Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,463
- Last 24h
- 627
- Critical, 7 days
- 342
- Known exploited
- 1,779
97,643 results · Clear filters · Feed
-
High 7.1
WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid invoicing allows Stored XSS.This issue affects GetPaid: from n/a through 2.8.62.
-
High 7.1
WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows Stored XSS.This issue affects DXP ToolKit: from n/a through 2.0.1.
-
High 7.5
Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStreamProcessing allow an …
-
High 7.5
Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question …
-
High 7.5
Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to terminate or hang the hos…
-
High 7.5
Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause…
-
High 7.5
XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested…
-
High 7.1
Path Traversal in Telerik Document Processing Libraries AI Agent Tools
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments to read files outside t…
-
High 8.6
HCL BigFix AEX is affected by multiple security vulnerabilities.
HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to info…
-
High 7.5
Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed input
The Compound File Binary (OLE2) parser (`src/cfb.rs`), used when reading `.xls` and `.xlsb` workbooks and when extracting VBA projects from `.xlsx`, can panic or allocate without bound on crafted input. Both are reachable through the public reader API (`open_…
-
High 7.5
Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`
With `Options::ENABLE_WIKILINKS`, handle_wikilink builds a wikilink's target from the raw text of its body: scan_wikilink_pipe walks it looking for |, then contains('\0') and from_replace_nuls walk it again. Once a wikilink is created, disable_all_links only …
-
High 7.5
Excessive CPU and memory use on crafted GraphQL documents
Several parts of `juniper` did work that grew faster than the size of the GraphQL document. A small document could thus use seconds of CPU time or gigabytes of memory. The requests need no authentication. - `OverlappingFieldsCanBeMerged` compared all pairs of…
-
High 7.5
Stack overflow on deeply nested GraphQL documents
The parser of `juniper` called itself once for each level of nesting in a GraphQL document. The parser had no limit on the nesting depth. Deeply nested selection sets, input values, and list types thus overflowed the stack of the thread that parsed the docume…
-
High 7.5
Unbounded memory use on large request bodies
The `graphql()` and `graphql_sync()` functions of `juniper_hyper` read the whole body of a POST request into memory before they parsed the body. The functions had no limit on the size of the body. A client could thus send a large body and exhaust the memory o…
-
High 8.6
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16
-
High 8.1
Axel Download Accelerator Path Traversal via URL Filename Decoding
Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in th…
-
High 7.3
Norton, Avast, and AVG local privilege escalation via link following in Data Shredder
Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operati…
-
High 8.4
Drivers: hv: Don't reset VMBus connection state on error/exit paths
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmb…
-
High 7.8
vsock: treat TCP_CLOSING as once-established
In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCP_CLOSING as once-established Handle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can race with the connect loop. Immediately break and return 0 on ESTABLISHE…
-
High 7.0
net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure
In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure rds_rdma_cm_event_handler_cmn() hands the return value of rdma_resolve_route() straight back to the rdma_cm on RDM…
-
High 7.8
pipe: preserve existing fasync readers on writer setup failure
In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure F_SETFL and FIOASYNC decide whether to invoke ->fasync() before pipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO …
-
High 8.8
firewire: core: fix race condition in split transaction handling
In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fw_core_handle_response() or split_transaction_timeout_callback() may manipulate the same tran…
-
High 7.8
unicode: free the map after a grace period
In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rc…
-
High 7.8
KVM: SEV: Fix page dirtying in sev_gmem_post_populate()
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sev_gmem_post_populate() set_page_dirty() requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That…
-
High 7.8
eventfs: Free the eventfs_inode after an rcu grace period too
In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in r…
-
High 8.8
namespace: a mount that copy_tree() leaves out can't take over a lock
In the Linux kernel, the following vulnerability has been resolved: namespace: a mount that copy_tree() leaves out can't take over a lock Since commit c62a4766937e ("move_mount: transfer MNT_LOCKED") a mount can be moved beneath a locked mount. The lock moves…
-
High 7.8
net/sched: fix use-after-free in __tcf_action_put()
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put() __tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these o…
-
High 7.8
spi: imx: fix slab corruption from undersized DMA bounce buffers
In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e ("spi: imx: support dynamic burst length for ECSPI DMA mode"), the driver allocates its private DMA …
-
High 7.8
tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields
In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In check_synth_field(), when a synthetic event field is a stacktrace (field->is_stack) and the histogram field…
-
High 7.8
scsi: st: Fix use-after-free race between st_remove() and st_open()
In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix use-after-free race between st_remove() and st_open() st_remove() drops the probe reference on the scsi_tape with kref_put() and only afterwards removes its index from st_index_…
-
High 7.5
scsi: libiscsi: Validate the task named by a management response
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that the index resolved: case I…
-
High 7.0
drm/amdgpu: keep the eviction fence until the last handle is closed
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpu_gem_object_close() detaches the user queue eviction fence from the BO before it checks bo_va->ref_count, so closing …
-
High 7.8
tracing: Keep the predicate limit separate from program capacity
In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicate_parse() adds two to nr_preds to reserve the terminal TRUE and FALSE entries. It also uses that increased value as th…
-
High 7.1
tracing: Check operator stack capacity before pushing
In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicate_parse() uses the first operator stack entry before processing any opening parentheses. A push then increments top before writin…
-
High 7.0
dm-crypt: fix a tiny race condition in crypt_dec_pending
In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in crypt_dec_pending crypt_dec_pending reads io->error before calling atomic_dec_and_test. Another context, for example crypt_endio called from an interrup…
-
High 8.2
xfs: fix capability check in xfs
In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas …
-
High 7.1
vsock/virtio: validate packet source for connected sockets
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: validate packet source for connected sockets virtio_transport_recv_pkt() looks up sockets first by the full source and destination tuple, then by destination only in the bound t…
-
High 7.3
vsock/vmci: validate packet source for connected sockets
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmci_transport_recv_stream_cb() looks up sockets first by the full source and destination tuple, then by destination only in the bound…
-
High 7.8
net: bridge: mcast: don't truncate the port group walk on teardown
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown __br_multicast_disable_port_ctx() and br_multicast_del_port() walk port->mglist with hlist_for_each_entry_safe(). However, b…
-
High 7.8
net: psp: do not inherit the Rx association on clone
In the Linux kernel, the following vulnerability has been resolved: net: psp: do not inherit the Rx association on clone sk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into every socket accepted from a listener without taking a reference, w…