Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,464
- Last 24h
- 605
- Critical, 7 days
- 338
- Known exploited
- 1,779
107,987 results · Clear filters · Feed
-
Medium 5.3
Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an…
-
Medium 6.3
HPE NonStop Kernel - Access to unmapped or privileged data
A security vulnerability in HPE NonStop Kernel may allow user space access to privileged or unmapped data.
-
Medium 4.2
Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite
The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and f…
-
Medium 6.5
Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any camp…
-
Medium 5.3
eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, …
-
Medium 6.1
Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'
The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possibl…
-
Medium 6.4
VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature
The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authentic…
-
Medium 6.1
Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. …
-
Medium 6.4CVE-2026-17001 Public exploit
Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This…
-
Medium 6.5
Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_short…
-
Medium 6.4
Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitiz…
-
Medium 5.7
HPE NonStop EXPAND - Out-of-Bounds memory read vulnerability
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
-
Medium 4.7
HPE NonStop EXPAND - Out-of-Bounds memory read
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
-
Medium 6.4
Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escap…
-
Medium 6.4
HPE NonStop EXPAND - Out-of-Bounds memory read/write
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operations
-
Medium 5.0
Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the c…
-
Medium 5.9
HPE NonStop TELSERV - Memory corruption vulnerability
A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.
-
Medium 5.3
HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability
A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service when traceroute is executed under certain conditions.
-
Medium 5.3
ApostropheCMS: Page REST API authorization bypass
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.
-
Medium 5.5
An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information a…
-
Medium 6.1
ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityCo…
-
Medium 5.4
XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog).…
-
Medium 5.4
XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeContr…
-
Medium 6.2
A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service…
-
Medium 5.0CVE-2026-78850 Public exploit
An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / Site…
-
Medium 6.5CVE-2026-78851 Public exploit
Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive informat…
-
Medium 4.3
sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service
A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create_req of the file python/sglang/srt/session/session_controller.py of the component Session Cleanup. Such manipulation leads to d…
-
Medium 4.3
sgl-project SGLang generate Endpoint io_struct.py denial of service
A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/io_struct.py of the component generate Endpoint. This manipulation of the argument session_par…
-
Medium 5.9
Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines wit…
-
Medium 6.5
Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens o…
-
Medium 5.3
Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comme…
-
Medium 4.7
Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pu…
-
Medium 6.1
GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()
GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vend…
-
Medium 6.5
GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name
GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft …
-
Medium 6.3
n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable componen…
-
Medium 6.1
n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which p…
-
Medium 6.0
n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated us…
-
Medium 6.1
n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval
n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list…
-
Medium 6.5
FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Content-Type
FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a …
-
Medium 4.0
FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token
FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host header. A remote unaut…