Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,413
- Last 24h
- 697
- Critical, 7 days
- 339
- Known exploited
- 1,779
97,631 results · Clear filters · Feed
-
High 8.4
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type …
-
High 7.6CVE-2026-34157 Public exploit
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands …
-
High 8.7
Black: GitHub Action installs unvalidated required-version from pyproject.toml
Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can…
-
High 7.1CVE-2026-87008 Public exploit
Code Graph RAG structural tools follow out-of-root symlinks
Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies…
-
High 7.5
Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read
Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins attacker-controlled file…
-
High 8.1
OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLER_ACL_MAP, and checkCont…
-
High 7.1
OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstall
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custom_modules/oe-module-dorn/public/compendium_install.php checks authentication and CSRF but does not require the admi…
-
High 8.1
OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attribute
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and code…
-
High 7.1
OpenEMR: Arbitrary Patient Recall and Contact Detail Read
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the new_recall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow…
-
High 7.1
OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operations
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/patient_file/pos_checkout_ippf.php performs state-changing void, voidall, and regen operations through GET requests without CSRF…
-
High 7.1
OpenEMR: Patient Data Search Without Sufficient ACL
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level …
-
High 8.0
Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user se…
-
High 7.5
OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custom_modules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::…
-
High 7.5
FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to …
-
High 8.2
FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, udptl_rx_packet() used a peer-controlled FEC entry count di…
-
High 7.1
A vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse Engineering. This issue affects…
-
High 8.2
FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding
FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switch_xml_decode() can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent…
-
High 7.5
FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared …
-
High 7.4
FreeSWITCH: DTLS-SRTP peer certificate is not bound to the SDP fingerprint when FreeSWITCH is the DTLS server
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, dtls_state_setup() compared a peer certificate with the SDP…
-
High 8.8
FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, sofia_handle_sip_i_refer() placed raw Refer-To URI paramete…
-
High 7.5
FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, mod_event_socket used an unauthenticated Content-Length val…
-
High 7.5CVE-2026-116567 Public exploit
FreeSWITCH: Pre-authentication stack buffer overflow in mod_rtmp control-message handling
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_handle_control() rendered an RTMP user-control message…
-
High 7.5
FreeSWITCH: Pre-authentication stack buffer overflow in mod_xml_rpc HTTP directory authentication
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, http_directory_auth() rebuilt an expected user@domain:passw…
-
High 7.5
FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, msrp_parse_buffer() subtracted delimiter framing from a pee…
-
High 7.5
FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtmp2rtpH264() trusted the length prefix of each inbou…
-
High 7.8
In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM p…
-
High 7.5
FreeSWITCH: Stack buffer overflow parsing the SDP a=crypto key material on inbound calls
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_core_media_add_crypto() passed the encoded key and s…
-
High 8.8
SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API exposes CRUD operations for administrator-only modules to any authenticated OAuth2 user. The affected flow …
-
High 8.0
mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata
Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can decl…
-
High 8.0
ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator
ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can…
-
High 8.8
SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query con…
-
High 7.1
SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on both related records.…
-
High 7.1
SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field…
-
High 7.1
SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The af…
-
High 8.8
SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. Th…
-
High 8.8
SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR_Report::build_report_query_where incorporates a report editor's parameter_value when value_type=Field without sufficient …
-
High 8.8
SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the REST v4 JSON handler reads the pre-filter RAW_REQUEST value and relationship write helpers interpolate supplied field val…
-
High 8.3
SuiteCRM: SQL injection via search param in modules/Cases/controller.php
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CasesController action_get_kb_articles action interpolates $_POST['search'] into a CASE WHEN ... LIKE expression and the …
-
High 8.8
SuiteCRM: Authenticated SQL Injection in map_markers distance Parameter
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwg_Maps map marker endpoint uses the authenticated caller's distance value in the map_markers action without strict num…
-
High 8.3
SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, GetLatestRevision.php interpolates get_latest_for_id directly into an SQL UPDATE statement. Although securexss() normally ent…