WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Has a public PoC✕
Overview 31,192 matches · 642 in Waratek scope · 254 protected · 3,300 exploited · 1,061 CISA KEV · 3,305 EPSS ≥ 0.5
31,192matches 642in Waratek scope2.1% 254protected0.8% 3,300exploited10.6% 1,061CISA KEV3.4% 3,305EPSS ≥ 0.510.6%
Protected by Waratek 261 0.8% Rule in development 6 0.0% Mitigation candidate 375 1.2% No exploit published 0 0.0% Outside Waratek scope 256 0.8% Not applicable 30,163 96.7% Withdrawn CVE 131 0.4%
Critical 3,604 11.6% High 14,972 48.0% Medium 11,832 37.9% Low 650 2.1% None 1 0.0% Unknown 133 0.4%
blocked by ARMR today 254 0.8% partly blocked 7 0.0% not blocked 30,931 99.2% not established 0 0.0% unrecorded 0 0.0%
Exploited 3,300 10.6% Working exploit published 26,490 84.9% Proof of concept only 1,402 4.5% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2,638 / year
Withdrawn CVE: 131Not applicable: 30,163Outside Waratek scope: 256Mitigation candidate: 375Rule in development: 6Protected by Waratek: 261 Unknown: 133None: 1Low: 650Medium: 11,832High: 14,972Critical: 3,604 not blocked: 30,931partly blocked: 7blocked by ARMR today: 254 Proof of concept only: 1,402Working exploit published: 26,490Exploited: 3,300
19881 Not applicable1 High1 not blocked1 Working exploit published1 19890 19901 Not applicable1 Medium1 not blocked1 Working exploit published1 19912 Not applicable2 High2 not blocked2 Working exploit published2 19920 19930 19946 Not applicable6 High3 Medium2 Low1 not blocked6 Working exploit published6 19955 Not applicable5 Critical1 High2 Medium2 not blocked5 Working exploit published5 199618 Not applicable17 Withdrawn CVE1 High12 Medium5 Unknown1 not blocked18 Working exploit published18 199775 Not applicable75 High53 Medium18 Low4 not blocked75 Exploited2 Working exploit published73 199851 Not applicable51 Critical1 High34 Medium11 Low5 not blocked51 Exploited1 Working exploit published50 1999283 Outside Waratek scope1 Not applicable281 Withdrawn CVE1 Critical2 High133 Medium119 Low28 Unknown1 not blocked283 Exploited1 Working exploit published282 2000431 Mitigation candidate6 Outside Waratek scope1 Not applicable424 Critical1 High200 Medium196 Low34 not blocked431 Exploited4 Working exploit published427 2001490 Mitigation candidate2 Outside Waratek scope4 Not applicable484 Critical4 High229 Medium219 Low38 not blocked490 Exploited10 Working exploit published480 2002551 Mitigation candidate8 Outside Waratek scope4 Not applicable537 Withdrawn CVE2 Critical3 High282 Medium246 Low18 Unknown2 not blocked551 Exploited6 Working exploit published545 2003508 Protected by Waratek1 Mitigation candidate7 Outside Waratek scope2 Not applicable497 Withdrawn CVE1 Critical3 High245 Medium243 Low16 Unknown1 blocked by ARMR today1 not blocked507 Exploited9 Working exploit published499 2004768 Mitigation candidate1 Outside Waratek scope1 Not applicable766 Critical4 High311 Medium417 Low36 not blocked768 Exploited13 Working exploit published755 20051,361 Protected by Waratek1 Mitigation candidate4 Outside Waratek scope4 Not applicable1,347 Withdrawn CVE5 Critical5 High669 Medium628 Low54 Unknown5 blocked by ARMR today1 not blocked1,360 Exploited20 Working exploit published1,341 20062,462 Protected by Waratek1 Mitigation candidate4 Outside Waratek scope7 Not applicable2,447 Withdrawn CVE3 Critical4 High1,214 Medium1,142 Low99 Unknown3 blocked by ARMR today1 not blocked2,461 Exploited21 Working exploit published2,440 Proof of concept only1 20072,528 Protected by Waratek1 Mitigation candidate10 Outside Waratek scope12 Not applicable2,502 Withdrawn CVE3 Critical8 High1,430 Medium1,057 Low30 Unknown3 blocked by ARMR today1 not blocked2,527 Exploited31 Working exploit published2,495 Proof of concept only2 20082,546 Protected by Waratek4 Mitigation candidate9 Outside Waratek scope6 Not applicable2,522 Withdrawn CVE5 Critical6 High1,514 Medium991 Low30 Unknown5 blocked by ARMR today4 not blocked2,542 Exploited25 Working exploit published2,518 Proof of concept only3 20092,638 Protected by Waratek4 Mitigation candidate13 Outside Waratek scope9 Not applicable2,606 Withdrawn CVE6 Critical7 High1,457 Medium1,135 Low33 Unknown6 blocked by ARMR today4 not blocked2,634 Exploited46 Working exploit published2,591 Proof of concept only1 20101,367 Protected by Waratek5 Mitigation candidate11 Outside Waratek scope13 Not applicable1,336 Withdrawn CVE2 Critical10 High770 Medium557 Low28 Unknown2 blocked by ARMR today5 not blocked1,362 Exploited53 Working exploit published1,313 Proof of concept only1 2011718 Protected by Waratek3 Mitigation candidate9 Outside Waratek scope8 Not applicable695 Withdrawn CVE3 Critical3 High398 Medium300 Low14 Unknown3 blocked by ARMR today3 not blocked715 Exploited22 Working exploit published691 Proof of concept only5 2012868 Protected by Waratek3 Mitigation candidate19 Outside Waratek scope14 Not applicable827 Withdrawn CVE5 Critical9 High335 Medium485 Low34 Unknown5 blocked by ARMR today3 not blocked865 Exploited31 Working exploit published831 Proof of concept only6 2013586 Protected by Waratek7 Mitigation candidate15 Outside Waratek scope19 Not applicable525 Withdrawn CVE20 Critical10 High284 Medium250 Low22 Unknown20 blocked by ARMR today7 not blocked579 Exploited64 Working exploit published520 Proof of concept only2 2014868 Protected by Waratek7 Mitigation candidate12 Outside Waratek scope4 Not applicable834 Withdrawn CVE11 Critical9 High385 Medium435 Low28 Unknown11 blocked by ARMR today7 not blocked861 Exploited60 Working exploit published795 Proof of concept only13 2015724 Protected by Waratek7 Mitigation candidate5 Outside Waratek scope7 Not applicable700 Withdrawn CVE5 Critical16 High393 Medium276 Low34 Unknown5 blocked by ARMR today7 not blocked717 Exploited62 Working exploit published647 Proof of concept only15 2016506 Protected by Waratek13 Mitigation candidate11 Outside Waratek scope1 Not applicable477 Withdrawn CVE4 Critical78 High288 Medium132 Low4 Unknown4 blocked by ARMR today12 partly blocked1 not blocked493 Exploited56 Working exploit published429 Proof of concept only21 20171,424 Protected by Waratek25 Mitigation candidate13 Outside Waratek scope7 Not applicable1,369 Withdrawn CVE10 Critical377 High681 Medium354 Low2 Unknown10 blocked by ARMR today23 partly blocked2 not blocked1,399 Exploited129 Working exploit published1,260 Proof of concept only35 20181,260 Protected by Waratek21 Mitigation candidate16 Outside Waratek scope20 Not applicable1,197 Withdrawn CVE6 Critical347 High524 Medium377 Low6 Unknown6 blocked by ARMR today20 partly blocked1 not blocked1,239 Exploited131 Working exploit published1,069 Proof of concept only60 20191,118 Protected by Waratek27 Rule in development1 Mitigation candidate23 Outside Waratek scope25 Not applicable1,039 Withdrawn CVE3 Critical273 High490 Medium352 Unknown3 blocked by ARMR today25 partly blocked2 not blocked1,091 Exploited234 Working exploit published784 Proof of concept only100 2020966 Protected by Waratek29 Mitigation candidate32 Outside Waratek scope27 Not applicable873 Withdrawn CVE5 Critical283 High408 Medium267 Low3 Unknown5 blocked by ARMR today29 not blocked937 Exploited231 Working exploit published603 Proof of concept only132 2021857 Protected by Waratek25 Rule in development1 Mitigation candidate22 Outside Waratek scope16 Not applicable792 Withdrawn CVE1 Critical252 High290 Medium313 Low1 Unknown1 blocked by ARMR today25 not blocked832 Exploited294 Working exploit published446 Proof of concept only117 20221,023 Protected by Waratek22 Rule in development1 Mitigation candidate20 Outside Waratek scope10 Not applicable960 Withdrawn CVE10 Critical312 High351 Medium348 Low2 Unknown10 blocked by ARMR today22 not blocked1,001 Exploited288 Working exploit published566 Proof of concept only169 20231,046 Protected by Waratek14 Mitigation candidate35 Outside Waratek scope13 Not applicable977 Withdrawn CVE7 Critical345 High386 Medium306 Low2 Unknown7 blocked by ARMR today14 not blocked1,032 Exploited339 Working exploit published557 Proof of concept only150 2024961 Protected by Waratek14 Mitigation candidate24 Outside Waratek scope6 Not applicable913 Withdrawn CVE4 Critical384 High365 Medium200 Low7 Unknown5 blocked by ARMR today13 partly blocked1 not blocked947 Exploited371 Working exploit published405 Proof of concept only185 20251,128 Protected by Waratek15 Rule in development3 Mitigation candidate22 Outside Waratek scope9 Not applicable1,072 Withdrawn CVE7 Critical415 High412 Medium269 Low25 Unknown7 blocked by ARMR today15 not blocked1,113 Exploited377 Working exploit published593 Proof of concept only158 20261,047 Protected by Waratek12 Mitigation candidate22 Outside Waratek scope6 Not applicable1,006 Withdrawn CVE1 Critical432 High421 Medium179 Low12 None1 Unknown2 blocked by ARMR today12 not blocked1,035 Exploited369 Working exploit published452 Proof of concept only226
1990199419982002200620102014201820222026
31,192 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 312 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-64858 Medium 2026-11-11 Not applicable Working exploit published vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16.
CVE-2026-63505 Medium 2026-11-11 Not applicable Working exploit published Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.223.1, Probo's console GraphQL API is a multi-tenant GRC platform where all data is scoped to an organization. A Finding can reference a Risk via finding.riskId. That reference is stored without validating that the risk belongs to the caller's organization, and the Finding.risk field resolver authorizes the finding (caller's org) instead of the risk, then loads the risk with a tenant scope derived from the risk's own global ID. As a result, an authenticated member of organization A can attach an arbitrary organization B risk GID to a finding they own and then read organization B's Risk (name, description, treatment, category, severity, owner) — with no membership in B. The stored cross-tenant reference also blocks B from deleting its own risk (ON DELETE RESTRICT), a cross-tenant integrity/DoS. This issue has been patched in version 0.223.1.
CVE-2026-119618 High 2026-11-11 Not applicable Proof of concept only Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
CVE-2026-119302 Medium 2026-11-11 Not applicable Working exploit published The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request.
CVE-2026-88235 High 2026-11-10 Not applicable Proof of concept only Unintended proxy or intermediary ('confused deputy') in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
CVE-2026-126187 Critical 2026-11-10 Not applicable Proof of concept only React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Applications whose React code does not use a server are not affected. Applications that do not use a framework, bundler, or bundler plugin that supports React Server Components are not affected. This issue is fixed in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.
CVE-2026-125357 Medium 2026-11-10 Not applicable Working exploit published Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle_request that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../<file> to bypass the '/../' substring check and read munin.conf and plugin-conf.d files containing monitored service credentials.
CVE-2026-124194 Medium 2026-11-10 Not applicable Exploited Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-119987 High 2026-11-10 Not applicable Proof of concept only Untrusted search path in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.
CVE-2026-123270 Critical 2026-11-09 Not applicable Working exploit published Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (RCE). In streams mode, the management HTTP API is exposed on `0.0.0.0:4195`, but authentication is disabled by default and there is no authentication gate protecting the stream CRUD routes. An unauthenticated attacker with network access to TCP/4195 can `POST` a malicious pipeline definition to `/streams/{id}` that includes code-executing processors such as `command`, `subprocess`, `ffi`, or unsafe `sql_raw`, thereby achieving arbitrary RCE on the host with the permissions of the Redpanda Connect service account. Because pipelines can also return command output in-band via HTTP, this vulnerability enables full host compromise, credential theft, and data exfiltration with no user interaction or credentials required. Starting with v4.111, the API endpoint was reconfigured as opt-in, so this and later versions are no longer vulnerable by default. However, RCE remains achievable on v4.111 and later if the management API is manually enabled via the `--bind-http` flag.
CVE-2026-118267 High 2026-11-07 Not applicable Exploited The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb->update`, `$wpdadb->delete`, and `$wpdadb->insert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.
CVE-2026-118066 Critical 2026-11-07 Not applicable Exploited The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the `OsModel::build_conditions_query()` function in `lib/models/model.php` comparing WHERE-clause values against the literal strings `'IS NULL'` and `'IS NOT NULL'` and concatenating a match directly into SQL without binding it as a parameter, a flaw that neither `sanitize_text_field()` nor the 5.7.5 `is_scalar()` hardening guard closes, since both pass the scalar sentinel through unchanged. This makes it possible for unauthenticated attackers to send `params[password_reset_token]=IS NOT NULL` to the public `customer_cabinet__change_password` AJAX route to match every non-null `account_nonse` value, resolving to the lowest-id customer and overwriting that customer's password to an attacker-chosen value — granting full access to their bookings, orders, and PII, and, when the `wp_users_as_customers` option is enabled, takeover of the linked WordPress subscriber or customer-role account. The attacker can first identify the target customer's email by sending `params[order_intent_key]=IS NOT NULL` to the public `steps__start_from_order_intent` route, which returns the name and email from the first matching order intent, and can then self-arm the required 15-minute password-reset freshness window by triggering a reset for that customer directly.
CVE-2026-62850 Medium 2026-11-06 Not applicable Working exploit published FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrative tools.php maintenance endpoint is reachable without an appropriate authentication or access-control boundary. Response differences for attacker-controlled path values disclose whether arbitrary directories and files exist on the server. The same endpoint validates application-key and database-password candidates without rate limiting, per-session throttling, or a CAPTCHA, allowing unrestricted guessing attempts against application secrets. This issue is fixed in version 1.8.225.
CVE-2026-124027 High 2026-11-06 Not applicable Working exploit published ChatWiki before 2.10.0 contains a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage route that allows unauthenticated attackers to read other tenants' documents. Attackers can enumerate sequential admin_user_id and file id query parameters, bypassing the ownership check, to retrieve PDF-rendered pages of any tenant's knowledge-base documents.
CVE-2026-123488 Critical 2026-11-06 Not applicable Exploited Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.
CVE-2026-69137 High 2026-11-05 Not applicable Working exploit published SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's server_url directly to curl without host, address, or scheme validation. The affected flow begins at CalendarAccount::action_testConnection and uses server_url, CalDAVProvider::makeCalDAVRequest(), and PROPFIND to carry attacker-controlled data or authorization state into the security-sensitive operation. The server sends a PROPFIND request from its network context and returns non-success response bodies, enabling internal-service access, partial response disclosure, service enumeration, and possible cloud metadata access. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-123158 High 2026-11-05 Not applicable Exploited sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
CVE-2026-118523 Medium 2026-11-04 Not applicable Working exploit published The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.
CVE-2026-115574 Medium 2026-11-04 Not applicable Working exploit published Zulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing access-control check allowed include_custom_profile_fields=true to return every user's custom profile field values in addition to the documented limited directory data. This exposed those custom profile field values to unauthenticated visitors. This issue is fixed in version 12.2.
CVE-2026-119495 Medium 2026-11-03 Not applicable Working exploit published Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Search: from n/a through 4.5.2.
CVE-2026-86596 Critical 2026-11-02 Not applicable Exploited The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.
CVE-2026-120597 Low 2026-11-02 Not applicable Working exploit published A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVE-2026-120446 High 2026-11-02 Not applicable Exploited madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.
CVE-2026-120442 Critical 2026-11-02 Not applicable Working exploit published ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.
CVE-2026-116606 Critical 2026-11-02 Not applicable Exploited An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
CVE-2026-120201 Critical 2026-10-31 Not applicable Working exploit published Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
CVE-2026-119977 High 2026-10-31 Not applicable Exploited WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
CVE-2026-116548 High 2026-10-31 Not applicable Exploited The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'optionals' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-116512 Critical 2026-10-31 Not applicable Exploited The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable by unauthenticated attackers because WordPress core executes the route argument's validate_callback inside WP_REST_Server::dispatch() before the route's permission_callback is invoked, meaning the Project_Manage_Capability authorization gate is never reached on the vulnerable code path.
CVE-2026-118539 Medium 2026-10-30 Not applicable Exploited Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.
CVE-2026-116366 Critical 2026-10-30 Not applicable Working exploit published An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
CVE-2026-63286 High 2026-10-28 Not applicable Proof of concept only Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backup for recovery purpose when the update is applied. Delete all these backups and change the credentials stored in AXIS Camera Station Pro.
CVE-2026-59177 High 2026-10-28 Not applicable Working exploit published ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.
CVE-2026-116817 Medium 2026-10-27 Not applicable Working exploit published OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore health.
CVE-2026-116690 High 2026-10-27 Not applicable Exploited MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when a source has a URL scheme, and mlflow.prompt.is_prompt is interpreted by tag presence rather than a true value. A remote caller can store a server-local path as the model version artifact location and use /api/2.0/mlflow/model-versions/get-artifact to read files accessible to the MLflow server process. Default unauthenticated servers require no privileges, while basic-auth deployments are exposed to authenticated users who can create registered models. This issue is fixed in version 3.17.0.
CVE-2026-111585 High 2026-10-27 Not applicable Proof of concept only An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83 may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.
CVE-2026-116748 High 2026-10-26 Not applicable Working exploit published Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.
CVE-2026-116747 Critical 2026-10-26 Not applicable Working exploit published Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.
CVE-2026-116485 Critical 2026-10-26 Not applicable Working exploit published danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.
CVE-2026-112706 Medium 2026-10-26 Not applicable Proof of concept only A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112705 Medium 2026-10-26 Not applicable Proof of concept only An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2. An app may be able to cause unexpected system termination.
CVE-2026-112688 High 2026-10-26 Not applicable Proof of concept only A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Parsing a file may lead to an unexpected app termination or arbitrary code execution.
CVE-2026-112621 High 2026-10-26 Not applicable Proof of concept only An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing a maliciously crafted image may result in memory corruption.
CVE-2026-112611 Medium 2026-10-26 Not applicable Proof of concept only An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted PDF file may lead to memory corruption.
CVE-2026-112487 High 2026-10-26 Not applicable Proof of concept only A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.
CVE-2026-116205 Medium 2026-10-25 Not applicable Working exploit published YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal hosts and ports and read their responses.
CVE-2026-116167 High 2026-10-25 Not applicable Working exploit published SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.
CVE-2026-116070 Medium 2026-10-25 Not applicable Working exploit published Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.
CVE-2026-116067 High 2026-10-25 Not applicable Working exploit published Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.
CVE-2026-116006 Medium 2026-10-25 Not applicable Working exploit published A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116000 Medium 2026-10-25 Not applicable Working exploit published A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-112866 Critical 2026-10-24 Not applicable Working exploit published Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
CVE-2026-98937 Unknown 2026-10-23 Not applicable Proof of concept only In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf_event_open() currently gates perf_allow_kernel() only on !attr.exclude_kernel. However, users can still request kernel callchain collection with attr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1. That still requires kernel profiling privilege, but the existing check does not enforce it. Update the permission check to call perf_allow_kernel() when either kernel sampling is requested or kernel callchains are requested. This keeps permission checks aligned with requested data and prevents unprivileged use of kernel callchain capture.
CVE-2026-93489 High 2026-10-23 Not applicable Proof of concept only Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
CVE-2026-53921 Critical 2026-10-23 Not applicable Proof of concept only odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.
CVE-2026-115886 Medium 2026-10-23 Not applicable Exploited MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or its constructor arguments. When optional trulens and trulens-providers-litellm packages are installed, an attacker can select mlflow.genai.scorers.trulens, choose a model URI outside MLflow's native provider registry so execution uses the LiteLLM fallback, and supply api_base and api_key values that cause the server to send an outbound request to an attacker-chosen or internal host with attacker-controlled headers and body. The vulnerable deserialization occurs before a tracking-store lookup or job submission. This issue is fixed in version 3.17.0.
CVE-2026-105482 High 2026-10-23 Not applicable Proof of concept only A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
CVE-2026-111497 Critical 2026-10-22 Outside Waratek scope Exploited A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVE-2026-92998 High 2026-10-21 Not applicable Working exploit published The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.
CVE-2026-76466 Critical 2026-10-21 Not applicable Proof of concept only A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as&nbsp;root. This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
CVE-2026-114509 Critical 2026-10-21 Not applicable Exploited Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
CVE-2026-109619 Critical 2026-10-21 Not applicable Exploited PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
CVE-2026-109618 Critical 2026-10-21 Not applicable Exploited PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
CVE-2026-75128 Critical 2026-10-20 Not applicable Working exploit published Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).
CVE-2026-110372 Critical 2026-10-18 Not applicable Exploited Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.
CVE-2026-108123 High 2026-10-17 Not applicable Working exploit published The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.
CVE-2026-104736 Critical 2026-10-17 Not applicable Exploited The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.
CVE-2026-94169 Critical 2026-10-16 Not applicable Exploited Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
CVE-2026-89079 Critical 2026-10-16 Not applicable Exploited The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.
CVE-2026-99999 Critical 2026-10-15 Not applicable Exploited In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.
CVE-2026-98432 Critical 2026-10-15 Not applicable Proof of concept only In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build(). A similar issue exists with request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler() clones the request socket with inet_reqsk_clone(), so that the old request socket and its clone share the same ireq_opt, then reqsk_migrate_reset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcp_v4_syn_recv_sock()) when the clone is freed, and tcp_v4_reqsk_destructor() also uses a plain kfree(). Readers already use RCU, and other paths replacing inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor() as well. IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options. tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is only set by CALIPSO. This will be addressed in a separate patch.
CVE-2026-102764 Critical 2026-10-15 Not applicable Exploited The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
CVE-2026-85714 Critical 2026-10-14 Not applicable Working exploit published Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlContent() splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file. This permits arbitrary file access. The demonstrated operating-system command execution chain writes attacker-controlled startup files to a user-site location and then triggers an application Python interpreter configured to load those startup files, resulting in command execution as the JVM service account. This issue is fixed in version 2.13.2.
CVE-2026-76519 Critical 2026-10-14 Not applicable Exploited A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with&nbsp;root privileges on the underlying operating system.
CVE-2026-59774 Critical 2026-10-14 Not applicable Exploited Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.
CVE-2026-110447 Critical 2026-10-14 Not applicable Exploited Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
CVE-2026-97798 High 2026-10-13 Not applicable Proof of concept only Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVE-2026-97793 High 2026-10-13 Not applicable Proof of concept only Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.
CVE-2026-97229 Critical 2026-10-13 Not applicable Exploited GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
CVE-2026-85884 High 2026-10-13 Not applicable Proof of concept only Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.
CVE-2026-83834 High 2026-10-13 Not applicable Proof of concept only Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVE-2026-83681 Medium 2026-10-13 Not applicable Proof of concept only Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.
CVE-2026-106173 Critical 2026-10-13 Not applicable Exploited A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4 all versions, FortiSIEM 7.3 all versions, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions may allow attacker to execute unauthorized code or commands via specially crafted packets.
CVE-2026-104935 High 2026-10-13 Not applicable Exploited Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
CVE-2026-108578 Medium 2026-10-11 Not applicable Working exploit published A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-91136 High 2026-10-10 Not applicable Exploited The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — sanitize_text_field() and esc_html() do not restrict filesystem paths, the file:// stream wrapper, or arbitrary URLs — before it is passed to file_get_contents() (with a wp_remote_get() fallback) and the raw response body is returned in the JSON 'html' field. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2026-107806 Critical 2026-10-09 Not applicable Proof of concept only Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.
CVE-2026-85097 Critical 2026-10-08 Not applicable Exploited The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.
CVE-2026-93674 Critical 2026-10-07 Not applicable Working exploit published IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
CVE-2026-76268 Critical 2026-10-07 Not applicable Working exploit published In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation. Splunk Enterprise versions 10.0.x and 9.4.x are not affected.
CVE-2026-59346 Critical 2026-10-07 Not applicable Proof of concept only VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)
CVE-2026-107181 High 2026-10-07 Not applicable Proof of concept only Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.
CVE-2026-102782 Critical 2026-10-07 Not applicable Working exploit published Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic, non-sanitizing input filter, which strips HTML/script tags but never touches quotes or SQL syntax, and concatenates it directly into a query string with no escaping or parameterization:
CVE-2026-98260 High 2026-10-06 Not applicable Proof of concept only In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posix_cputimers. The task is looked up by that PID. When a non-leader thread exec()s, de_thread() changes which task owns that PID. pid_task(timer->it.cpu.pid, PIDTYPE_PID) then returns NULL, but the node is still queued on tsk, which is alive. timer_lock_sighand() takes a failed lookup to mean that the node is already dequeued, so it has nothing to undo. begin_new_exec() calls posix_cpu_timers_exit(me) right after exec_task_namespaces() and that removes the leftover node, so the state normally stays invisible. But bprm->point_of_no_return is set before de_thread(), so if unshare_files(), set_mm_exe_file(), exec_mmap() or exec_task_namespaces() fails, the task dies before it gets there. exit_itimers() then frees the k_itimer while its node is still queued, and reaping tsk later erases that freed node from the rbtree. In short: the non-leader thread B the parent timer_create(CLOCK_THREAD_CPUTIME_ID) timer_settime() arm_timer() // the node is queued on B execve() de_thread(B) exchange_tids(B, leader) // B's PID now belongs to the leader release_task(leader) __exit_signal(leader) posix_cpu_timers_exit(leader) // cleans leader's queue, not B's __unhash_process(leader) // that PID has no task anymore exec_mmap() mmap_read_lock_killable(old_mm) kill(B, SIGKILL) // -EINTR get_signal() do_exit() exit_itimers() posix_timer_delete() posix_cpu_timer_del() posix_timer_unhash_and_free() // freed while still queued wait4() release_task(B) posix_cpu_timers_exit(B) cleanup_timerqueue() timerqueue_del() // use-after-free Move the POSIX timer cleanup right after de_thread() before any of the later failure conditions brings the task into do_exit(). [ tglx: Move the cleanup right after de_thread() ]
CVE-2026-21589 Critical 2026-10-05 Not applicable Exploited This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
CVE-2026-105740 Critical 2026-10-05 Not applicable Exploited Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override). This vulnerability is fixed in 1.9.0.
CVE-2026-102282 High 2026-10-05 Not applicable Proof of concept only adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.
CVE-2026-105134 Critical 2026-10-04 Not applicable Exploited A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
CVE-2026-105133 Medium 2026-10-04 Not applicable Exploited A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
CVE-2026-103956 Critical 2026-10-02 Not applicable Working exploit published Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured. To remediate this issue, users should upgrade to version 1.6.1 or later.
‹ prev page 1 of 312 next ›