WaratekVRT Sign in
Reset
More filters
Columns
Including CVEs outside Waratek scope✕
Overview 43,992 matches · 2,034 in Waratek scope · 505 protected · 2,194 exploited · 678 CISA KEV · 3,604 public PoC · 1,445 EPSS ≥ 0.5
43,992matches 2,034in Waratek scope4.6% 505protected1.1% 2,194exploited5.0% 678CISA KEV1.5% 3,604public PoC8.2% 1,445EPSS ≥ 0.53.3%
Protected by Waratek 508 1.2% Rule in development 2 0.0% Mitigation candidate 81 0.2% No exploit published 1,443 3.3% Outside Waratek scope 359 0.8% Not applicable 41,599 94.6% Withdrawn CVE 0 0.0%
Critical 43,992 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 505 1.1% partly blocked 3 0.0% not blocked 43,478 98.8% not established 6 0.0% unrecorded 0 0.0%
Exploited 2,194 5.0% Working exploit published 1,840 4.2% Proof of concept only 6,406 14.6% Forecast only 173 0.4% No public exploit 33,379 75.9%
split by peak 10,975 / year
Not applicable: 41,599Outside Waratek scope: 359No exploit published: 1,443Mitigation candidate: 81Rule in development: 2Protected by Waratek: 508 Critical: 43,992 not established: 6not blocked: 43,478partly blocked: 3blocked by ARMR today: 505 No public exploit: 33,379Forecast only: 173Proof of concept only: 6,406Working exploit published: 1,840Exploited: 2,194
19951 Not applicable1 Critical1 not blocked1 Working exploit published1 19961 Not applicable1 Critical1 not blocked1 No public exploit1 19971 Not applicable1 Critical1 not blocked1 No public exploit1 19981 Not applicable1 Critical1 not blocked1 Working exploit published1 19993 Not applicable3 Critical3 not blocked3 Working exploit published2 No public exploit1 20002 Not applicable2 Critical2 not blocked2 Working exploit published1 No public exploit1 200112 Not applicable12 Critical12 not blocked12 Working exploit published4 No public exploit8 200210 Not applicable10 Critical10 not blocked10 Working exploit published3 Forecast only1 No public exploit6 20039 Not applicable9 Critical9 not blocked9 Working exploit published3 Forecast only1 No public exploit5 200410 Not applicable10 Critical10 not blocked10 Exploited1 Working exploit published3 No public exploit6 200513 No exploit published1 Not applicable12 Critical13 not blocked13 Exploited1 Working exploit published4 No public exploit8 200612 Not applicable12 Critical12 not blocked12 Working exploit published4 No public exploit8 200721 Not applicable21 Critical21 not blocked21 Exploited1 Working exploit published6 Proof of concept only3 No public exploit11 200819 Outside Waratek scope1 Not applicable18 Critical19 not blocked19 Exploited2 Working exploit published4 No public exploit13 200915 Not applicable15 Critical15 not blocked15 Exploited2 Working exploit published5 No public exploit8 201028 Protected by Waratek1 Outside Waratek scope1 Not applicable26 Critical28 blocked by ARMR today1 not blocked27 Exploited5 Working exploit published6 Forecast only1 No public exploit16 20115 Outside Waratek scope1 Not applicable4 Critical5 not blocked5 Exploited3 Working exploit published1 Forecast only1 201221 Protected by Waratek2 Mitigation candidate1 Outside Waratek scope4 Not applicable14 Critical21 blocked by ARMR today2 not blocked18 not established1 Exploited8 Working exploit published2 No public exploit11 201323 Protected by Waratek1 Outside Waratek scope2 Not applicable20 Critical23 blocked by ARMR today1 not blocked22 Exploited8 Working exploit published2 No public exploit13 201420 Not applicable20 Critical20 not blocked20 Exploited9 Working exploit published2 No public exploit9 201551 Protected by Waratek3 No exploit published1 Outside Waratek scope4 Not applicable43 Critical51 blocked by ARMR today3 not blocked48 Exploited15 Working exploit published4 No public exploit32 2016887 Protected by Waratek14 Mitigation candidate1 No exploit published32 Outside Waratek scope17 Not applicable823 Critical887 blocked by ARMR today13 partly blocked1 not blocked873 Exploited22 Working exploit published61 Proof of concept only4 Forecast only5 No public exploit795 20172,113 Protected by Waratek36 Mitigation candidate5 No exploit published41 Outside Waratek scope35 Not applicable1,996 Critical2,113 blocked by ARMR today36 not blocked2,077 Exploited66 Working exploit published326 Proof of concept only6 Forecast only8 No public exploit1,707 20182,616 Protected by Waratek51 Mitigation candidate1 No exploit published34 Outside Waratek scope40 Not applicable2,490 Critical2,616 blocked by ARMR today50 partly blocked1 not blocked2,565 Exploited76 Working exploit published279 Proof of concept only16 Forecast only9 No public exploit2,236 20192,657 Protected by Waratek40 Rule in development1 Mitigation candidate2 No exploit published43 Outside Waratek scope41 Not applicable2,530 Critical2,657 blocked by ARMR today40 not blocked2,617 Exploited130 Working exploit published145 Proof of concept only33 Forecast only17 No public exploit2,332 20202,780 Protected by Waratek42 Mitigation candidate11 No exploit published61 Outside Waratek scope32 Not applicable2,634 Critical2,780 blocked by ARMR today42 not blocked2,738 Exploited141 Working exploit published150 Proof of concept only27 Forecast only21 No public exploit2,441 20212,850 Protected by Waratek45 Rule in development1 Mitigation candidate4 No exploit published54 Outside Waratek scope41 Not applicable2,705 Critical2,850 blocked by ARMR today45 not blocked2,805 Exploited190 Working exploit published81 Proof of concept only38 Forecast only37 No public exploit2,504 20224,441 Protected by Waratek73 Mitigation candidate10 No exploit published67 Outside Waratek scope58 Not applicable4,233 Critical4,441 blocked by ARMR today73 not blocked4,368 Exploited231 Working exploit published117 Proof of concept only612 Forecast only22 No public exploit3,459 20235,031 Protected by Waratek56 Mitigation candidate17 No exploit published153 Outside Waratek scope30 Not applicable4,775 Critical5,031 blocked by ARMR today56 not blocked4,974 not established1 Exploited234 Working exploit published138 Proof of concept only1,222 Forecast only26 No public exploit3,411 20244,874 Protected by Waratek35 Mitigation candidate11 No exploit published78 Outside Waratek scope12 Not applicable4,738 Critical4,874 blocked by ARMR today34 partly blocked1 not blocked4,839 Exploited290 Working exploit published137 Proof of concept only1,339 Forecast only16 No public exploit3,092 20254,490 Protected by Waratek34 Mitigation candidate8 No exploit published35 Outside Waratek scope22 Not applicable4,391 Critical4,490 blocked by ARMR today34 not blocked4,454 not established2 Exploited320 Working exploit published188 Proof of concept only1,058 Forecast only5 No public exploit2,919 202610,975 Protected by Waratek75 Mitigation candidate10 No exploit published843 Outside Waratek scope18 Not applicable10,029 Critical10,975 blocked by ARMR today75 not blocked10,898 not established2 Exploited439 Working exploit published160 Proof of concept only2,048 Forecast only3 No public exploit8,325
19961999200220052008201120142017202020232026
43,992 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 440 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-125758 Critical 2026-11-10 Not applicable No public exploit Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH_SECRET. Attackers can enumerate registered e-mails via /api/_auth/signin, forge HS256 JWTs redeemed by /api/_auth/continue, impersonate users, export analytics data, and transfer app ownership.
CVE-2026-125757 Critical 2026-11-10 Not applicable Proof of concept only mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.
CVE-2026-125384 Critical 2026-11-10 Not applicable No public exploit INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates admin@root.com with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.
CVE-2026-125383 Critical 2026-11-10 Not applicable No public exploit INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API.
CVE-2026-125370 Critical 2026-11-10 Not applicable Proof of concept only Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.
CVE-2026-125347 Critical 2026-11-10 Not applicable No public exploit Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-125331 Critical 2026-11-10 Not applicable No public exploit HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header before validating the bearer, while the service-only PUT and GET /v1/orgs/{org}/connections/{name}, PUT /v1/orgs/{org}/policy/{backend}, and /internal/* routes trust that key and take the organization from the URL. In a multi-organization deployment, a remote caller can use a made-up bearer to rewrite another organization's provider connection to an attacker-controlled endpoint, causing later prompts to be disclosed and attacker-controlled responses to influence tasks. This issue is fixed in version 0.31.8.
CVE-2026-125298 Critical 2026-11-10 Not applicable No public exploit AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in 9.2.41.
CVE-2026-125297 Critical 2026-11-10 Not applicable No public exploit AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.
CVE-2026-125086 Critical 2026-11-10 Not applicable Proof of concept only A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-124917 Critical 2026-11-10 Not applicable No public exploit Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124903 Critical 2026-11-10 Not applicable No public exploit Sandbox escape due to use-after-free in the IPC component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124900 Critical 2026-11-10 Not applicable No public exploit Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124864 Critical 2026-11-10 Not applicable No public exploit Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124861 Critical 2026-11-10 Not applicable No public exploit Sandbox escape due to use-after-free in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124859 Critical 2026-11-10 Not applicable No public exploit Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124853 Critical 2026-11-10 Not applicable No public exploit Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124600 Critical 2026-11-10 Not applicable No public exploit GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic.
CVE-2026-121908 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-121906 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-121904 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
CVE-2026-121902 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of the application. Exploitation of this issue does not require user interaction.
CVE-2026-121898 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-121896 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-121894 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-121892 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-121889 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-121887 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-121683 Critical 2026-11-10 Not applicable No public exploit Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.
CVE-2026-121653 Critical 2026-11-10 Not applicable No public exploit SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.
CVE-2026-121529 Critical 2026-11-10 Not applicable No public exploit A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote attacker to execute unauthorized code or commands. Successful exploitation requires interaction with the victim.
CVE-2026-121370 Critical 2026-11-10 Not applicable No public exploit On affected platforms running Arista EOS with Precision Time Protocol (PTP) configured, an unauthenticated attacker with network access to a PTP-enabled port can create a denial of service (DoS) condition by sending traffic to the system.
CVE-2026-121356 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-121355 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction.
CVE-2026-121354 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-121353 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by an Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-121352 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access to sensitive resources. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-121351 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-121349 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-121295 Critical 2026-11-10 Not applicable No public exploit On affected platforms running Arista EOS configured as S-BFD peers, an unauthenticated attacker could send a crafted S-BFD PDU to an initiator device. This crafted PDU could cause the kernel on the initiator device to crash, resulting in an unexpected device reboot.
CVE-2026-121289 Critical 2026-11-10 Not applicable No public exploit On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash. Successful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system.
CVE-2026-120808 Critical 2026-11-10 Not applicable No public exploit An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connections to IPv6-addressed peers. When a MongoDB process using the Apple SecureTransport TLS backend connects to an IPv6 target, the trust evaluation result from SecTrustEvaluate is silently discarded, regardless of whether the peer's certificate is trusted. An on-path party could exploit this by presenting a self-signed certificate containing the target's IPv6 address in the Subject Alternative Name to intercept and modify encrypted inter-node or external service traffic. This issue only affects MongoDB processes running on macOS with the Apple SecureTransport TLS provider.
CVE-2026-120779 Critical 2026-11-10 Not applicable No public exploit Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-120017 Critical 2026-11-10 Not applicable No public exploit SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.
CVE-2026-120002 Critical 2026-11-10 Not applicable No public exploit Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-119990 Critical 2026-11-10 Not applicable No public exploit Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-119958 Critical 2026-11-10 Not applicable No public exploit Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
CVE-2026-119446 Critical 2026-11-10 Not applicable Proof of concept only Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no authentication and returns a polling token, a confirmation URL that carries that token, and a confirmation code. When a signed-in user opens that URL and clicks Confirm, NervesHub.Accounts.verify_cli_session_token/2 creates an API token for the user's account and stores it on the login, and the next poll of GET /api/auth/cli_session/<token> returns it to whoever started the login. The confirmation code is only displayed and is never compared with anything, so it cannot show that the person confirming is the one who started the login. The confirm form carries a CSRF token and the page cannot be framed, so the attacker has to persuade the user to open the link and click the button themselves. This issue affects nerves_hub: from 2.5.0 before 2.5.3.
CVE-2026-119017 Critical 2026-11-10 Not applicable No public exploit Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-118740 Critical 2026-11-10 Not applicable No public exploit Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-118383 Critical 2026-11-10 Not applicable No public exploit A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.
CVE-2026-116945 Critical 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-116928 Critical 2026-11-10 Not applicable No public exploit Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.
CVE-2026-115646 Critical 2026-11-10 Not applicable No public exploit Partial String Comparison Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-50-/F through 09-66/V; HiRDB Server Version 9(32): from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-50-/F through 09-66-/V.
CVE-2026-114371 Critical 2026-11-10 Not applicable No public exploit Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-114162 Critical 2026-11-10 Not applicable No public exploit Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.
CVE-2026-114160 Critical 2026-11-10 Not applicable No public exploit Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-114146 Critical 2026-11-10 Not applicable No public exploit Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-113580 Critical 2026-11-10 Not applicable No public exploit Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-113579 Critical 2026-11-10 Not applicable No public exploit Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-112967 Critical 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.
CVE-2026-112136 Critical 2026-11-10 Not applicable No public exploit A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.
CVE-2026-109803 Critical 2026-11-10 Not applicable No public exploit SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL transformation to be processed, potentially leading to arbitrary code execution in the application context. Successful exploitation could impact the confidentiality, integrity, and availability of the application.
CVE-2026-109798 Critical 2026-11-10 Not applicable No public exploit SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability.
CVE-2026-109795 Critical 2026-11-10 Not applicable No public exploit SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected system. Successful exploitation could extend the attacker's reach beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability.
CVE-2026-109467 Critical 2026-11-10 Not applicable No public exploit Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.
CVE-2026-109454 Critical 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-108186 Critical 2026-11-10 Not applicable No public exploit Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
CVE-2026-107246 Critical 2026-11-10 Not applicable No public exploit The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.
CVE-2026-107242 Critical 2026-11-10 Not applicable No public exploit The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session.  Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
CVE-2026-102166 Critical 2026-11-10 Not applicable No public exploit Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification checks. This vulnerability is specific to the C-260 and C-250 models; other access point models enforce digitally signed upgrade images with secure boot and are not affected by this issue.
CVE-2026-68982 Critical 2026-11-09 Not applicable No public exploit Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.
CVE-2026-125120 Critical 2026-11-09 Not applicable No public exploit Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can therefore process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count. This issue is fixed in versions 6.13.11, 7.8.12, 8.24.3, and 9.9.2.
CVE-2026-124580 Critical 2026-11-09 Not applicable Proof of concept only A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-124079 Critical 2026-11-09 Not applicable No public exploit rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which runs without authentication in affected deployments. Laravel's CallQueuedHandler unserializes the job without class restrictions, allowing attackers to instantiate the existing App\\Jobs\\TaskDownloadRun class and invoke an attacker-controlled Artisan command. Attackers can leverage the bundled laravel/tinker package to execute arbitrary PHP and operating system commands as the queue worker's user, write a persistent web shell into the web-served storage/app/public directory, and read database credentials, stored device credentials, and API tokens. Where Redis is not directly reachable, authenticated attackers can deliver the payload through the application by configuring a device target that points at the rConfig server's loopback address.
CVE-2026-124001 Critical 2026-11-09 Not applicable No public exploit NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers can exploit the dgr_receive API's unchecked memcpy operation using synthetic datagrams or DGR traffic over internal IPC or custom transports to trigger an out-of-bounds write, leading to denial of service or potential remote code execution.
CVE-2026-123870 Critical 2026-11-09 Not applicable Proof of concept only The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the webapp host.
CVE-2026-123815 Critical 2026-11-09 Not applicable Proof of concept only pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar._safe_extractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling tarfile.extractall. On supported Python 3.9 through 3.13 runtimes, tarfile defaults to the fully_trusted extraction filter, so a user with ADD and STATUS permissions can cause extraction of a crafted archive containing character devices, block devices, or FIFOs. Python 3.14 defaults to a safe extraction filter. When pyLoad runs with operating-system privileges that permit device creation, including the official root-based Docker deployment, the archive can expose raw devices and compromise the host. Non-root deployments can still create FIFOs that cause hangs or IPC confusion. This issue is fixed in version 0.5.0b3.dev102.
CVE-2026-123807 Critical 2026-11-09 Not applicable Proof of concept only Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId accepts an unsafe resourceId that can escape the intended resource directory. The route passes the attacker-controlled resourceId through src/api/resources/index.ts to FileStore.getResource() in packages/resources-provider-plugin/src/filestorage.ts without adequate path containment, allowing arbitrary JSON files reachable by the server to be read. Related PUT and DELETE resource operations can write or delete files outside the storage root. Deployments with allow_readonly enabled permit anonymous reads, while other deployments require a readonly user token. Reading security.json exposes the HS256 JWT signing secret and password hashes, allowing an attacker to forge an administrator token. Administrative access to POST /skServer/providers can then create an Execute provider that runs commands with the server process privileges and persists its configuration across restarts. This issue is fixed in Signal K Server 2.34.0 and @signalk/resources-provider 1.5.3.
CVE-2026-123800 Critical 2026-11-09 Not applicable No public exploit SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in src/main/java/io/supertokens/multitenancy/Multitenancy.java does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate api_keys, an attacker holding one application's valid API key can update the parent domain because the CUD-target branch checks the domain without requiring the source application and tenant to be public. Because api_keys is not protected, the attacker can replace the parent key and then sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application's own key. In the advisory's v2 create or update handlers, omitting the optional identifier produces a base-tenant target that skips the permission branches and enterprise-feature gate, allowing changes to firstFactors, required secondary factors, and recipe-enabled flags that affect login integrity and availability. The base-target variant still rejects coreConfig and does not establish key theft. This issue is fixed in versions 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
CVE-2026-123753 Critical 2026-11-09 No exploit published No public exploit Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
CVE-2026-123751 Critical 2026-11-09 Not applicable Exploited The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This vulnerability is being actively exploited in the wild.
CVE-2026-123270 Critical 2026-11-09 Not applicable Working exploit published Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (RCE). In streams mode, the management HTTP API is exposed on `0.0.0.0:4195`, but authentication is disabled by default and there is no authentication gate protecting the stream CRUD routes. An unauthenticated attacker with network access to TCP/4195 can `POST` a malicious pipeline definition to `/streams/{id}` that includes code-executing processors such as `command`, `subprocess`, `ffi`, or unsafe `sql_raw`, thereby achieving arbitrary RCE on the host with the permissions of the Redpanda Connect service account. Because pipelines can also return command output in-band via HTTP, this vulnerability enables full host compromise, credential theft, and data exfiltration with no user interaction or credentials required. Starting with v4.111, the API endpoint was reconfigured as opt-in, so this and later versions are no longer vulnerable by default. However, RCE remains achievable on v4.111 and later if the management API is manually enabled via the `--bind-http` flag.
CVE-2026-121688 Critical 2026-11-09 Not applicable No public exploit FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.
CVE-2026-121687 Critical 2026-11-09 Not applicable No public exploit FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication. 1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-arbitrary-WiFi, diagnostic export. 2. ADB (Android Debug Bridge, port 5555) access to root shell 3. SSH (port 22)
CVE-2026-121686 Critical 2026-11-09 Not applicable No public exploit FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet.
CVE-2026-121685 Critical 2026-11-09 Not applicable No public exploit FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges.
CVE-2026-120761 Critical 2026-11-09 Protected by Waratek No public exploit Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:import were parsed by wsdl4j's own XML parser, which processes DOCTYPE declarations and external entities. An attacker who controls a WSDL, or a document it imports, could therefore read local files or make the JVM issue network requests. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
CVE-2026-119756 Critical 2026-11-09 Not applicable No public exploit Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447 that cause the log_remaining counter to go negative and writes to exceed the fixed 512-byte buffer. Attackers can exploit this flaw to crash the device or potentially achieve native code execution on ESP8266 and ESP32 platforms that lack ASLR and heap cookies.
CVE-2026-119506 Critical 2026-11-09 Not applicable No public exploit Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.
CVE-2026-119078 Critical 2026-11-09 No exploit published No public exploit Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again without supplying more input returns the same bytes. The key-derivation example in the class Javadoc, shipped since 1.16.0, derives two keys with two consecutive doFinalize calls. Code that follows it gets identical keys, so the separation between the derived keys is lost. The same applies to any application that calls doFinalize more than once on one instance and expects new output each time. This issue affects Apache Commons Codec from 1.16.0 before 1.23.0. Version 1.23.0 corrects the documentation, but the behavior of doFinalize is unchanged. Upgrading alone does not fix affected code. Users should check their applications for repeated doFinalize calls on the same Blake3 instance and derive multiple keys by requesting the combined length in one call and splitting the output, as the updated Javadoc shows.
CVE-2026-118462 Critical 2026-11-09 Not applicable No public exploit Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
CVE-2026-118196 Critical 2026-11-09 Not applicable No public exploit OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: through 1.22.0. Users are recommended to upgrade to version 1.22.1, which fixes the issue.
CVE-2026-115934 Critical 2026-11-09 Not applicable No public exploit An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search, allowing stacked query execution and enabling escalation to an administrator. Note that this only affects MySQL/MariaDB. Impact * SQL injection — The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. This gives unauthenticated read and write access to the application database. * Privilege escalation to administrator — The write primitive was used to set the admin flag on user ID 1 in the users table, confirmed by reading the value back. Craft short-circuits its permission checks on this single column, so no further changes were needed. The same primitive can overwrite any account’s password hash. Update to the patched versions (4.18.9 and 5.11.2) to get the fix. If you cannot update immediately, you can block front-end requests with %5Battribute%5D and [attribute] anywhere in the query string as a temporary mitigation.
CVE-2026-115252 Critical 2026-11-09 Not applicable No public exploit The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.
CVE-2026-115237 Critical 2026-11-09 Not applicable No public exploit The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site.
CVE-2026-115213 Critical 2026-11-09 Not applicable No public exploit The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.
CVE-2026-113364 Critical 2026-11-09 Not applicable No public exploit Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header.
CVE-2026-113363 Critical 2026-11-09 Not applicable No public exploit Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet sent to the computer on which WinShare is running.
CVE-2026-110469 Critical 2026-11-09 Not applicable No public exploit WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.
‹ prev page 3 of 440 next ›