Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,455
- Last 24h
- 634
- Critical, 7 days
- 339
- Known exploited
- 1,779
97,640 results · Clear filters · Feed
-
High 7.2
WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.
-
High 7.2
WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
-
High 7.2
WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability
Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
-
High 8.8
WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.
-
High 8.8
WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability
Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.
-
High 7.2
WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
-
High 8.8
WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
-
High 7.2
WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.
-
High 8.8
WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.
-
High 8.8
WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions.
-
High 8.8
WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
-
High 7.2
WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability
Editor PHP Object Injection in Zippy <= 1.7.0 versions.
-
High 7.2
WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
-
High 7.1
WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.
-
High 8.5
WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability
Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.
-
High 7.1
WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.
-
High 7.1
WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.
-
High 7.1CVE-2026-61989 Public exploit
WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.
-
High 7.1
WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.
-
High 7.1
WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.
-
High 7.1
WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.
-
High 7.2
WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.
-
High 7.1
WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.
-
High 7.1
WordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.
-
High 7.1
WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.
-
High 8.8
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
-
High 7.4
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
-
High 8.1
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.
-
High 7.8CVE-2026-114148 Public exploit
ASP.NET Core Elevation of Privilege Vulnerability
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.
-
High 8.5
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.
-
High 8.8
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.
-
High 8.1
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.
-
High 8.8
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.
-
High 8.8
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
-
High 8.8CVE-2026-107326 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
-
High 8.8
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command…
-
High 8.8
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attac…