Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,442
- Last 24h
- 628
- Critical, 7 days
- 338
- Known exploited
- 1,779
97,636 results · Clear filters · Feed
-
High 7.5
SQL Injection in Starnet Computer Systems' Inventory Tracking Application
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection. This issue affects Inventory Tracking Application: through 2026-10-…
-
High 8.9
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor ru…
-
High 8.6
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.
-
High 7.2
Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5
Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5
-
High 8.6
Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5
Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5
-
High 8.6
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.
-
High 8.8
Apache Syncope: AuthProfile value escalation via self-service update
Improper Privilege Management vulnerability in Apache Syncope. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication. This issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.…
-
High 8.6CVE-2026-111560 Exploited
OS Command Injection in Barracuda Appliances
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the craf…
KEV Nov 10, 2026 -
High 7.8
Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's eta-register
Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation. This issue affects eta-register: from 2.0.8 before 2.0.9.
-
High 8.0
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an…
-
High 8.2
@fastify/reply-from vulnerable to path traversal via backslash dot-segment prefix escape
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, w…
-
High 8.7
Remote Code Execution
Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option.
-
High 8.7
SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption
The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enab…
-
High 8.8
Remote Code Execution Vulnerability
Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability.
-
High 7.1
Permission control vulnerability in the event notification management module. Impact: Successful exploitation of this v…
-
High 7.5
DoS vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect availability.
-
High 7.3
dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection
A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code …
-
High 7.3
dayrui XunRuiCMS Email Template Rendering Notice.php _get_tpl_content code injection
A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The…
-
High 7.3
dayrui XunRuiCMS Member View.php View sql injection
A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to lau…
-
High 7.3
mathurvishal CloudClassroom-PHP-Project viewquery.php sql injection
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is …
-
High 7.3
mathurvishal CloudClassroom-PHP-Project studentdetails.php redirect
A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project. Impacted is an unknown function of the file studentdetails.php. The manipulation leads to execution after redirect. Remote exploitation of the attack is possible. The explo…
-
High 7.3
VStarcam O-KAM SuperIPCam P2P Session Teardown SuperIPCam.exe FUN_005a2d44 use after free
A vulnerability was determined in VStarcam O-KAM SuperIPCam 1.3.3.32. Affected by this issue is the function FUN_005a2d44 of the file SuperIPCam.exe of the component P2P Session Teardown. This manipulation causes use after free. The attack can be initiated re…
-
High 7.3
VStarcam O-KAM Client DevDll_925.dll FUN_10003EA0 stack-based overflow
A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN_10003EA0 in the library DevDll_925.dll. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The …
-
High 8.4
In GPU pdma, there is a possible escalation of privilege due to a missing permission check. This could lead to local es…
-
High 7.5
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 8.4
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation…
-
High 7.8
In GPU pdma, there is a possible memory corruption due to use after free. This could lead to local escalation of privil…
-
High 8.4
In GPU pdma, there is a possible escalation of privilege due to use after free. This could lead to local escalation of …
-
High 7.5
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 7.5
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 7.1
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote escalation of privi…
-
High 7.5
In Modem, there is a possible out of bounds write due to improper input validation. This could lead to remote escalatio…
-
High 7.5
In Modem, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of p…
-
High 7.5
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 7.5
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalatio…
-
High 7.5
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 7.5
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 8.3
Aklivity Zilla http-filesystem Binding FileSystemServerFactory Path.resolve path traversal
A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path …
-
High 8.8
LobeHub Chat 1.84.26 before 2.1.49 Path Traversal RCE via writeTempFile
LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile(). Attackers can create a file record via file.createFile with a trav…
-
High 7.5
Network-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePath
Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the…