WaratekVRT Sign in
Reset
More filters
Columns
Including CVEs outside Waratek scope✕
Overview 165,493 matches · 6,285 in Waratek scope · 690 protected · 2,677 exploited · 915 CISA KEV · 14,971 public PoC · 2,214 EPSS ≥ 0.5
165,493matches 6,285in Waratek scope3.8% 690protected0.4% 2,677exploited1.6% 915CISA KEV0.6% 14,971public PoC9.0% 2,214EPSS ≥ 0.51.3%
Protected by Waratek 693 0.4% Rule in development 3 0.0% Mitigation candidate 116 0.1% No exploit published 5,473 3.3% Outside Waratek scope 1,702 1.0% Not applicable 157,506 95.2% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 165,493 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 690 0.4% partly blocked 3 0.0% not blocked 164,798 99.6% not established 2 0.0% unrecorded 0 0.0%
Exploited 2,677 1.6% Working exploit published 12,852 7.8% Proof of concept only 15,786 9.5% Forecast only 429 0.3% No public exploit 133,749 80.8%
split by peak 40,763 / year
Not applicable: 157,506Outside Waratek scope: 1,702No exploit published: 5,473Mitigation candidate: 116Rule in development: 3Protected by Waratek: 693 High: 165,493 not established: 2not blocked: 164,798partly blocked: 3blocked by ARMR today: 690 No public exploit: 133,749Forecast only: 429Proof of concept only: 15,786Working exploit published: 12,852Exploited: 2,677
19882 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 19892 Not applicable2 High2 not blocked2 No public exploit2 19908 Not applicable8 High8 not blocked8 No public exploit8 199111 Not applicable11 High11 not blocked11 Working exploit published2 No public exploit9 199212 Not applicable12 High12 not blocked12 No public exploit12 19938 Not applicable8 High8 not blocked8 No public exploit8 199414 Not applicable14 High14 not blocked14 Working exploit published3 No public exploit11 199517 Not applicable17 High17 not blocked17 Working exploit published2 No public exploit15 199643 No exploit published1 Not applicable42 High43 not blocked43 Working exploit published12 Forecast only1 No public exploit30 1997143 Not applicable143 High143 not blocked143 Exploited2 Working exploit published51 No public exploit90 1998137 Not applicable137 High137 not blocked137 Exploited1 Working exploit published33 No public exploit103 1999423 No exploit published2 Not applicable421 High423 not blocked423 Exploited2 Working exploit published132 No public exploit289 2000454 Mitigation candidate2 No exploit published3 Outside Waratek scope2 Not applicable447 High454 not blocked454 Exploited3 Working exploit published197 Forecast only1 No public exploit253 2001776 Protected by Waratek1 No exploit published6 Outside Waratek scope5 Not applicable764 High776 blocked by ARMR today1 not blocked775 Exploited11 Working exploit published219 No public exploit546 20021,023 Protected by Waratek1 Mitigation candidate2 No exploit published8 Outside Waratek scope8 Not applicable1,004 High1,023 blocked by ARMR today1 not blocked1,022 Exploited9 Working exploit published276 Forecast only3 No public exploit735 2003674 Mitigation candidate2 No exploit published7 Outside Waratek scope4 Not applicable661 High674 not blocked674 Exploited10 Working exploit published236 No public exploit428 2004973 Protected by Waratek1 No exploit published5 Outside Waratek scope4 Not applicable963 High973 blocked by ARMR today1 not blocked972 Exploited10 Working exploit published302 No public exploit661 20052,048 No exploit published30 Outside Waratek scope10 Not applicable2,008 High2,048 not blocked2,048 Exploited11 Working exploit published658 Forecast only5 No public exploit1,374 20062,763 Protected by Waratek4 No exploit published62 Outside Waratek scope63 Not applicable2,634 High2,763 blocked by ARMR today4 not blocked2,759 Exploited26 Working exploit published1,197 Proof of concept only1 Forecast only4 No public exploit1,535 20073,162 Protected by Waratek3 Mitigation candidate1 No exploit published64 Outside Waratek scope26 Not applicable3,068 High3,162 blocked by ARMR today3 not blocked3,159 Exploited32 Working exploit published1,405 Proof of concept only1 Forecast only4 No public exploit1,720 20082,846 Protected by Waratek3 Mitigation candidate1 No exploit published42 Outside Waratek scope44 Not applicable2,756 High2,846 blocked by ARMR today3 not blocked2,843 Exploited33 Working exploit published1,492 Proof of concept only2 Forecast only8 No public exploit1,311 20092,734 Protected by Waratek3 Mitigation candidate4 No exploit published45 Outside Waratek scope26 Not applicable2,656 High2,734 blocked by ARMR today3 not blocked2,731 Exploited54 Working exploit published1,424 No public exploit1,256 20102,093 Protected by Waratek2 Mitigation candidate1 No exploit published24 Outside Waratek scope41 Not applicable2,025 High2,093 blocked by ARMR today2 not blocked2,091 Exploited53 Working exploit published730 Forecast only6 No public exploit1,304 20111,784 Protected by Waratek1 Mitigation candidate4 No exploit published15 Outside Waratek scope44 Not applicable1,720 High1,784 blocked by ARMR today1 not blocked1,783 Exploited38 Working exploit published380 Proof of concept only1 Forecast only2 No public exploit1,363 20121,724 Protected by Waratek2 Mitigation candidate2 No exploit published25 Outside Waratek scope34 Not applicable1,661 High1,724 blocked by ARMR today2 not blocked1,722 Exploited31 Working exploit published316 Proof of concept only4 Forecast only4 No public exploit1,369 20131,735 Protected by Waratek12 Mitigation candidate4 No exploit published29 Outside Waratek scope132 Not applicable1,558 High1,735 blocked by ARMR today12 not blocked1,723 Exploited62 Working exploit published241 Proof of concept only2 Forecast only15 No public exploit1,415 20141,938 Protected by Waratek9 Mitigation candidate3 No exploit published18 Outside Waratek scope74 Not applicable1,834 High1,938 blocked by ARMR today9 not blocked1,929 Exploited63 Working exploit published340 Proof of concept only5 Forecast only4 No public exploit1,526 20152,354 Protected by Waratek8 Mitigation candidate1 No exploit published33 Outside Waratek scope60 Not applicable2,252 High2,354 blocked by ARMR today8 not blocked2,346 Exploited57 Working exploit published351 Proof of concept only8 Forecast only10 No public exploit1,928 20162,895 Protected by Waratek19 Mitigation candidate7 No exploit published108 Outside Waratek scope51 Not applicable2,710 High2,895 blocked by ARMR today19 not blocked2,876 Exploited65 Working exploit published238 Proof of concept only17 Forecast only16 No public exploit2,559 20176,608 Protected by Waratek41 Mitigation candidate4 No exploit published293 Outside Waratek scope77 Not applicable6,193 High6,608 blocked by ARMR today39 partly blocked2 not blocked6,567 Exploited124 Working exploit published590 Proof of concept only24 Forecast only13 No public exploit5,857 20187,571 Protected by Waratek70 Mitigation candidate7 No exploit published225 Outside Waratek scope109 Not applicable7,160 High7,571 blocked by ARMR today70 not blocked7,501 Exploited122 Working exploit published431 Proof of concept only41 Forecast only17 No public exploit6,960 20197,227 Protected by Waratek36 Mitigation candidate8 No exploit published288 Outside Waratek scope191 Not applicable6,704 High7,227 blocked by ARMR today35 partly blocked1 not blocked7,190 not established1 Exploited149 Working exploit published339 Proof of concept only62 Forecast only26 No public exploit6,651 20207,782 Protected by Waratek64 Mitigation candidate8 No exploit published314 Outside Waratek scope161 Not applicable7,235 High7,782 blocked by ARMR today64 not blocked7,718 Exploited144 Working exploit published249 Proof of concept only90 Forecast only35 No public exploit7,264 20218,770 Protected by Waratek47 Mitigation candidate9 No exploit published290 Outside Waratek scope178 Not applicable8,246 High8,770 blocked by ARMR today47 not blocked8,723 Exploited213 Working exploit published124 Proof of concept only84 Forecast only86 No public exploit8,263 202210,337 Protected by Waratek76 Rule in development1 Mitigation candidate8 No exploit published245 Outside Waratek scope125 Not applicable9,882 High10,337 blocked by ARMR today76 not blocked10,261 Exploited174 Working exploit published173 Proof of concept only1,182 Forecast only41 No public exploit8,767 202311,637 Protected by Waratek70 Mitigation candidate13 No exploit published272 Outside Waratek scope79 Not applicable11,203 High11,637 blocked by ARMR today70 not blocked11,566 not established1 Exploited231 Working exploit published174 Proof of concept only1,924 Forecast only60 No public exploit9,248 202415,332 Protected by Waratek47 Mitigation candidate12 No exploit published196 Outside Waratek scope66 Not applicable15,011 High15,332 blocked by ARMR today47 not blocked15,285 Exploited321 Working exploit published148 Proof of concept only2,422 Forecast only59 No public exploit12,382 202516,670 Protected by Waratek27 Rule in development2 Mitigation candidate3 No exploit published180 Outside Waratek scope41 Not applicable16,417 High16,670 blocked by ARMR today27 not blocked16,643 Exploited252 Working exploit published218 Proof of concept only2,710 Forecast only7 No public exploit13,483 202640,763 Protected by Waratek146 Mitigation candidate10 No exploit published2,643 Outside Waratek scope47 Not applicable37,917 High40,763 blocked by ARMR today146 not blocked40,617 Exploited374 Working exploit published168 Proof of concept only7,206 Forecast only2 No public exploit33,013
1990199419982002200620102014201820222026
165,493 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 1,655 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-126319 High 2026-11-13 Not applicable No public exploit Dockhand before 1.0.55 contains an arbitrary file read vulnerability that allows authenticated users with stacks:create permission to read sensitive files by supplying an arbitrary composePath during stack adoption. Attackers can adopt a stack pointing to the encryption key, SQLite database, or /proc/self/environ and read it via the compose endpoint to obtain all stored credentials.
CVE-2026-126317 High 2026-11-13 Not applicable No public exploit Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users to read company details outside their permissions due to a missing permission check. Any logged-in user, including Employee role users, can query the affected endpoint to list every company on the site along with its default currency.
CVE-2026-126314 High 2026-11-13 Not applicable No public exploit Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees.
CVE-2026-126312 High 2026-11-13 Not applicable No public exploit OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules.
CVE-2026-126310 High 2026-11-13 Not applicable No public exploit OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the identity/oidc/provider/<name>/token endpoint to impersonate the client without any secret.
CVE-2026-126309 High 2026-11-13 Not applicable No public exploit OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a required_parameters name constraint can craft traversal sequences during import to write key material under arbitrary Transit key names.
CVE-2026-126308 High 2026-11-13 Not applicable No public exploit The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination.
CVE-2026-126307 High 2026-11-13 Not applicable No public exploit Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities that allow members or unauthenticated attackers to abuse NAT, DDNS, OAuth, cron, and server transfer features. Attackers can claim undeclared Dashboard hostnames to capture login bodies, hijack DDNS profiles, create executable schedules without exec scope, or exhaust memory via buffered NAT requests.
CVE-2026-126306 High 2026-11-13 Not applicable No public exploit EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator.
CVE-2026-126305 High 2026-11-13 Not applicable No public exploit EspoCRM before 9.3.11 and 10.x before 10.0.9 contains a stored cross-site scripting vulnerability in Knowledge Base articles that lets users with Knowledge Base create or edit access attach a JavaScript file and add a crafted link to the article body. When an administrator clicks the link, the script runs in their session and can create an administrator account with attacker-chosen credentials.
CVE-2026-126304 High 2026-11-13 Not applicable No public exploit NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox.
CVE-2026-126303 High 2026-11-13 Not applicable Proof of concept only NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools.
CVE-2026-126299 High 2026-11-13 Not applicable Proof of concept only NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads.
CVE-2026-126298 High 2026-11-13 Not applicable No public exploit NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread.
CVE-2026-126297 High 2026-11-13 Not applicable No public exploit NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes.
CVE-2026-126295 High 2026-11-13 Not applicable Proof of concept only NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices.
CVE-2026-126294 High 2026-11-13 Not applicable No public exploit Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa_enabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a session the API plugin accepts, gaining full account permissions including super-admin control.
CVE-2026-126293 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a server that understates or omits its length to exhaust disk space or storage quota.
CVE-2026-126291 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local part containing a single quote to execute arbitrary SQL, exposing user records, API tokens and data-source credentials.
CVE-2026-126290 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials.
CVE-2026-126286 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted link that bypasses the scheme check and reaches the anchor href or window.location, stealing the session token from localStorage for account takeover.
CVE-2026-126285 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values concatenated by CustomKnex.ts to read other tables, schemas, view-filtered rows, and hidden columns.
CVE-2026-126283 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete records on every base the token owner belongs to, including bases joined later.
CVE-2026-126282 High 2026-11-13 Not applicable No public exploit NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read, write and schema modification access across all default-workspace bases using their existing session token.
CVE-2026-126281 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own.
CVE-2026-126279 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders unescaped field references from AI field prompts as HTML in a tooltip. Attackers with the Creator role or above can store markup in a prompt's field reference that executes when victims open the field configuration, stealing the localStorage session token to call authenticated APIs as the victim.
CVE-2026-126278 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out.
CVE-2026-126277 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust server resources by sending unbounded filter arrays to shared-view bulk endpoints. Attackers with a shared view UUID can POST a large body of minimal filter objects, triggering a full database query per entry, to crash the NocoDB process.
CVE-2026-126276 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.08.1 contains an authentication bypass vulnerability in oauth-token.service.ts that treats PKCE as a substitute for confidential client authentication, skipping client secret verification when omitted. Attackers holding a captured authorization code and PKCE verifier can mint access tokens and 60-day refresh tokens for a confidential client without knowing its secret.
CVE-2026-126275 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plant decoy tables and duplicate comment ids to spoof teammates' comments.
CVE-2026-126272 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass bulk row-count limits by using session authentication instead of API tokens. Attackers with Editor write permission on one table can submit hundreds of thousands of rows to v1 and v2 bulk write routes, exhausting database connections, CPU, and memory.
CVE-2026-126271 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers retrieve the decrypted private key, client certificate and CA to connect directly to the external database, bypassing NocoDB permissions.
CVE-2026-126267 High 2026-11-13 Not applicable No public exploit NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup condition undefined, causing knex binding errors in the unawaited logHelper call that terminate the server process.
CVE-2026-126266 High 2026-11-13 Not applicable No public exploit SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field.
CVE-2026-126264 High 2026-11-13 Not applicable No public exploit SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced widgets to obtain API keys, tokens, or other stored secrets.
CVE-2026-126091 High 2026-11-13 Not applicable No public exploit Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.
CVE-2026-125856 High 2026-11-13 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Reflected XSS.This issue affects Dynamic User Directory: from n/a through 2.4.
CVE-2026-125854 High 2026-11-13 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unbounce Unbounce Landing Pages unbounce allows Stored XSS.This issue affects Unbounce Landing Pages: from n/a through 1.1.6.
CVE-2026-125852 High 2026-11-13 Not applicable No public exploit Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Path Traversal.This issue affects Realtyna Organic IDX plugin: from n/a through 5.5.0.
CVE-2026-125837 High 2026-11-13 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thethemefoundry Make make allows Reflected XSS.This issue affects Make: from n/a through 1.10.10.
CVE-2026-125811 High 2026-11-13 Not applicable No public exploit Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in myCred myCred mycred allows Blind SQL Injection.This issue affects myCred: from n/a through 4.0.2.
CVE-2026-125783 High 2026-11-13 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madalin.ungureanu Custom Post Types and Custom Fields creator – WCK wck-custom-fields-and-custom-post-types-creator allows Reflected XSS.This issue affects Custom Post Types and Custom Fields creator – WCK: from n/a through 2.4.0.
CVE-2026-125452 High 2026-11-13 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM Basic wpjam-basic allows Reflected XSS.This issue affects WPJAM Basic: from n/a through 7.1.2.
CVE-2026-124761 High 2026-11-13 Not applicable No public exploit P-Net before 1.0.4 copies the IP suite of a DCP Set request to the current and the non-volatile configuration, and starts saving it, before the state of the device is checked. If the request is refused, for example because an Application Relationship is active, the configuration is not restored and is still saved. After a restart the device uses the refused address, and may not answer the controller or may use its address. A host with ADJACENT network access can use this while an Application Relationship is active.
CVE-2026-124759 High 2026-11-13 Not applicable No public exploit P-Net before 1.0.4 routes a received RTA alarm frame to an Application Relationship using only the destination alarm reference in the frame, without checking the source of the frame. A host with ADJACENT network access can abort an established Application Relationship with a single alarm ERROR frame, or deliver forged alarm notifications with chosen type, slot, subslot, USI and payload to the application.
CVE-2026-124680 High 2026-11-13 Not applicable No public exploit Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX. An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the same upstream and the upstream does not collapse encoded dot segments. This issue affects Apache APISIX: from 0.9 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.
CVE-2026-124679 High 2026-11-13 Not applicable No public exploit Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable. This issue affects Apache APISIX: from 3.18.0 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.
CVE-2026-124420 High 2026-11-13 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Woody ad snippets insert-php allows Reflected XSS.This issue affects Woody ad snippets: from n/a through 2.7.10.
CVE-2026-124410 High 2026-11-13 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpLingua Translation Service Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua wplingua allows Stored XSS.This issue affects Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua: from n/a through 3.1.1.
CVE-2026-124279 High 2026-11-13 Not applicable No public exploit Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests. The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with max_body_size only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all. This issue affects grpc_server: from 1.0.0 before 1.1.0.
CVE-2026-124278 High 2026-11-13 Not applicable No public exploit Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type. Only the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another. This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.
CVE-2026-124272 High 2026-11-13 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.14.
CVE-2026-124267 High 2026-11-13 Not applicable No public exploit Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23.
CVE-2026-124265 High 2026-11-13 Not applicable No public exploit Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.
CVE-2026-124260 High 2026-11-13 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.06.001.
CVE-2026-124218 High 2026-11-13 Not applicable Exploited The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the remove_files function in all versions up to, and including, 1.6.2 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is reachable when the "yeepdf_not_save" privacy option is enabled, a commonly used production setting that triggers the remove_files() cleanup path.
CVE-2026-123975 High 2026-11-13 Not applicable No public exploit Grid Community Toolkit before 6.2.20261111 (globus-gss-assist before 12.9) contains a heap out-of-bounds write in globus_gss_assist_token_get_fd() triggered by SSLv2 record lengths below 3. Remote unauthenticated clients can send a crafted GSI handshake record to services like globus-gatekeeper and myproxy to corrupt heap memory and crash the service.
CVE-2026-123769 High 2026-11-13 Not applicable No public exploit The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.13.0 This is due to the `save_settings()` REST handler at `/suredash/v1/save-settings` being gated only by `admin_permission_callback()`, which authorizes any holder of the custom `manage_portal_dashboard` capability (Portal Manager role) without requiring `promote_users`, `edit_users`, or `manage_options`, combined with `sanitize_settings_data()` iterating all attacker-supplied keys with no allow-list, allowing arbitrary keys such as `default_role` to pass through `sanitize_text_field()` unchanged and be persisted into the `portal_settings` option via `update_option()` with no role-validity check. This makes it possible for authenticated attackers with Portal Manager-level access and above to poison the `default_role` setting to `administrator`, after which any subsequent new-user registration through the publicly accessible block-register endpoint reads the corrupted setting and passes it directly to `wp_insert_user()`, producing a full WordPress Administrator account under the attacker's control. The exploit requires two steps: a POST to the authenticated `save-settings` endpoint to overwrite `default_role`, followed by triggering a new registration through the unauthenticated block-register endpoint to receive the escalated account. Successful exploitation causes the attacker's own account to receive the complete administrator role.
CVE-2026-123628 High 2026-11-13 Not applicable No public exploit IBM webMethods Integration Server 10.15 and 11.1 could allow a remote attacker to obtain sensitive information due to an exposure of sensitive server-side environment variables and Java runtime details.
CVE-2026-123177 High 2026-11-13 Not applicable No public exploit A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader that may store fetched content in a world-readable cache without size limits, or open local paths as root, allowing a local attacker to disclose privileged content and to deny service via disk exhaustion.
CVE-2026-121809 High 2026-11-13 Not applicable No public exploit Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message. GRPC.Server.Adapters.Cowboy.read_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with END_STREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers. This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0.
CVE-2026-121808 High 2026-11-13 Not applicable No public exploit Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body. GRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body. This issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0.
CVE-2026-120867 High 2026-11-13 Not applicable No public exploit Memory overflow in SSL/TLS/DTLS can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
CVE-2026-120866 High 2026-11-13 Not applicable No public exploit Memory overflow / improper handling in BGP dynamic routing can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
CVE-2026-120865 High 2026-11-13 Not applicable No public exploit Memory overflow in HTTP/3 (QUIC) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
CVE-2026-120863 High 2026-11-13 Not applicable No public exploit Memory overflow in the management plane can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
CVE-2026-120862 High 2026-11-13 Not applicable No public exploit Memory overflow in SIP ALG (LSN) and DNS answer-section logging datapaths can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
CVE-2026-120861 High 2026-11-13 Not applicable No public exploit Memory overflow / improper handling in GSLB and geolocation (MEP, static-proximity, config-sync) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
CVE-2026-120860 High 2026-11-13 Not applicable No public exploit Memory overflow in protocol load-balancing traffic handling (Diameter, SIP-over-TCP, MQTT, RADIUS) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
CVE-2026-120835 High 2026-11-13 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.11.
CVE-2026-120688 High 2026-11-13 Not applicable No public exploit The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT (demonstrated); more generally, any attacker-controllable DB column the saved report selects' parameter in all versions up to, and including, 5.25.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have saved a SQL report that selects an attacker-controllable database column, such as wp_comments.comment_agent, which WordPress stores verbatim from unauthenticated visitors even when comments are pending moderation.
CVE-2026-120221 High 2026-11-13 Not applicable No public exploit In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured ("neighbor PG soo"). Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its own when the neighbor is deleted, which happens as soon as its connection closes. The first disconnect leaves the peer-group pointing at freed memory, and the second disconnect frees it again, causing bgpd to abort and drop all BGP sessions on the router. Any host whose address falls inside the listen range can trigger this by opening and closing two TCP connections to the BGP port, without sending any BGP message and without knowing the AS number, and can repeat it each time bgpd restarts. If the peer-group has a TCP-MD5 password, only hosts that know the password can trigger it. Two ordinary flaps of legitimate dynamic neighbors have the same effect. Between the two frees, displaying the configuration ("show running-config") or establishing a dynamic neighbor also reads the freed memory, which can crash bgpd after a single disconnect. Only configurations that combine a listen range with a SoO on the same peer-group are affected.
CVE-2026-119517 High 2026-11-13 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna – Woo Name Your Price and Offers catna-woo-name-your-price-and-offers allows Reflected XSS.This issue affects Catna – Woo Name Your Price and Offers: from n/a through 2.0.3.
CVE-2026-119512 High 2026-11-13 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.2.
CVE-2026-118976 High 2026-11-13 Not applicable No public exploit In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder that are within the server's filesystem scope.
CVE-2026-118191 High 2026-11-13 Not applicable No public exploit The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_job function in all versions up to, and including, 4.5.5 This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The 'NextGEN Manage gallery' capability required to reach the vulnerable endpoint is granted to Administrators by default but can be delegated to lower-privileged roles via the plugin's Roles screen.
CVE-2026-116615 High 2026-11-13 Not applicable No public exploit The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the `post_content` parameter. This is due to asymmetric parsing between the save-time strip filter (`widgetopts_strip_logic_from_blocks()`) and the render-time parser (`blockopts_filter_before_display()`): embedding an inner `<!--start_widgetopts` literal inside a JSON key causes the write-side `json_decode` to see a non-`class` key and skip stripping — persisting the payload verbatim to the database — while the render-side `str_replace` reconstitutes the key to `class`, feeding the attacker-controlled `logic` value directly into `@eval`. This makes it possible for authenticated attackers, with Author-level access and above, to inject PHP expressions that execute on every front-end page view, enabling boolean-oracle exfiltration of WordPress site configuration data — including admin email address, default role, and arbitrary `get_option`, `get_user_meta`, and `get_post_meta` values — via the plugin's allowlisted-function sandbox, which escalates to unrestricted code execution if any installed plugin extends the `widgetopts_allowed_php_functions` filter. Contributors can also exploit this vulnerability when their submitted post is later published by an administrator; notably, the injected payload executes for all site visitors, including unauthenticated users, because a trust-flag mechanism introduced in version 4.2.6 causes `widgetopts_safe_eval_trusted()` to bypass its non-admin short-circuit at every legacy render callsite. Exploitation by attackers with contributor-level access and above requires that an administrator (or editor) later publishes the contributor's submission. On a default installation, where that is not configured, the vulnerability requires attackers with author-level access and above.
CVE-2026-116418 High 2026-11-13 Not applicable No public exploit Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVE-2026-116417 High 2026-11-13 Not applicable No public exploit Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Weak Password Requirements vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Unauthorized access.
CVE-2026-116413 High 2026-11-13 Not applicable No public exploit Dell PowerStore contains a use-of-broken-cryptography vulnerability. A low-privileged attacker could exploit it to impersonate another identity, potentially leading to unauthorized access.
CVE-2026-116411 High 2026-11-13 Not applicable No public exploit Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability, potentially leading to information disclosure via requests to internal services.
CVE-2026-115788 High 2026-11-13 Not applicable No public exploit IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a request to create a resource.
CVE-2026-112182 High 2026-11-13 Not applicable No public exploit Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints `registerProcessDefinition` and `runProcessDefinition` require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the `ROLE_USER` role can register and execute a process definition containing BeanShell scripts, allowing them to execute Java code and operating system commands with the service’s privileges. In the official Docker image, the process runs as root.
CVE-2026-112181 High 2026-11-13 Not applicable No public exploit Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attacker with the ROLE_USER role can exploit the flaw via a REST request. In the 6.3.x branch, this allows the attacker to trigger HTTP requests under their control (SSRF); in 7.0.3, it allows the attacker to read local files and access internal HTTP resources from the server.
CVE-2026-111547 High 2026-11-13 Not applicable No public exploit Dell PowerStore contains an out-of-bounds read vulnerability. An attacker could exploit this vulnerability, potentially leading to denial of service or limited information disclosure.
CVE-2026-111545 High 2026-11-13 Not applicable No public exploit Dell PowerStore contains a SQL Injection vulnerability. An authenticated attacker could exploit this vulnerability, potentially leading to disclosure of stored private keys and tampering with trusted certificates.
CVE-2026-111342 High 2026-11-13 Not applicable No public exploit Memory overflow in LDAP authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
CVE-2026-111341 High 2026-11-13 Not applicable No public exploit Memory overflow in client-certificate authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
CVE-2026-111340 High 2026-11-13 Not applicable No public exploit Memory overflow in KBA (knowledge-based authentication) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
CVE-2026-111337 High 2026-11-13 Not applicable No public exploit Memory overflow in Base64 decoding in advanced policy expressions leading to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
CVE-2026-111336 High 2026-11-13 Not applicable No public exploit Memory overflow in HTTP/2 handling can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
CVE-2026-110331 High 2026-11-13 Not applicable No public exploit A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard and again poison elements in, or seize ownership of, dump directories while privileged ABRT handlers are processing them. Related Problems2 mutating methods remain ungated by the same check.
CVE-2026-110279 High 2026-11-13 Not applicable No public exploit IBM ContextForge MCP Gateway 1.0.0 through 1.1.0 is vulnerable to improper credential handling because the X-Upstream-Authorization request header can override the gateway-managed upstream credential for OAuth (authorization_code and client_credentials), bearer and basic authenticated gateways, which could allow an authenticated user to cause upstream requests to be made with a different credential and bypass per-user permission and audit attribution.
CVE-2026-110278 High 2026-11-13 Not applicable No public exploit IBM ContextForge MCP Gateway 1.0.0 through 1.1.0 could allow an attacker to replay identity propagation claims signatures or expose sensitive user identity information to third-party MCP servers due to static signature payloads and missing per-gateway configuration checks during tool invocation.
CVE-2026-109903 High 2026-11-13 Not applicable No public exploit A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before 21.1.26 and xwayland before 24.1.15 could be used to causes crashes by authenticated X clients.
CVE-2026-109158 High 2026-11-13 Not applicable No public exploit IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sensitive information about the deployed environment within error messages.
CVE-2026-109094 High 2026-11-13 Not applicable No public exploit A integer overflow that can lead to a buffer overrread in the XRes QueryResourceBytes Swap Path in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 on 32bit systems could be used by authenticated clients to crash the X server.
CVE-2026-109093 High 2026-11-13 Not applicable No public exploit A stack buffer overflow in  ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash or execute code in the X server.
CVE-2026-109092 High 2026-11-13 Not applicable No public exploit Incorrectly handled negative sizes when processing ProcXvShmPutImage requests in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by local authenticated X clients to crash the X server or execute code.
CVE-2026-109091 High 2026-11-13 Not applicable No public exploit A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by malicious monitors to crash the x server or execute cote.
‹ prev page 3 of 1,655 next ›