Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,442
- Last 24h
- 649
- Critical, 7 days
- 338
- Known exploited
- 1,779
97,636 results · Clear filters · Feed
-
High 8.4
In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a co…
-
High 8.4
In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent action…
-
High 8.4
In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy d…
-
High 8.4
In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing pe…
-
High 8.4
In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This…
-
High 7.8
In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input valid…
-
High 8.4
In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused de…
-
High 8.4
In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in th…
-
High 8.4
In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confu…
-
High 8.4
In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic er…
-
High 8.4
In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improp…
-
High 8.4
In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper in…
-
High 8.4
In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due t…
-
High 8.4
In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to i…
-
High 8.4
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay …
-
High 8.4
In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/ov…
-
High 7.8
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerabili…
-
High 7.8
Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket
The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to …
-
High 7.1
psqlODBC does not escape a server-supplied column name in its updatable-cursor queries
For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause o…
-
High 7.5
psqlODBC does not validate column numbers and row indexes in binding and descriptor functions
Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC…
-
High 7.5
psqlODBC SQL injection through SQLSpecialColumns table and schema names
SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets th…
-
High 7.5
psqlODBC ODBC escape parser stack buffer overflow
The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and …
-
High 7.5
psqlODBC large-object read overflows the application buffer
psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more byte…
-
High 7.5
psqlODBC row cache overflow when a later FETCH changes the column count
psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more col…
-
High 8.2
Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials
Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration…
-
High 8.1
Munshi Missing Authorization in Company Deletion API
Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company own…
-
High 7.5
Munshi Payment Bypass via Unauthenticated Webhook Endpoint
Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independen…
-
High 7.5
CVE-2026-120656
OpenKruise kruise-manager exposes an unauthenticated pprof endpoint, enabled by default, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any pod on the cluster network.
-
High 7.7
Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir
Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: http_headers.<name>.files and basic_auth.username_file. A tenant permitted to upload an Alertmanager…
-
High 8.4
FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support/templates/admin/mod_s…
-
High 8.8
Template injection in the publishing component of awslabs Virtual Engineering Workbench
Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda'…
-
High 7.5
CVE-2026-120627
The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in ver…
-
High 7.5
CVE-2026-120596
A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single…
-
High 7.5
Furl versions before 3.16 for Perl allow memory exhaustion via unbounded decompression of HTTP responses
Furl versions before 3.16 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It d…
-
High 7.9
Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas
Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Gl…
-
High 7.2
Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRules
A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagates permissions into named namespaces of every downstream cluster managed by the Rancher instance, but it was…
-
High 7.8
Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn l2cap_chan may be linked to l2cap_conn at most once. This is assumed in several places, eg l2cap_chan_del cleanup. There is …
-
High 7.8
tracing: Hold trace_types_lock when updating modules in persistent instances
In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when updating modules in persistent instances trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock. A concurrent rm…
-
High 7.8
tracing: Hold trace_types_lock when resetting last boot data from readers
In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when resetting last boot data from readers update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read(…
-
High 7.8
tracing: Reject incomplete event filter expressions
In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicate_parse()'s inner loop, which resolves the pending logical operators before jumping to …