Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,354
- Last 24h
- 680
- Critical, 7 days
- 350
- Known exploited
- 1,779
12,722 results · Clear filters · Feed
-
Low 2.7
LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR
The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any…
-
Low 2.7
Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress o…
-
Low 2.7
Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update via IDOR
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the c…
-
Low 3.4
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enh…
-
Low 3.4
Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) passes …
-
Low 2.1
A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions befo…
-
Low 2.1
A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabri…
-
Low 3.3
The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application …
-
Low 3.9
Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with…
-
Low 3.7
GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU)…
-
Low 3.7
In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actio…
-
Low 3.7
AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invali…
-
Low 3.7
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptog…
-
Low 3.7
Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy
Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bc…
-
Low 2.9
M17n-lib: null dereference in minput_open_im() after failed m17n_init()
A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an …
-
Low 2.1
Apache YuniKorn: LDAP Group provider panics on lowercase attribute name
Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the …
-
Low 2.0
Apache YuniKorn: Admission control bypass via workload UPDATE operation
Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemon…
-
Low 2.7
CP Media Player < 1.3.4 - Contributor+ Media Player Settings Update
The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change …
-
Low 2.5
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
-
Low 2.9
In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpecte…
-
Low 3.1
Backstage: Inconsistent enforcement of allowed location types during catalog processing
Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog…
-
Low 3.1
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is…
-
Low 3.6
In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but …
-
Low 2.5
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwa…
-
Low 3.0
Backstage: Cloud storage catalog locations may cross configured storage boundaries
Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog sourc…
-
Low 2.5
In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mis…
-
Low 3.5
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery…
-
Low 3.7
In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the…
-
Low 2.2
In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentic…
-
Low 2.2
In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authenticat…
-
Low 3.7
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty bl…
-
Low 3.1
Security Advisory 0196
On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory con…
-
Low 3.1
Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised …
-
Low 3.3
Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineeri…
-
Low 3.1
Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-orig…
-
Low 3.1
Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially ob…
-
Low 3.1
Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromi…
-
Low 3.1
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-…
-
Low 3.5CVE-2026-105950 Public exploit
getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting
A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument…
-
Low 3.7
i18next-http-backend incomplete URL validation permits SSRF
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{ln…