Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,381
- Last 24h
- 670
- Critical, 7 days
- 338
- Known exploited
- 1,779
12,723 results · Clear filters · Feed
-
Low 3.5
SysReptor: Anonymous note-share link discloses project member identities and non-shared note activity
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as …
-
Low 3.6
Cockpit: cockpit: unauthorized modification of login records via integer overflow
A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of login records. On 32-bit systems, an integer overflow during session accounting allows the user's login process t…
-
Low 2.0
NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS
NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_codec.c does not handle a failed read_uint16() while counting topics in a malformed UNSUBSCRIBE packet. A zero-length to…
-
Low 3.7
NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing
NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c uses property_append() to walk the entire linked list for each property added by decode_buf_properties(). A remote unauthenticated client c…
-
Low 3.5
CareCam CM2507 Missing Authentication for Critical Function
A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access func…
-
Low 3.1
CareCam CM2507 Missing Authentication for Critical Function
CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who satisfies certain device state conditions could make the service remotely acces…
-
Low 3.7
libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heif_image_create() and hei…
-
Low 3.1
Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames
gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() and switched on hdr->message_type without first checking that the received frame carries at least sizeof(struct gptp_hdr) (34) bytes of payload. The he…
-
Low 3.2
Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks
xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restr…
-
Low 3.5
SveltyCMS SVG Media Upload media-service.server.ts cross site scripting
A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated…
-
Low 2.2
rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass
rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.…
-
Low 2.2
rustls webpki Name Constraints URI Validation Bypass
rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are…
-
Low 3.7
ImageMagick before 7.1.2-31 Division by Zero in FLIF encoder
ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is …
-
Low 3.7
ImageMagick before 7.1.2-31 Policy Bypass in UHDR encoder
ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potential…
-
Low 3.1
ImageMagick before 7.1.2-31 Null Pointer Dereference via PNM
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferen…
-
Low 2.9
ImageMagick before 7.1.2-31 Use After Free via ImagesToBlob
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected pro…
-
Low 3.3
ImageMagick before 7.1.2-31 Policy Bypass via PCD decoder
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can resu…
-
Low 3.3
Sensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS Shell
An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive …
-
Low 3.1
HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806)
HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict o…
-
Low 3.7
An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manage…
-
Low 3.1
HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized ac…
-
Low 3.1
HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IP addresses from the application's responses, enabling them to map the underlying network topology a…
-
Low 2.7
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler…
-
Low 3.5
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Ma…
-
Low 2.7
Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin befor…
-
Low 2.7
Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.
-
Low 2.7
MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's …
-
Low 3.8
King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownersh…
-
Low 2.7
King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of p…
-
Low 3.8
MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free co…
-
Low 3.1
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships…
-
Low 3.1
Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised …
-
Low 3.1
Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the …
-
Low 3.7
Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker …
-
Low 3.7
libmongoc SCRAM client nonce-validation bypass
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-m…
-
Low 2.7
Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions wi…
-
Low 2.1
punchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To
punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added Reply-To header intended to …
-
Low 1.0
uniget: EDITOR Command Injection in uniget CLI
uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an argument to the sele…
-
Low 2.3
mport mirror-selection ping accepts insufficiently validated ICMP replies
mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fixed IP-header offset instead of ip_hl. A network attacker able to inject or spoof v…
-
Low 2.0
mport verify can compare stale checksum data after hashing failures
mport is the MidnightBSD Package Manager. Prior to 2.7.8, mport_verify_package() in libmport/verify.c could continue after MD5File() or SHA256_File() failed and compare an expected checksum with stale data in the hash buffer rather than a newly computed diges…