Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,631
- Last 24h
- 2,093
- Critical, 7 days
- 363
- Known exploited
- 1,773
2,620 results · Clear filters · Feed
-
Medium 5.3CVE-2026-22013 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 6.5CVE-2026-22009 Public exploit
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 5.4CVE-2026-22006 Public exploit
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Employee Snapsh…
-
Medium 4.9CVE-2026-22005 Public exploit
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 4.9CVE-2026-22004 Public exploit
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 6.0CVE-2026-22003 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
-
Medium 4.9CVE-2026-22002 Public exploit
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 5.1CVE-2026-41456 Public exploit
Bludit CMS Reflected XSS via Search Plugin
Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Attackers can execute malicious scripts …
-
Medium 6.5CVE-2026-6770 Public exploit
Other issue in the Storage: IndexedDB component
Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
-
Medium 5.3CVE-2026-6765 Public exploit
Information disclosure in the Form Autofill component
Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
-
Medium 4.5CVE-2026-6060 Public exploit
Possible DoS via SQL Box
A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be killed by the systemThis issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X befor…
-
Medium 6.5CVE-2025-66954 Public exploit
A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users t…
-
Medium 4.3CVE-2026-41285 Public exploit
In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Di…
-
Medium 5.3CVE-2026-26399 Public exploit
A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() functio…
-
Medium 5.4CVE-2026-35603 Public exploit
Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows
Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or access permissions. Because …
-
Medium 5.5CVE-2025-70795 Public exploit
STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOC…
-
Medium 5.4CVE-2026-1880 Public exploit
An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows priv…
-
Medium 5.3CVE-2026-40179 Public exploit
Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer
Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values a…
-
Medium 5.4CVE-2026-34213 Public exploit
Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation
Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same wo…
-
Medium 5.4CVE-2026-34212 Public exploit
Docmost page content has stored XSS via unsanitized attachment URLs
Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment nod…
-
Medium 4.3CVE-2026-33146 Public exploit
Docmost's Public Share Search Exposes Metadata of Restricted Children
Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-se…
-
Medium 4.3CVE-2026-33829 Public exploit
Windows Snipping Tool Spoofing Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network.
-
Medium 6.5
Microsoft SharePoint Server Spoofing Vulnerability
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
KEV Apr 14, 2026 -
Medium 6.8CVE-2026-32223 Public exploit
Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack.
-
Medium 4.3
Windows Shell Spoofing Vulnerability
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
KEV Apr 28, 2026 -
Medium 4.9CVE-2026-22692 Public exploit
October CMS: Twig Sandbox Bypass via Collection Methods
October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper wer…
-
Medium 6.1CVE-2025-69993 Public exploit
Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. Thi…
-
Medium 6.5CVE-2026-30480 Public exploit
A Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2 allows…
-
Medium 4.6CVE-2026-33657 Public exploit
EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have a stored HTML injection vulnerability that allows any authenticated user with standard (non-administrative) privileges to inject arbitrary HTML into system-g…
-
Medium 4.3CVE-2026-33534 Public exploit
EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 represen…
-
Medium 5.4CVE-2026-6201 Public exploit
CodeAstro Online Job Portal Delete Job Posting job-delete.php access control
A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.php of the component Delete Job Posting Handler. Such manipulation of the argument ID leads to improper access controls…
-
Medium 6.6CVE-2026-21010 Public exploit
Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged f…
-
Medium 5.1CVE-2026-21008 Public exploit
Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensiti…
-
Medium 5.1CVE-2026-21014 Public exploit
Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. Us…
-
Medium 6.9CVE-2026-21013 Public exploit
Incorrect default permission in Galaxy Wearable prior to version 2.2.68.26 allows local attackers to access sensitive i…
-
Medium 6.8CVE-2026-21012 Public exploit
External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create …
-
Medium 5.4CVE-2026-21011 Public exploit
Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attacke…
-
Medium 4.1CVE-2026-21009 Public exploit
Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass…
-
Medium 4.4CVE-2026-21007 Public exploit
Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to b…
-
Medium 4.7CVE-2026-21006 Public exploit
Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden no…