WaratekVRT Sign in
Reset
More filters
Columns
Including CVEs outside Waratek scope✕
Overview 43,992 matches · 2,034 in Waratek scope · 505 protected · 2,194 exploited · 678 CISA KEV · 3,604 public PoC · 1,445 EPSS ≥ 0.5
43,992matches 2,034in Waratek scope4.6% 505protected1.1% 2,194exploited5.0% 678CISA KEV1.5% 3,604public PoC8.2% 1,445EPSS ≥ 0.53.3%
Protected by Waratek 508 1.2% Rule in development 2 0.0% Mitigation candidate 81 0.2% No exploit published 1,443 3.3% Outside Waratek scope 359 0.8% Not applicable 41,599 94.6% Withdrawn CVE 0 0.0%
Critical 43,992 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 505 1.1% partly blocked 3 0.0% not blocked 43,478 98.8% not established 6 0.0% unrecorded 0 0.0%
Exploited 2,194 5.0% Working exploit published 1,840 4.2% Proof of concept only 6,406 14.6% Forecast only 173 0.4% No public exploit 33,379 75.9%
split by peak 10,975 / year
Not applicable: 41,599Outside Waratek scope: 359No exploit published: 1,443Mitigation candidate: 81Rule in development: 2Protected by Waratek: 508 Critical: 43,992 not established: 6not blocked: 43,478partly blocked: 3blocked by ARMR today: 505 No public exploit: 33,379Forecast only: 173Proof of concept only: 6,406Working exploit published: 1,840Exploited: 2,194
19951 Not applicable1 Critical1 not blocked1 Working exploit published1 19961 Not applicable1 Critical1 not blocked1 No public exploit1 19971 Not applicable1 Critical1 not blocked1 No public exploit1 19981 Not applicable1 Critical1 not blocked1 Working exploit published1 19993 Not applicable3 Critical3 not blocked3 Working exploit published2 No public exploit1 20002 Not applicable2 Critical2 not blocked2 Working exploit published1 No public exploit1 200112 Not applicable12 Critical12 not blocked12 Working exploit published4 No public exploit8 200210 Not applicable10 Critical10 not blocked10 Working exploit published3 Forecast only1 No public exploit6 20039 Not applicable9 Critical9 not blocked9 Working exploit published3 Forecast only1 No public exploit5 200410 Not applicable10 Critical10 not blocked10 Exploited1 Working exploit published3 No public exploit6 200513 No exploit published1 Not applicable12 Critical13 not blocked13 Exploited1 Working exploit published4 No public exploit8 200612 Not applicable12 Critical12 not blocked12 Working exploit published4 No public exploit8 200721 Not applicable21 Critical21 not blocked21 Exploited1 Working exploit published6 Proof of concept only3 No public exploit11 200819 Outside Waratek scope1 Not applicable18 Critical19 not blocked19 Exploited2 Working exploit published4 No public exploit13 200915 Not applicable15 Critical15 not blocked15 Exploited2 Working exploit published5 No public exploit8 201028 Protected by Waratek1 Outside Waratek scope1 Not applicable26 Critical28 blocked by ARMR today1 not blocked27 Exploited5 Working exploit published6 Forecast only1 No public exploit16 20115 Outside Waratek scope1 Not applicable4 Critical5 not blocked5 Exploited3 Working exploit published1 Forecast only1 201221 Protected by Waratek2 Mitigation candidate1 Outside Waratek scope4 Not applicable14 Critical21 blocked by ARMR today2 not blocked18 not established1 Exploited8 Working exploit published2 No public exploit11 201323 Protected by Waratek1 Outside Waratek scope2 Not applicable20 Critical23 blocked by ARMR today1 not blocked22 Exploited8 Working exploit published2 No public exploit13 201420 Not applicable20 Critical20 not blocked20 Exploited9 Working exploit published2 No public exploit9 201551 Protected by Waratek3 No exploit published1 Outside Waratek scope4 Not applicable43 Critical51 blocked by ARMR today3 not blocked48 Exploited15 Working exploit published4 No public exploit32 2016887 Protected by Waratek14 Mitigation candidate1 No exploit published32 Outside Waratek scope17 Not applicable823 Critical887 blocked by ARMR today13 partly blocked1 not blocked873 Exploited22 Working exploit published61 Proof of concept only4 Forecast only5 No public exploit795 20172,113 Protected by Waratek36 Mitigation candidate5 No exploit published41 Outside Waratek scope35 Not applicable1,996 Critical2,113 blocked by ARMR today36 not blocked2,077 Exploited66 Working exploit published326 Proof of concept only6 Forecast only8 No public exploit1,707 20182,616 Protected by Waratek51 Mitigation candidate1 No exploit published34 Outside Waratek scope40 Not applicable2,490 Critical2,616 blocked by ARMR today50 partly blocked1 not blocked2,565 Exploited76 Working exploit published279 Proof of concept only16 Forecast only9 No public exploit2,236 20192,657 Protected by Waratek40 Rule in development1 Mitigation candidate2 No exploit published43 Outside Waratek scope41 Not applicable2,530 Critical2,657 blocked by ARMR today40 not blocked2,617 Exploited130 Working exploit published145 Proof of concept only33 Forecast only17 No public exploit2,332 20202,780 Protected by Waratek42 Mitigation candidate11 No exploit published61 Outside Waratek scope32 Not applicable2,634 Critical2,780 blocked by ARMR today42 not blocked2,738 Exploited141 Working exploit published150 Proof of concept only27 Forecast only21 No public exploit2,441 20212,850 Protected by Waratek45 Rule in development1 Mitigation candidate4 No exploit published54 Outside Waratek scope41 Not applicable2,705 Critical2,850 blocked by ARMR today45 not blocked2,805 Exploited190 Working exploit published81 Proof of concept only38 Forecast only37 No public exploit2,504 20224,441 Protected by Waratek73 Mitigation candidate10 No exploit published67 Outside Waratek scope58 Not applicable4,233 Critical4,441 blocked by ARMR today73 not blocked4,368 Exploited231 Working exploit published117 Proof of concept only612 Forecast only22 No public exploit3,459 20235,031 Protected by Waratek56 Mitigation candidate17 No exploit published153 Outside Waratek scope30 Not applicable4,775 Critical5,031 blocked by ARMR today56 not blocked4,974 not established1 Exploited234 Working exploit published138 Proof of concept only1,222 Forecast only26 No public exploit3,411 20244,874 Protected by Waratek35 Mitigation candidate11 No exploit published78 Outside Waratek scope12 Not applicable4,738 Critical4,874 blocked by ARMR today34 partly blocked1 not blocked4,839 Exploited290 Working exploit published137 Proof of concept only1,339 Forecast only16 No public exploit3,092 20254,490 Protected by Waratek34 Mitigation candidate8 No exploit published35 Outside Waratek scope22 Not applicable4,391 Critical4,490 blocked by ARMR today34 not blocked4,454 not established2 Exploited320 Working exploit published188 Proof of concept only1,058 Forecast only5 No public exploit2,919 202610,975 Protected by Waratek75 Mitigation candidate10 No exploit published843 Outside Waratek scope18 Not applicable10,029 Critical10,975 blocked by ARMR today75 not blocked10,898 not established2 Exploited439 Working exploit published160 Proof of concept only2,048 Forecast only3 No public exploit8,325
19961999200220052008201120142017202020232026
43,992 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 440 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-110959 Critical 2026-11-12 Not applicable No public exploit The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account's email address.
CVE-2026-110003 Critical 2026-11-12 Not applicable No public exploit A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waives the remote-rejection check before the token is validated, and an invalid token falls through to password-based authentication, which succeeds without credentials on default domains configured with an empty administrative password. Successful exploitation grants execution of arbitrary administrative commands, equivalent to complete compromise of the server.
CVE-2026-107360 Critical 2026-11-12 Not applicable No public exploit A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.
CVE-2026-85632 Critical 2026-11-11 Not applicable No public exploit Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle. This issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1.
CVE-2026-78287 Critical 2026-11-11 Not applicable No public exploit Improper Control of Generation of Code ('Code Injection') vulnerability in Staggs STAGGS staggs allows Remote Code Inclusion.This issue affects STAGGS: from n/a through 3.3.0.
CVE-2026-67449 Critical 2026-11-11 Not applicable No public exploit Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler (app/api/tus/hooks/route.ts) allowed an unauthenticated attacker to overwrite arbitrary files under the private data directory, including /data/private/keys/master_key.bin (the AES-256-GCM master key). This issue has been patched in version 1.21.2.
CVE-2026-65840 Critical 2026-11-11 Not applicable No public exploit Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants. Single-host deployments (HOST_MODE=single, the default) are NOT affected. This issue has been patched in version 0.36.0.
CVE-2026-64682 Critical 2026-11-11 Not applicable No public exploit AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package) can forge a valid session token with role: "owner" and obtain full administrative control of the CMS — creating/deleting content, users, media, redirects, and configuration. This issue has been patched in version 3.4.0.
CVE-2026-64678 Critical 2026-11-11 Not applicable Proof of concept only NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store. Prior to version 4.4.1, when Nitrite opens a database file, MVStoreUtils.openOrCreate() automatically checks for a legacy v1-format store and, on detecting one (or hitting a compatibility error while opening), triggers an automatic migration path. This path deserializes stored values using NitriteDataType.deserialize(byte[]), which passes the raw bytes directly to java.io.ObjectInputStream.readObject() via a custom NitriteObjectInputStream subclass. That subclass overrides only readClassDescriptor() — solely to remap a handful of known legacy class names to their current equivalents — and implements no class allowlist, blocklist, or ObjectInputFilter (JEP 290). Any Serializable class reachable on the embedding application's classpath can therefore be instantiated via readObject(), with readObject()/readExternal()/readResolve() callbacks invoked unconditionally. If a suitable gadget class (e.g. from commons-collections or similar) happens to be present on the classpath, this is a precondition for remote code execution. This issue has been patched in version 4.4.1.
CVE-2026-64670 Critical 2026-11-11 Not applicable Proof of concept only Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw, un-sanitized body (orig). Only administrators and the comment owner can edit. So an administrator who clicks Edit on an attacker's comment renders that attacker's raw HTML in their own session: an unauthenticated commenter achieves privilege-escalation stored XSS against a moderator with a single Edit click. At time of publication, there are no publicly available patches.
CVE-2026-126912 Critical 2026-11-11 Not applicable No public exploit Buffer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126909 Critical 2026-11-11 Not applicable No public exploit Use after free in Passwords in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126885 Critical 2026-11-11 Not applicable No public exploit Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-126872 Critical 2026-11-11 Not applicable No public exploit Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126859 Critical 2026-11-11 Not applicable No public exploit Link following in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126846 Critical 2026-11-11 Not applicable No public exploit Use after free in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-126842 Critical 2026-11-11 Not applicable No public exploit Use after free in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126812 Critical 2026-11-11 Not applicable Proof of concept only blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.
CVE-2026-126806 Critical 2026-11-11 Not applicable Proof of concept only WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source tag in view/managerVideos_body.php, executing in administrator sessions to install plugin archives containing PHP.
CVE-2026-126800 Critical 2026-11-11 Not applicable No public exploit Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when administrators or other users view it, stealing the non-httpOnly sid session cookie for session hijacking.
CVE-2026-126797 Critical 2026-11-11 Not applicable No public exploit NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results.
CVE-2026-126777 Critical 2026-11-11 Not applicable No public exploit Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.
CVE-2026-126768 Critical 2026-11-11 Not applicable Proof of concept only OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access.
CVE-2026-126542 Critical 2026-11-11 Not applicable Proof of concept only WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.
CVE-2026-126539 Critical 2026-11-11 Not applicable No public exploit Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then read, create, update or delete records in any user-defined collection.
CVE-2026-126537 Critical 2026-11-11 Not applicable Exploited The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36. The flaw spans NF_FU_Fields_Upload::process() in includes/fields/upload.php — which returns early (leaving the client-supplied files[] intact) whenever a public submission carries a nonempty extra.saveProgress — and NF_FU_External_Abstracts_Service::process_upload() in includes/external/abstracts/service.php, whose authoritative-path reload only fires when the client sends upload_id. By omitting upload_id, an attacker's data[file_path] survives into the Background Upload queue and is used by both upload_file_to_s3() (as SourceFile) and the maybe_delete_server_file() unlink() call in includes/external/abstracts/backgroundupload.php, with no canonicalization or upload-directory containment check (the plugin's own is_path_within_upload_dir() helper is only applied on admin paths). This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server which may make remote code execution possible — specifically, deleting wp-config.php forces WordPress into its setup screen, enabling full site takeover.
CVE-2026-126325 Critical 2026-11-11 Not applicable No public exploit A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
CVE-2026-126263 Critical 2026-11-11 Not applicable No public exploit A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted requests.
CVE-2026-126262 Critical 2026-11-11 Not applicable No public exploit A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an unauthenticated attacker who has access to the oftp port to execute code or command on the system via crafted OFTP packets.
CVE-2026-126259 Critical 2026-11-11 Not applicable No public exploit A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets.
CVE-2026-126257 Critical 2026-11-11 Not applicable No public exploit A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access.
CVE-2026-126254 Critical 2026-11-11 Not applicable No public exploit A numeric truncation error vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a configured ibgp neighbor to send malicious/malformed attributes to all connected routers via a specially crafted request
CVE-2026-126253 Critical 2026-11-11 Not applicable No public exploit A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker to broadcast LSA via specially crafted request
CVE-2026-126251 Critical 2026-11-11 Not applicable No public exploit A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access.
CVE-2026-126229 Critical 2026-11-11 Not applicable No public exploit A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiAnalyzer Cloud 7.0 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager 7.0 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12, FortiManager Cloud 7.0 all versions may allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests.
CVE-2026-126170 Critical 2026-11-11 Not applicable No public exploit A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request
CVE-2026-126164 Critical 2026-11-11 Not applicable No public exploit A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
CVE-2026-126157 Critical 2026-11-11 Not applicable No public exploit A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to gain access to other users' secure email accounts via crafted HTTP requests.
CVE-2026-126156 Critical 2026-11-11 Not applicable No public exploit A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests.
CVE-2026-126155 Critical 2026-11-11 Not applicable No public exploit A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests.
CVE-2026-126150 Critical 2026-11-11 Not applicable No public exploit A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests.
CVE-2026-126148 Critical 2026-11-11 Not applicable No public exploit A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets.
CVE-2026-126147 Critical 2026-11-11 Not applicable No public exploit A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
CVE-2026-123710 Critical 2026-11-11 Not applicable No public exploit A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.
CVE-2026-123695 Critical 2026-11-11 Not applicable No public exploit The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators.
CVE-2026-121497 Critical 2026-11-11 Not applicable No public exploit The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled.
CVE-2026-121374 Critical 2026-11-11 Not applicable No public exploit Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user via crafted node roles in the "Exclude nodes based on their role" rule option, leading to code execution as the site user.
CVE-2026-120495 Critical 2026-11-11 Not applicable No public exploit Path traversal in the Synthetic Monitoring "Robotmk" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls the agent output of a monitored host's check output for a host to inject a crafted robot output to define the contents and location for the generated HTML log, leading to code execution as the site user.
CVE-2026-118965 Critical 2026-11-11 Not applicable No public exploit Path traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an attacker in control of a remote site in a distributed monitoring setup to write arbitrary files on the central site and thereby execute code as the central site user.
CVE-2026-115735 Critical 2026-11-11 Not applicable No public exploit The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a full site takeover.
CVE-2026-115734 Critical 2026-11-11 Not applicable No public exploit The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict access to the relevant administration screens, allowing users with a role as low as Subscriber to delete arbitrary files on the server, which can lead to a full site compromise.
CVE-2026-115733 Critical 2026-11-11 Not applicable No public exploit The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causing every WooCommerce REST route to accept unauthenticated requests, which allows unauthenticated attackers to read and modify store data including customer orders and personal information, store and payment settings, and webhooks.
CVE-2026-112174 Critical 2026-11-11 Not applicable No public exploit Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistently with Administrator privileges, a local attacker with low privileges can use the native Windows dialogues exposed by the application to run programmes that inherit its elevated context. This allows commands to be executed with SYSTEM or Administrator privileges, depending on the application’s context, and compromises the affected Windows system.
CVE-2026-110697 Critical 2026-11-11 Not applicable No public exploit A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.
CVE-2026-96157 Critical 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
CVE-2026-96078 Critical 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code over a network.
CVE-2026-96067 Critical 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network.
CVE-2026-95962 Critical 2026-11-10 Not applicable No public exploit Use after free in Windows Virtual Filtering Platform (VFP) allows an unauthorized attacker to execute code over a network.
CVE-2026-95901 Critical 2026-11-10 Not applicable No public exploit Double free in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.
CVE-2026-95882 Critical 2026-11-10 Not applicable No public exploit Stack-based buffer overflow in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.
CVE-2026-89324 Critical 2026-11-10 Not applicable Exploited The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to evaluate the constant's value rather than its name, making the check always fail and permanently falling back to the static hardcoded salt 2NlBUibcszrVtNmDnxqDbwCOpLWq91eatIz6O1O that is publicly visible in the theme source code; because this salt is static and known, an attacker can compute a valid Opauth signature entirely offline and submit a forged ?opauth callback to the unauthenticated init hook endpoint processed by register_or_login. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, by forging a callback tied to a known target account email address — bypassing all password verification, multi-factor authentication, and ownership checks, and receiving a fully authenticated session cookie via wc_set_customer_auth_cookie(). Exploitation requires WooCommerce to be active and at least one Basel social-login provider (Facebook, Google, or VKontakte) to be configured with a valid app_id and app_secret in the theme settings.
CVE-2026-89126 Critical 2026-11-10 Not applicable No public exploit SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
CVE-2026-89119 Critical 2026-11-10 Not applicable No public exploit SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability.
CVE-2026-89103 Critical 2026-11-10 Not applicable No public exploit SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.
CVE-2026-88243 Critical 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVE-2026-88234 Critical 2026-11-10 Not applicable No public exploit Release of invalid pointer or reference in Windows iSCSI allows an unauthorized attacker to execute code over a network.
CVE-2026-88218 Critical 2026-11-10 Not applicable No public exploit Double free in Windows DNS allows an unauthorized attacker to execute code over a network.
CVE-2026-85844 Critical 2026-11-10 Not applicable No public exploit Authentication bypass using an alternate path or channel in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-82509 Critical 2026-11-10 Not applicable No public exploit V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate validation bypass vulnerability that allows on-path attackers to intercept HTTPS traffic by exploiting the default false value of SSLConnectConfig.validate and FetchConfig.validate, which completes TLS handshakes without verifying certificates in both the mbedtls and OpenSSL backends. Attackers can present an expired, self-signed, wrong-hostname, or untrusted-root certificate to successfully complete the handshake via http.get, http.post, or http.fetch, enabling interception or modification of HTTPS traffic unless validate: true is explicitly configured.
CVE-2026-82391 Critical 2026-11-10 Not applicable No public exploit The HTTP/2 front-end of the Zephyr HTTP server aliased connection receive state as a scratch output. In subsys/net/lib/http/http_server_http2.c, handle_http2_static_fs_resource() passed &client->data_len as the file_size out-parameter of http_server_find_file(). client->data_len is the count of unprocessed bytes remaining in the fixed-size per-connection receive buffer client->buffer[CONFIG_HTTP_SERVER_CLIENT_BUFFER_SIZE] (256 bytes by default), an invariant every frame handler and the socket receive path rely on. Serving any static file therefore replaced that bounded value with the file's on-disk size, and nothing resets it afterwards. The defect is reached by an unauthenticated HTTP/2 GET for any file under the web root, in applications that register a static-filesystem resource (HTTP_RESOURCE_TYPE_STATIC_FS) with CONFIG_FILE_SYSTEM=y; CONFIG_HTTP_SERVER_VERSION_2 is enabled by default and no TLS or credentials are required on this path. Once client->data_len exceeds the buffer size, the frame dispatch loop in subsys/net/lib/http/http_server_core.c keeps parsing past the end of the received data, and the peer controls the bytes at client->cursor, so it can choose which fabricated frame the state machine consumes next by appending bytes after its request. The inflated length defeats the only guards on the buffer. parse_http_frame_header() and the per-frame handlers read and skip up to a 24-bit frame length beyond the buffer (out-of-bounds read); the compaction memmove(client->buffer, client->cursor, client->data_len) at the end of request handling copies the file-size number of bytes into the 256-byte buffer, overflowing the rest of struct http_client_ctx — including the current_detail/current_stream pointers, the parser_settings function-pointer table and the inactivity_timer work handler — and the adjacent client contexts in static memory; and the subsequent zsock_recv(client->fd, client->buffer + client->data_len, sizeof(client->buffer) - client->data_len, 0) underflows its size argument, writing attacker-supplied data of attacker-chosen length out of bounds. The impact is remote memory corruption in the server's single address space: at minimum a crash or hang of the device, and plausibly control-data overwrite leading to code execution. The HTTP/1 and HTTP/3 static-filesystem handlers already used a local variable and are unaffected; the fix makes the HTTP/2 handler use a local size_t file_size as well.
CVE-2026-80095 Critical 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-76965 Critical 2026-11-10 Not applicable No public exploit SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating system commands on the underlying host. Successful exploitation could impact resources beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability of the system.
CVE-2026-76964 Critical 2026-11-10 Not applicable No public exploit SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
CVE-2026-66801 Critical 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.
CVE-2026-63011 Critical 2026-11-10 Not applicable No public exploit Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string (tpl parameter) that is passed without restriction to TemplateParser::parse(). When the template contains an [assign] block whose expression includes a {{...}} variable reference, the engine calls eval() on the expanded expression after running it through a validateExpression() guard. The guard double-quotes unrecognized tokens, but PHP 7+ allows a string enclosed in parentheses to be invoked as a function ("system")("id") is valid PHP and calls system("id"). A single authenticated HTTP request is sufficient to execute arbitrary OS commands as the web server user (www-data). This issue has been patched in versions 6.8.167, 25.0.102, and 26.0.27.
CVE-2026-61887 Critical 2026-11-10 Not applicable No public exploit Missing critical step in authentication in the MigTD SPDM rebind implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege and information disclosure. Network adversary with an unauthenticated user combined with a low complexity attack may enable remote code execution. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.
CVE-2026-61547 Critical 2026-11-10 Not applicable Proof of concept only rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqp_send_frame() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0.
CVE-2026-61473 Critical 2026-11-10 Not applicable No public exploit Authentication bypass by capture-replay in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.
CVE-2026-59626 Critical 2026-11-10 Not applicable No public exploit In SendInfo of UssiController.cpp, there is a possible way to corrupt memory via a dangling connection listener pointer due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59625 Critical 2026-11-10 Not applicable No public exploit In GetTwiddledMiptreeSparsePageMap of texmgmt.c, there is a possible way to trigger an out of bounds write due to a logic error. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58800 Critical 2026-11-10 Not applicable No public exploit In IMG_vkCreateImageView of image_view.c, there is a possible way to trigger a use after free due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58799 Critical 2026-11-10 Not applicable No public exploit In multiple functions of rmmi_utility.c, there is a possible way to trigger an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58780 Critical 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58736 Critical 2026-11-10 Not applicable No public exploit In NotifySipResponse of SessionEx.cpp, there is a possible way to corrupt memory via a dangling connection pointer in the pending response queue due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58722 Critical 2026-11-10 Not applicable No public exploit In chppProcessDiscoverAllResponse of system/chre/chpp/clients/discovery.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58705 Critical 2026-11-10 Not applicable No public exploit In handleEvent of gscan.cpp, there is a possible way to trigger an out of bounds write on the heap due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58681 Critical 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-57047 Critical 2026-11-10 Not applicable No public exploit In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-57010 Critical 2026-11-10 Not applicable No public exploit In EncodeLastScanBufferElement of data_manager.cc, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56971 Critical 2026-11-10 Not applicable No public exploit In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55362 Critical 2026-11-10 Not applicable No public exploit In multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55335 Critical 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-44685 Critical 2026-11-10 Not applicable No public exploit Authentication bypass by spoofing in the MigTD rebinding protocol for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.
CVE-2026-13312 Critical 2026-11-10 No exploit published No public exploit A vulnerability that could allow an attacker to compromise a system.
CVE-2026-126261 Critical 2026-11-10 Not applicable No public exploit A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets.
CVE-2026-126187 Critical 2026-11-10 Not applicable Proof of concept only React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Applications whose React code does not use a server are not affected. Applications that do not use a framework, bundler, or bundler plugin that supports React Server Components are not affected. This issue is fixed in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.
CVE-2026-126087 Critical 2026-11-10 Not applicable No public exploit Untrusted search path in the cross-user process launcher in Open Job Description (OpenJD) Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user with permission to submit jobs to a queue to execute arbitrary code as the worker agent OS user and obtain the AWS credentials held by the worker agent via a crafted job that modifies the PATH environment variable. To remediate this issue, users of customer-managed fleets should upgrade the Deadline Cloud worker agent to version 0.33.0 or later, which includes OpenJD Sessions 0.11.0. Service-managed fleets were remediated service-side.
CVE-2026-126065 Critical 2026-11-10 Not applicable Proof of concept only OpenObserve is a cloud-native observability platform. Prior to 1.1.0, the shared authentication validator in src/api/common/src/auth/validator.rs accepts an empty or whitespace-only HTTP Basic password for an account whose password_ext value is missing or empty. SSO-provisioned and migration-created users can have this state, allowing an unauthenticated attacker who knows an affected user's email address and organization to authenticate on protected non-ingestion API routes with the victim's role and permissions. A compromised privileged account can expose or modify telemetry, alerts, streams, users, and security configuration. An account with search permission can submit a DataFusion COPY ... TO statement through the search API to create or overwrite attacker-controlled files at service-process-writable locations, creating a conditional escalation to pre-authentication remote code execution. This issue is fixed in version 1.1.0.
CVE-2026-125883 Critical 2026-11-10 Not applicable Exploited Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-central: before 26.4.1.
CVE-2026-125881 Critical 2026-11-10 Not applicable No public exploit Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery. This issue affects N-central: before 26.4.1.
‹ prev page 2 of 440 next ›