Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,964
- Last 24h
- 1,942
- Critical, 7 days
- 354
- Known exploited
- 1,779
12,708 results · Clear filters · Feed
-
Low 3.5
Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable…
-
Low 3.7
Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From…
-
Low 3.8
YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax
The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.…
-
Low 3.7
WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user accoun…
-
Low 3.7
WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.
-
Low 3.5
LetterPress < 2.4.0 - Admin+ Stored XSS
The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for ex…
-
Low 3.5
LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes i…
-
Low 3.5
configuroweb inventariobasico Add Product addlist.php cross site scripting
A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affects unknown code of the file addlist.php of the component Add Product Page. Such manipula…
-
Low 3.7
xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can sup…
-
Low 3.1
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately be…
-
Low 3.7
go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated a…
-
Low 3.7
i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand …
-
Low 2.1
Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call suppl…
-
Low 3.5
PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats
PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore read a limited subset of the data through the statistics view's histograms and mcvs. The vulnerability is resolved in Post…
-
Low 3.5
PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles
PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions
-
Low 3.5
Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability
Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. A…
-
Low 3.7
Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.
An Improper Initialization vulnerability in the SSR software in Juniper Networks Session Smart Router allows an attacker to decrypt traffic or cause a denial of service via security policy assignment.
-
Low 3.7
HCL BigFix AEX is affected by multiple security vulnerabilities.
HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or non‐AWS endpoints.
-
Low 2.3
Incorrect session validation for API-created shredder exports
The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creatin…
-
Low 3.6
Protection mechanism failure due to missing binary hardening in Linux executables. The following products are affected:…
-
Low 3.1
Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Prot…
-
Low 2.7
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions…
-
Low 2.7
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions…
-
Low 3.4
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through …
-
Low 2.7
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions…
-
Low 2.7
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions…
-
Low 2.7
GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode
The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and cust…
-
Low 3.8
Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page
The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or dr…
-
Low 3.8
Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with…
-
Low 2.7
Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read …
-
Low 3.8
Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifie…
-
Low 3.5
a2ui-project a2ui Parser expression_parser.ts formatString resource consumption
A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts of the component Parser. This manipulation causes res…
-
Low 3.7
LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on n…
-
Low 3.7
LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters an…
-
Low 3.7
LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed charact…
-
Low 2.3
Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `app_sms.c` copies externally controlled `SMS` lengths into `fixed in-struct buffers`…
-
Low 2.3
pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)
pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte len…
-
Low 3.3
russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and …
-
Low 2.0
Lenient parsing of integers for response body and chunk framing
Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.
-
Low 3.1
CKEditor: Cross-site scripting (XSS) in the engine package
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object conten…