Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,476
- Last 24h
- 551
- Critical, 7 days
- 337
- Known exploited
- 1,779
97,656 results · Clear filters · Feed
-
High 8.8
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF)…
-
High 7.3
code-projects Simple Content Management System Admin welcome.php authorization
A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization.…
-
High 8.8
A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in…
-
High 8.8
Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode
Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and r…
-
High 7.8
llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer
llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed v…
-
High 8.2
llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs
llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and llama_encode_internal that allows remote unauthenticated attackers to read memory by supplying unvalidated token IDs. Attackers can send integer-array prompts to …
-
High 8.8
A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Sc…
-
High 7.3
Tencent RapidJSON Regex stream.h Take out-of-bounds
A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream<UTF8<char>>::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds…
-
High 8.8
Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` in a value was executed…
-
High 8.5
OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC…
-
High 8.2
OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket
OpenPanel before 3.0.0 contains an unauthenticated ClickHouse SQL injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Att…
-
High 8.8
OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template
OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into…
-
High 7.2
OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses an…
-
High 8.7
compress zstd: Panic on two-block frames
compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768.…
-
High 8.8CVE-2026-116748 Scanner template
Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response …
-
High 8.1CVE-2026-116747 Scanner template
Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrat…
-
High 8.8
VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder
VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length characte…
-
High 7.8
FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow
FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding…
-
High 7.8
FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field
FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256…
-
High 8.2
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled e…
-
High 8.7
Datadog dd-trace-py: ReDOS in URL query string obfuscation
Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP …
-
High 7.5
Go JOSE: DoS when parsing JWKs that contain RSA keys
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-c…
-
High 7.5
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payloa…
-
High 7.8
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS…
-
High 8.4
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, …
-
High 7.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS…
-
High 7.8
A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS…
-
High 7.1
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 2…
-
High 7.1
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS…
-
High 7.5
A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, m…
-
High 7.8
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS…
-
High 7.5
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Golden Gate 27.2. An app ma…
-
High 7.5
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26…
-
High 7.8
An integer overflow was addressed with improved input validation. This issue is fixed in visionOS 27.2. Processing a ma…
-
High 7.8
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2…
-
High 8.8
A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27.2, iOS 26.7.2 and…
-
High 8.8
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, …
-
High 7.8
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, …
-
High 7.1
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS…
-
High 7.5
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS…