Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 405,858
- Last 24h
- 566
- Critical, 7 days
- 315
- Known exploited
- 1,769
233 results · Clear filters · Feed
-
Low 3.5CVE-2026-120218 Public exploit
Typemill SvgSanitizer.php saveImage cross site scripting
A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the file system/typemill/Models/SvgSanitizer.php. Executing a manipulation can lead to cross site scripting. The attack may be performed from…
-
Low 3.7CVE-2026-118776 Public exploit
Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node…
-
Low 3.7CVE-2026-116105 Public exploit
HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission
A weakness has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component Network Security Configuration. Executing a manipulation can lead to cleartext transmission of sensitive informa…
-
Low 3.5CVE-2026-116004 Public exploit
onyx-dot-app Onyx PreviewTab.tsx cross site scripting
A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remo…
-
Low 3.6CVE-2026-116012 Public exploit
Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sl…
-
Low 3.3CVE-2026-106073 Public exploit
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissi…
-
Low 3.6CVE-2026-106071 Public exploit
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--all…
-
Low 3.7CVE-2026-106070 Public exploit
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after t…
-
Low 3.5CVE-2026-105950 Public exploit
getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting
A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument…
-
Low 1.2CVE-2026-103585 Public exploit
attacker-controlled javascript license URL via XSS
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.
-
Low 1.1CVE-2026-103584 Public exploit
attacker-controlled javascript license URL via XSS
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, …
-
Low 1.2CVE-2026-103440 Public exploit
pagetriagelist discloses suppressed reviewer usernames
Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.
-
Low 1.1CVE-2026-103437 Public exploit
ReadingLists imported metadata permits JavaScript URL XSS
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.
-
Low 1.2CVE-2026-103445 Public exploit
Stored XSS through PageForms #autoedit redirect links
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS. This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1.43.
-
Low 2.3CVE-2026-96874 Public exploit
Stored XSS in Cargo Drilldown tab names
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
-
Low 2.7CVE-2026-93661 Public exploit
Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to t…
-
Low 2.9CVE-2026-96872 Public exploit
WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions
Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki -…
-
Low 3.7CVE-2026-93528 Public exploit
NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page
The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key.
-
Low 2.4CVE-2026-0303 Public exploit
Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File
A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file.
-
Low 3.8CVE-2026-73318 Public exploit
XenForo < 2.3.13 Missing Authorization via force-agreement Controller
XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permi…
-
Low 2.7CVE-2026-73317 Public exploit
XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher
XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job clas…
-
Low 3.1CVE-2026-19975 Public exploit
Azuriom CMS Money Transfer ProfileController.php transferMoney toctou
A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the component Money Transfer Handler. This manipulation causes time-of-check time-of-use. The a…
-
Low 3.7CVE-2026-58044 Public exploit
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…
-
Low 3.3CVE-2026-58039 Public exploit
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…
-
Low 3.3CVE-2026-56847 Public exploit
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside…
-
Low 3.7CVE-2026-66753 Public exploit
tiny-http 0.12.0 HTTP Response Splitting via Header Injection
tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into HTTP header values on both request and response sides due to insufficient validation in header pars…
-
Low 1.8CVE-2026-40000 Public exploit
Path Traversal Vulnerability in ZTE Blade A75 5G
The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fileprovide…
-
Low 3.7CVE-2026-26080 Public exploit
HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAPr…
-
Low 3.3CVE-2026-50416 Public exploit
Win32k Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally.
-
Low 3.3CVE-2026-13233 Public exploit
OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053
Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.
-
Low 2.4CVE-2026-55781 Public exploit
NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields
NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's UFS and FFS image handler in NanaZip.Codecs.Archive.Ufs.cpp validates the superblock block size only against the MINBSIZE lower bound and does not valid…
-
Low 2.4CVE-2026-55780 Public exploit
NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size
NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in NanaZip.Codecs.Archive.DotNetSingleFile.cpp sizes its extraction buffer from the bundle entry Size field, which is on…
-
Low 2.1CVE-2026-58225 Public exploit
SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service
SQL Injection vulnerability in elixir-ecto postgrex allows an attacker who can influence a LISTEN channel name to inject SQL into the reconnect replay query, causing a denial of service of the notification connection. Postgrex.Notifications sanitizes channel …
-
Low 3.7CVE-2026-46584 Public exploit
Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parameters
Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer (MailProducer.getSender) scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smt…
-
Low 3.3CVE-2026-57588 Public exploit
SQL Injection in Nessus via Malicious Scan Result File Import
A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.
-
Low 2.9CVE-2026-57062 Public exploit
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM becau…
-
Low 2.3CVE-2026-29114 Public exploit
A vulnerability has been found in some Dahua products. An attacker may obtain the device’s CA root certificate. If that…
-
Low 1.2CVE-2025-59382 Public exploit
QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)
QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the following version:
-
Low 2.1CVE-2026-48598 Public exploit
CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection
Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values. Tesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{…
-
Low 3.1CVE-2026-49009 Public exploit
Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.