MQTT Broker Authentication Bypass
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate l…
-
High 7.5
A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which…
-
High 8.8
Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the Google Cobalt browser engine exposes the WebDriver automation server on TCP port 4444 across all network interfaces without any authent…
-
High 8.8
A session validation vulnerability has been identified in the SonicOS management interface, which in specific condition…
-
High 8.8
A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specif…
-
High 8.1
Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser
An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent …
-
High 7.8
CVE-2026-90975
A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property r…
-
High 7.5
GROBID: Unauthenticated `/api/modelTraining` Endpoint Allows Unbounded Thread Pool Creation (DoS)
GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, where each request creates E…
-
High 7.8
xen-netback: defer xenvif_mcast_addr_list_free()
In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvif_mcast_addr_list_free() In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen f…
-
High 8.8
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have a security bypass vulnerability. Successful exploit…
-
High 7.8
Adobe Illustrator CC versions 23.1 and earlier have a binary planting vulnerability. Successful exploitation could lead…
-
High 7.6
Wanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTML
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTML template in web/sr…
-
High 7.6
Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unva…
-
High 7.5
Wanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub Endpoints
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, the unauthenticated GET /activitypub/trail/{id} and GET /activitypub/comment/{id} endpoints call ActivitypubTrail() and ActivitypubComment() to return full trail and …
-
High 7.5
Skyline DataMiner BrokerGateway Embedded API Key Authentication Bypass
Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthenticated attackers to retrieve the installation-specific BrokerGateway key even while pairing mode is disabled. Attackers can use the retrieved key to obtain the unr…
-
High 7.5
Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API
Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /__nuxt_content/:collection/query endpoint accepts an attacker-controlled sql field in src/runtime/api/query.po…
-
High 7.5
Kroki: TikZ Secure Mode Local File Read via LaTeX File I/O Primitives
Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAFE_MODE is enabled blocks only \verbatiminput while allowing native TeX file-read primitives including \openin, \read, \input, and \inc…
-
High 8.8
OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document
OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/g…
-
High 7.5
FreeScout: Conditional stored admin XSS via failed-job details
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a pre-authenticated attacker can place HTML in a failed-login email value that is copied through monitored user activity into a queued SendAlert job. If alert delivery fails, the seria…
-
High 7.1
FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checki…
-
High 8.4
In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting …
-
High 8.2
FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, multiple outbound paths in Helper::downloadRemoteFile(), Helper::checkPort(), Helper::sanitizeRemoteUrl(), MailboxesController.php, and ModulesController.php do not consistently enforc…
-
High 7.7
FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query
FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefix…
-
High 7.6
FreeScout: Stored XSS in mailbox signature via same-origin JS upload
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file uploaded through /uploads/upload with nested tag fragments that bypass Helper::stripDangerousTags(). The resulting…
-
High 7.3
Cross-site Scripting in Progress Telerik Fiddler Everywhere
Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.
-
High 7.5
Missing Integrity Verification in Progress Software Fiddler Download & Setup Skill
Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On m…