Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,442
- Last 24h
- 646
- Critical, 7 days
- 338
- Known exploited
- 1,779
107,980 results · Clear filters · Feed
-
Medium 6.3
A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials …
-
Medium 6.9
A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.
-
Medium 6.9
A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the servi…
-
Medium 6.9
An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the s…
-
Medium 6.9
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to cras…
-
Medium 6.9
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to cras…
-
Medium 6.9
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to cras…
-
Medium 4.3
QBinaryJson::fromBinaryData() integer overflow leading to OOB read
A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.
-
Medium 6.9
Multiple vulnerabilities in FacturaScripts
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid us…
-
Medium 6.9
Multiple vulnerabilities in FacturaScripts
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could …
-
Medium 6.6
Possible DOM XSS in SNS Web Administration Portal
It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure a…
-
Medium 4.8
Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequa…
-
Medium 6.5
ArmorX Global Technology｜ArmorX Spam - Command Injection
ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.
-
Medium 6.1
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before val…
-
Medium 4.8
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the W…
-
Medium 6.4
DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action
The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authentic…
-
Medium 5.1
A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting …
-
Medium 6.5
ArmorX Global Technology｜ArmorX Spam - Local File Inclusion
ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.
-
Medium 4.3
Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead …
-
Medium 5.3
Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, s…
-
Medium 4.9
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A us…
-
Medium 5.4
UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may l…
-
Medium 6.5
An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.…
-
Medium 5.3
Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send spec…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS…
-
Medium 5.5
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.8, ma…
-
Medium 5.5
A privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to …
-
Medium 4.3
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS G…
-
Medium 5.9
A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7…
-
Medium 5.5CVE-2026-86962 Public exploit
A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS…
-
Medium 4.3
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7…
-
Medium 6.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An ap…
-
Medium 4.6
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, …
-
Medium 5.5
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26…
-
Medium 5.5
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. An app may be ab…
-
Medium 5.5
This issue was addressed by removing additional entitlements. This issue is fixed in macOS Golden Gate 27. An app may b…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An ap…
-
Medium 5.5
A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27. An app may b…
-
Medium 4.3
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, …